Function at 0x140001010
Capabilities:
Create process on windows
Query or enumerate registry value
Terminate process

Disassembly:
push rbp
lea rbp, [rsp - 0x16b0]
mov eax, 0x17b0
call fcn.140028100
sub rsp, rax
mov rax, qword [0x140052008]
xor rax, rsp
mov qword [rbp + 0x1690], rax
call fcn.140006340
test eax, eax
jne 0x14000104b
mov eax, 1
jmp 0x1400015aa
mov qword [rsp + 0x17d0], rdi
mov qword [rsp + 0x17d8], r12
mov qword [rsp + 0x17a8], r14
call fcn.1400054e0
mov rcx, rax
call fcn.140005520
xor edx, edx
mov ecx, 0x20004
mov r14, rax
call fcn.140005cc0
mov edx, 3
mov ecx, 0x22002
call fcn.140005cc0
mov edx, 3
mov ecx, 0x22003
call fcn.140005cc0
mov edx, dword [r14 + 8]
mov ecx, 0x21001
call fcn.140005cc0
mov edx, dword [r14 + 0xc]
mov ecx, 0x21002
call fcn.140005cc0
mov edx, dword [r14 + 0x10]
mov ecx, 0x21003
call fcn.140005cc0
mov edx, 8
mov ecx, 0x21004
call fcn.140005cc0
mov edx, 0x18
mov ecx, 0x21005
call fcn.140005cc0
mov edx, 8
mov ecx, 0x21006
call fcn.140005cc0
xor r12d, r12d
lea r8, str.glText
xor r9d, r9d
mov qword [rsp + 0x20], r12
mov edx, 0x1e0
mov ecx, 0x280
call fcn.140005740
mov rdi, rax
test rax, rax
jne 0x14000112a
call fcn.140006410
lea eax, [rdi + 1]
jmp 0x140001592
mov qword [rsp + 0x17c0], rbx
mov rcx, rdi
mov qword [rsp + 0x17c8], rsi
call fcn.140003ce0
mov ecx, 1
call fcn.140003d80
movups xmm0, xmmword [str.FbsgjnerZvpebfbsgVagrearg_RkcybereZnva]
movzx eax, word [0x14004d530]
mov rsi, 0xffffffffffffffff
movups xmm1, xmmword [0x14004d518]
mov word [rbp + 0x1688], ax
lea rax, [rbp + 0x1660]
movups xmmword [rbp + 0x1660], xmm0
mov dword [rbp + 0xa98], 4
movsd xmm0, qword [0x14004d528]
movsd qword [rbp + 0x1680], xmm0
mov dword [rbp + 0xa9c], 4
movups xmmword [rbp + 0x1670], xmm1
nop dword [rax + rax]
inc rsi
cmp byte [rax + rsi], r12b
jne 0x1400011b0
mov rbx, r12
test rsi, rsi
je 0x14000123b
mov qword [rsp + 0x17a0], r15
mov r15d, 0x41
nop
movsx ecx, byte [rbp + rbx + 0x1660]
call fcn.140014160
test eax, eax
je 0x14000122b
movsx ecx, byte [rbp + rbx + 0x1660]
call fcn.1400142c0
test eax, eax
mov ecx, 0x61
mov eax, 0x4ec4ec4f
cmovne ecx, r15d
movzx r8d, cl
movsx ecx, byte [rbp + rbx + 0x1660]
sub ecx, r8d
add ecx, 0xd
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x1a
sub ecx, eax
add cl, r8b
mov byte [rbp + rbx + 0x1660], cl
inc rbx
cmp rbx, rsi
jb 0x1400011d0
mov r15, qword [rsp + 0x17a0]
lea rax, [rbp + 0xa90]
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x1660]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400012cc
mov rcx, qword [rbp + 0xa90]
lea rax, [rbp + 0xa9c]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0xa98]
lea rax, [rbp + 0xaa0]
xor r8d, r8d
lea rdx, str.IsStatus
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400012bf
cmp dword [rbp + 0xa98], 4
jne 0x1400012bf
mov rcx, qword [rbp + 0xa90]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x140001582
mov rcx, qword [rbp + 0xa90]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.1400021a0
test eax, eax
je 0x140001582
mov rcx, rdi
call fcn.140003ce0
mov ecx, 1
call fcn.140003d80
call fcn.140001d00
test eax, eax
je 0x14000150f
