Function at 0x1400d6470
Capabilities:
Create process on windows
Get common file path
Set registry value

Disassembly:
push rbp
push rbx
push r13
push r15
lea rbp, [rsp - 0x3f]
sub rsp, 0xe8
xor r13d, r13d
lea r9, [0x14018abe8]
mov qword [rsp + 0x30], r13
mov rbx, rdx
mov r15, rcx
mov dword [rsp + 0x28], r13d
mov edx, 0x20006
mov dword [rsp + 0x20], r13d
mov r8, 0xfffffffffffffff7
lea rcx, [rbp + 0x7f]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhCreateKey
test eax, eax
js 0x1400d6819
mov qword [rsp + 0x110], rsi
lea rax, str.LastKey
mov qword [rsp + 0xe0], rdi
mov rcx, rbx
mov qword [rsp + 0xd8], r12
mov qword [rsp + 0xd0], r14
mov dword [rbp + 7], 0x10000e
mov qword [rbp + 0xf], rax
call fcn.1400d5af0
mov r9d, 1
lea rdx, [rbp + 7]
xor r8d, r8d
mov rbx, rax
mov ecx, dword [rax]
add ecx, 2
mov dword [rsp + 0x28], ecx
mov rcx, qword [rax + 8]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbp + 0x7f]
call qword [sym.imp.ntdll.dll_NtSetValueKey]
mov rsi, 0xffffffffffffffff
lea rcx, [rbx - 0x10]
mov eax, esi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400d6541
call fcn.1400d9400
mov rcx, qword [rbp + 0x7f]
call qword [sym.imp.ntdll.dll_NtClose]
cmp byte [0x14018dbaa], 1
lea r12, str._regedit.exe
jb 0x1400d65c8
mov rdx, r12
mov rcx, r12
and rdx, 0xfffffffffffffff1
xorps xmm1, xmm1
and ecx, 0xf
je 0x1400d658d
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
sar eax, cl
bsf ecx, eax
mov dword [rbp + 0x77], ecx
je 0x1400d6589
mov edx, ecx
shr rdx, 1
jmp 0x1400d65cd
add rdx, 0x10
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
bsf ecx, eax
mov dword [rbp + 0x77], ecx
jne 0x1400d65b8
add rdx, 0x10
movdqa xmm0, xmm1
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
bsf ecx, eax
mov dword [rbp + 0x77], ecx
je 0x1400d65a0
sub rdx, r12
mov eax, ecx
sar rdx, 1
shr rax, 1
add rdx, rax
jmp 0x1400d65cd
mov edx, 0xc
lea r14, [rdx + rdx]
mov rdx, qword [0x140191180]
lea rbx, [r14 + 0x208]
lea rcx, [rbx + 0x12]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhCreateObject
xor r9d, r9d
xor r8d, r8d
mov edx, 0x24
mov rdi, rax
lea rcx, [rax + 0x10]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov word [rcx + rbx], r13w
mov rcx, qword [rax + 8]
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x1400d66db
cmp byte [0x14018dbaa], 1
mov r9, qword [rdi + 8]
jb 0x1400d66a8
mov rdx, r9
mov ecx, r9d
and rdx, 0xfffffffffffffff1
xorps xmm1, xmm1
and ecx, 0xf
je 0x1400d665e
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
sar eax, cl
bsf ecx, eax
mov dword [rbp + 0x77], ecx
je 0x1400d665a
mov edx, ecx
shr rdx, 1
jmp 0x1400d66ba
add rdx, 0x10
xorps xmm0, xmm0
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
bsf ecx, eax
mov dword [rbp + 0x77], ecx
jne 0x1400d6698
nop dword [rax]
nop word [rax + rax]
add rdx, 0x10
movdqa xmm0, xmm1
pcmpeqw xmm0, xmmword [rdx]
pmovmskb eax, xmm0
bsf ecx, eax
mov dword [rbp + 0x77], ecx
je 0x1400d6680
sub rdx, r9
mov eax, ecx
sar rdx, 1
shr rax, 1
add rdx, rax
jmp 0x1400d66ba
mov rdx, rsi
nop dword [rax + rax]
inc rdx
cmp word [r9 + rdx*2], r13w
jne 0x1400d66b0
lea rax, [rdx + rdx]
mov rdx, r12
lea rcx, [rax + r9]
mov qword [rdi], rax
lea r8, [r14 + 2]
call fcn.1401317c0
add qword [rdi], r14
test rdi, rdi
jne 0x1400d673a
jmp 0x1400d66f0
lea rcx, [rdi - 0x10]
mov eax, esi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400d66f0
call fcn.1400d9400
mov rdx, qword [0x140191180]
mov ecx, 0x28
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhCreateObject
mov rdi, rax
mov qword [rax], 0x16
add rax, 0x10
mov qword [rdi + 8], rax
mov word [rax + 0x16], r13w
mov rcx, qword [rdi + 8]
movups xmm0, xmmword [str.regedit.exe]
movups xmmword [rcx], xmm0
mov eax, dword [0x140166a18]
mov dword [rcx + 0x10], eax
movzx eax, word [0x140166a1c]
mov word [rcx + 0x14], ax
lea rcx, [rbp + 0x17]
call sym.4yUlCM3HuVsHzW5CaCX.exe_PhGetOwnTokenAttributes
mov r14, qword [rsp + 0xd0]
xorps xmm0, xmm0
mov r12, qword [rsp + 0xd8]
movups xmmword [rbp - 0x55], xmm0
mov ecx, dword [rax + 8]
mov rax, qword [rdi + 8]
mov qword [rbp - 0x51], rax
lea rax, [0x14013e488]
mov dword [rbp - 0x69], 0x70
movups xmmword [rbp - 0x65], xmm0
mov qword [rbp - 0x61], r15
movups xmmword [rbp - 0x45], xmm0
mov qword [rbp - 0x49], rax
movups xmmword [rbp - 0x35], xmm0
movups xmmword [rbp - 0x25], xmm0
movups xmmword [rbp - 0x15], xmm0
and ecx, 1
jne 0x1400d67dc
xor ecx, ecx
mov dword [rbp - 0x65], 0x40
cmp dword [sym.4yUlCM3HuVsHzW5CaCX.exe_WindowsVersion], 0x3c
lea rax, str.runas
mov qword [rbp - 5], rcx
cmovb rax, qword [rbp - 0x59]
mov dword [rbp + 3], ecx
lea rcx, [rbp - 0x69]
mov qword [rbp - 0x59], rax
mov dword [rbp - 0x39], 1
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x1400d67f6
mov rcx, qword [rbp - 1]
call qword [sym.imp.ntdll.dll_NtClose]
jmp 0x1400d67f6
xor ecx, ecx
mov dword [rbp - 0x39], 5
mov qword [rbp - 5], rcx
mov dword [rbp + 3], ecx
lea rcx, [rbp - 0x69]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
lea rcx, [rdi - 0x10]
lock xadd dword [rcx + 8], esi
mov rdi, qword [rsp + 0xe0]
cmp esi, 1
mov rsi, qword [rsp + 0x110]
jne 0x1400d6819
call fcn.1400d9400
add rsp, 0xe8
pop r15
pop r13
pop rbx
pop rbp
ret