Function at 0x1400047f0
Capabilities:
Accept command line arguments
Check mutex and terminate process on windows
Check mutex on windows
Create process on windows
Delete registry value
Get common file path
Persist via run registry key
Terminate process

Disassembly:
sub rsp, 0x378
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x60], rax
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0x58], rax
lea rdx, str.C77F29ED_F95F_4E5C_BAE0_F5A83D34CB62
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x14000491f
call fcn.14000f710
mov qword [rsp + 0x68], rax
cmp qword [rsp + 0x68], 0
je 0x14000485f
xor edx, edx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x70], 0
call qword [sym.imp.SHELL32.dll_IsUserAnAdmin]
cmp eax, 1
jne 0x140004894
lea r9, str.95DECE3C_1EA8_4D11_9DED_9E9B0FB631C1
mov r8d, 1
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x70], rax
jmp 0x1400048b0
lea r9, str.95DECE3C_1EA8_4D11_9DED_9E9B0FB631C1
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x70], rax
xor eax, eax
cmp eax, 1
je 0x1400048fd
mov qword [rsp + 0x78], 0
lea r8, str.AB56F979_1BB6_4E67_B697_5291740DCCC3
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov qword [rsp + 0x78], rax
cmp qword [rsp + 0x78], 0
je 0x1400048f9
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400048b0
jmp 0x1400048fd
cmp qword [rsp + 0x70], 0
je 0x140004910
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x1400056d1
lea rdx, str.9F826003_D3B0_4B0A_B892_460FD432AE4A
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140004a4e
lea r8, str.F12554D8_D520_4F73_9B56_8BA1ED5E0CB3
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov qword [rsp + 0x88], rax
cmp qword [rsp + 0x88], 0
je 0x14000498c
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x90], eax
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8, str.509C42FF_B4CB_4610_8290_30C245B32593
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov qword [rsp + 0x80], rax
cmp qword [rsp + 0x80], 0
je 0x1400049db
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x94], eax
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp eax, 1
je 0x140004a34
mov qword [rsp + 0x98], 0
lea r8, str.AB56F979_1BB6_4E67_B697_5291740DCCC3
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov qword [rsp + 0x98], rax
cmp qword [rsp + 0x98], 0
je 0x140004a30
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400049db
jmp 0x140004a34
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 1
jmp 0x1400056d1
lea rdx, str.E48FEC91_691F_4E6B_A4F3_8B9195566D9B
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140004b7d
lea r8, str.F12554D8_D520_4F73_9B56_8BA1ED5E0CB3
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov qword [rsp + 0xa8], rax
cmp qword [rsp + 0xa8], 0
je 0x140004abb
mov edx, 0xffffffff
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0xb0], eax
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8, str.509C42FF_B4CB_4610_8290_30C245B32593
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov qword [rsp + 0xa0], rax
cmp qword [rsp + 0xa0], 0
je 0x140004b0a
mov edx, 0xffffffff
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0xb4], eax
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp eax, 1
je 0x140004b63
mov qword [rsp + 0xb8], 0
lea r8, str.AB56F979_1BB6_4E67_B697_5291740DCCC3
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov qword [rsp + 0xb8], rax
cmp qword [rsp + 0xb8], 0
je 0x140004b5f
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140004b0a
jmp 0x140004b63
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 1
jmp 0x1400056d1
lea rdx, str.147C02A7_6071_4FCA_A540_F7C9E69737FF
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140004c0a
xor eax, eax
cmp eax, 1
je 0x140004bf0
mov qword [rsp + 0xc0], 0
lea r8, str.AB56F979_1BB6_4E67_B697_5291740DCCC3
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov qword [rsp + 0xc0], rax
cmp qword [rsp + 0xc0], 0
je 0x140004bec
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140004b97
jmp 0x140004bf0
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 1
jmp 0x1400056d1
lea rdx, str.397BB29C_3E5A_4687_AF34_347060730433
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140004fde
mov qword [rsp + 0xd8], 0
lea rdx, [rsp + 0xc8]
lea rcx, [0x14003a1d0]