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov ecx, 0x12c
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov edx, 0xfffffed4
sub edx, ebx
movsxd rdx, edx
add rax, rdx
mov r9, rax
shr r9, 0x20
mov r8d, r9d
xor r8d, eax
sub r8d, r9d
cmp r8d, 0x64
jg 0x14000150f
xor edx, edx
mov ecx, 0x20004
call fcn.140005cc0
mov edx, 3
mov ecx, 0x22002
call fcn.140005cc0
mov edx, 3
mov ecx, 0x22003
call fcn.140005cc0
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov rsi, rax
mov ebx, 0xa
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x1f4
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Beep]
sub rbx, 1
jne 0x140001371
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
sub eax, esi
cmp eax, 0x2710
jl 0x1400015c2
lea rcx, [rsp + 0x50]
call fcn.140001870
lea rcx, [rbp + 0xb20]
mov rdx, rax
mov r8d, 0xb3e
call fcn.14000f2b0
mov edx, dword [r14 + 8]
mov ecx, 0x21001
call fcn.140005cc0
mov edx, dword [r14 + 0xc]
mov ecx, 0x21002
call fcn.140005cc0
mov edx, dword [r14 + 0x10]
mov ecx, 0x21003
call fcn.140005cc0
lea edx, [rbx + 0x65]
lea rcx, [rbp + 0xc36]
call fcn.140002220
lea edx, [rbx + 0x66]
lea rcx, [rbp + 0xd3a]
call fcn.140002220
lea edx, [rbx + 0x67]
lea rcx, [rbp + 0xf42]
call fcn.140002220
lea edx, [rbx + 0x68]
lea rcx, [rbp + 0xe3e]
call fcn.140002220
mov rcx, rdi
call fcn.140003ce0
lea ecx, [rbx + 1]
call fcn.140003d80
xorps xmm0, xmm0
lea rcx, [rbp + 0xc36]
xor eax, eax
xor r9d, r9d
mov qword [rbp + 0xb10], rax
xor r8d, r8d
mov qword [rbp + 0x1670], rax
xor edx, edx
lea rax, [rbp + 0x1660]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0xab0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], r12d
movups xmmword [rbp + 0xab0], xmm0
movups xmmword [rbp + 0xac0], xmm0
movups xmmword [rbp + 0xad0], xmm0
movups xmmword [rbp + 0xae0], xmm0
movups xmmword [rbp + 0xaf0], xmm0
movups xmmword [rbp + 0xb00], xmm0
movups xmmword [rbp + 0x1660], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x1400014e0
mov rcx, qword [rbp + 0x1660]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x1668]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [r14 + 8]
mov ecx, 0x21001
call fcn.140005cc0
mov edx, dword [r14 + 0xc]
mov ecx, 0x21002
call fcn.140005cc0
mov edx, dword [r14 + 0x10]
mov ecx, 0x21003
call fcn.140005cc0
call fcn.140001a80
mov rcx, rdi
call fcn.140005fd0
test eax, eax
je 0x140001570
nop dword [rax + rax]
call fcn.140004630
lea r8, [rbp + 0xaa4]
mov rcx, rdi
lea rdx, [rbp + 0xaa8]
call fcn.140005c70
mov edx, 0x100
mov rcx, rdi
call fcn.1400045b0
test eax, eax
je 0x140001559
mov edx, 1
mov rcx, rdi
call fcn.140005ca0
mov ecx, 0x100
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rdi
call fcn.140005fd0
test eax, eax
jne 0x140001520
mov rcx, rdi
call fcn.140005b90
call fcn.140006410
mov eax, 1
mov rsi, qword [rsp + 0x17c8]
mov rbx, qword [rsp + 0x17c0]
mov rdi, qword [rsp + 0x17d0]
mov r12, qword [rsp + 0x17d8]
mov r14, qword [rsp + 0x17a8]
mov rcx, qword [rbp + 0x1690]
xor rcx, rsp
call fcn.140002380
add rsp, 0x17b0
pop rbp
ret
call fcn.140002320
call fcn.1400022c0
call fcn.1400021a0
lea rcx, [rsp + 0x50]
call fcn.140001870
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]