call fcn.140005d80
mov qword [rsp + 0xd0], rax
cmp qword [rsp + 0xd0], 0
je 0x140004fb8
lea rdx, [rsp + 0xe8]
lea rcx, [0x14003a1d0]
call fcn.140005fe0
mov qword [rsp + 0xe0], rax
cmp qword [rsp + 0xe0], 0
je 0x140004faa
mov edx, 0xfffe
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0xd8], rax
cmp qword [rsp + 0xd8], 0
je 0x140004faa
mov rdx, qword [rsp + 0xd8]
mov ecx, 0x7fff
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jbe 0x140004faa
lea r8, str.165B93F1_E1F8_49D4_9E9B_C9F9465DE6D8
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xf0], rax
cmp qword [rsp + 0xf0], 0
je 0x140004f9c
xor edx, edx
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0xf8], eax
cmp dword [rsp + 0xf8], 0
je 0x140004d29
cmp dword [rsp + 0xf8], 0x80
jne 0x140004f80
lea r8, str.AB56F979_1BB6_4E67_B697_5291740DCCC3
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov qword [rsp + 0x190], rax
cmp qword [rsp + 0x190], 0
je 0x140004d6b
mov rcx, qword [rsp + 0x190]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140004d29
cmp dword [0x14003c040], 1
jne 0x140004db7
lea r8, [rsp + 0x1d0]
lea rdx, [0x140025e50]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x140004db7
lea rdx, [0x14003c114]
mov rcx, qword [rsp + 0x1d0]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x1d0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x14003c03c], 1
jne 0x140004e03
lea r8, [rsp + 0x1d8]
lea rdx, [0x140025eb0]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x140004e03
lea rdx, str.AB1F3E47_AEF1_400E_A108_233A046C3A34
mov rcx, qword [rsp + 0x1d8]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x1d8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r8d, gethostname
xor edx, edx
lea rcx, [rsp + 0x198]
call fcn.140019ba0
mov dword [rsp + 0x1a0], 3
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x1a8], rax
mov eax, 0x614
mov word [rsp + 0x1b8], ax
mov dword [rsp + 0x118], 0
lea rcx, [rsp + 0x198]
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
je 0x140004e86
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rsp + 0x118]
inc eax
mov dword [rsp + 0x118], eax
cmp dword [rsp + 0x118], 0xa
jle 0x140004e84
jmp 0x140004e86
jmp 0x140004e4b
mov r8d, gethostname
xor edx, edx
lea rcx, [rsp + 0x198]
call fcn.140019ba0
mov dword [rsp + 0x1a0], 3
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x1a8], rax
mov eax, 0x614
mov word [rsp + 0x1b8], ax
mov dword [rsp + 0x118], 0
lea rcx, [rsp + 0x198]
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
je 0x140004f09
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rsp + 0x118]
inc eax
mov dword [rsp + 0x118], eax
cmp dword [rsp + 0x118], 0xa
jle 0x140004f07
jmp 0x140004f09
jmp 0x140004ece
mov r8d, 0x68
xor edx, edx
lea rcx, [rsp + 0x120]
call fcn.140019ba0
mov dword [rsp + 0x120], WSAGetLastError
lea rax, [rsp + 0x100]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x120]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 0x10]
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp qword [rsp + 0xd8], 0
je 0x140004fd1
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rdx, str.5578CCC3_C6A2_49E3_A83F_787180A18331
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140005454
mov qword [rsp + 0x1f0], 0
mov qword [rsp + 0x1f8], 0
lea rdx, [rsp + 0x1e0]
lea rcx, [0x14003a1d0]
call fcn.140005d80
mov qword [rsp + 0x1e8], rax
cmp qword [rsp + 0x1e8], 0
je 0x140005415
lea rdx, [rsp + 0x208]
lea rcx, [0x14003a1d0]
call fcn.140005fe0
mov qword [rsp + 0x200], rax
cmp qword [rsp + 0x200], 0
je 0x140005407
mov edx, 0xfffe
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x1f8], rax
cmp qword [rsp + 0x1f8], 0
je 0x140005407
mov rdx, qword [rsp + 0x1f8]
mov ecx, 0x7fff
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jbe 0x140005407
mov edx, 0xfffe
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x1f0], rax
cmp qword [rsp + 0x1f0], 0
je 0x1400053f9
mov r8d, reloc.WS2_32.dll_recv
xor edx, edx
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 0x18]
call fcn.14001a714
mov dword [rsp + 0x20c], eax
mov eax, dword [rsp + 0x20c]
mov dword [rsp + 0x28], eax
lea rax, str.0BFDF76E_9537_4BCC_AC21_AE51FCBA5671
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x58]
mov r9, qword [rax + 0x10]
lea r8, str.__s___s__x
mov edx, 0x7fff
mov rcx, qword [rsp + 0x1f0]
call qword [sym.imp.SHLWAPI.dll_wnsprintfW]
lea r8, str.165B93F1_E1F8_49D4_9E9B_C9F9465DE6D8
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x210], rax
cmp qword [rsp + 0x210], 0
je 0x1400053f9
xor edx, edx
mov rcx, qword [rsp + 0x210]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x218], eax
cmp dword [rsp + 0x218], 0
je 0x140005187
cmp dword [rsp + 0x218], 0x80
jne 0x1400053dd
lea r8, str.AB56F979_1BB6_4E67_B697_5291740DCCC3
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov qword [rsp + 0x2b0], rax
cmp qword [rsp + 0x2b0], 0
je 0x1400051c9
mov rcx, qword [rsp + 0x2b0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140005187
cmp dword [0x14003c040], 1
jne 0x140005215
lea r8, [rsp + 0x2f0]
lea rdx, [0x140025f10]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x140005215
lea rdx, [0x14003c114]
mov rcx, qword [rsp + 0x2f0]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x2f0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x14003c03c], 1
jne 0x140005261
lea r8, [rsp + 0x2f8]
lea rdx, [0x140025f70]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x140005261
lea rdx, str.AB1F3E47_AEF1_400E_A108_233A046C3A34
mov rcx, qword [rsp + 0x2f8]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x2f8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r8d, gethostname
xor edx, edx
lea rcx, [rsp + 0x2b8]
call fcn.140019ba0
mov dword [rsp + 0x2c0], 3
mov rax, qword [rsp + 0x1e8]
mov qword [rsp + 0x2c8], rax
mov eax, 0x614
mov word [rsp + 0x2d8], ax
mov dword [rsp + 0x238], 0
lea rcx, [rsp + 0x2b8]
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
je 0x1400052e4
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rsp + 0x238]
inc eax
mov dword [rsp + 0x238], eax
cmp dword [rsp + 0x238], 5
jle 0x1400052e2
jmp 0x1400052e4
jmp 0x1400052a9
mov r8d, gethostname
xor edx, edx
lea rcx, [rsp + 0x2b8]
call fcn.140019ba0
mov dword [rsp + 0x2c0], 3
mov rax, qword [rsp + 0x200]
mov qword [rsp + 0x2c8], rax
mov eax, 0x614
mov word [rsp + 0x2d8], ax
mov dword [rsp + 0x238], 0
lea rcx, [rsp + 0x2b8]
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
je 0x140005367
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rsp + 0x238]
inc eax
mov dword [rsp + 0x238], eax
cmp dword [rsp + 0x238], 5
jle 0x140005365
jmp 0x140005367
jmp 0x14000532c
mov r8d, 0x68
xor edx, edx
lea rcx, [rsp + 0x240]
call fcn.140019ba0
mov dword [rsp + 0x240], WSAGetLastError
lea rax, [rsp + 0x220]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x240]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x1f8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x1f0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov rcx, qword [rsp + 0x210]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, qword [rsp + 0x210]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x200]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x1e8]
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp qword [rsp + 0x1f0], 0
je 0x14000542e
mov rcx, qword [rsp + 0x1f0]
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp qword [rsp + 0x1f8], 0
je 0x140005447
mov rcx, qword [rsp + 0x1f8]
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rdx, str.0170098E_2A03_48F1_9521_A8BFE6500BA8
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1400056cc
lea rdx, [rsp + 0x300]
lea rcx, [0x14003a1d0]
call fcn.140005d80
mov qword [rsp + 0x308], rax
cmp qword [rsp + 0x308], 0
je 0x1400056c4
lea rdx, [rsp + 0x318]
lea rcx, [0x14003a1d0]
call fcn.140005fe0
mov qword [rsp + 0x310], rax
cmp qword [rsp + 0x310], 0
je 0x1400056b6
lea r8, str.AB56F979_1BB6_4E67_B697_5291740DCCC3
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov qword [rsp + 0x320], rax
cmp qword [rsp + 0x320], 0
je 0x14000550a
mov rcx, qword [rsp + 0x320]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400054c8
cmp dword [0x14003c040], 1
jne 0x140005556
lea r8, [rsp + 0x360]
lea rdx, [0x140025fd0]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x140005556
lea rdx, [0x14003c114]
mov rcx, qword [rsp + 0x360]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x360]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x14003c03c], 1
jne 0x1400055a2
lea r8, [rsp + 0x368]
lea rdx, [0x140026030]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x1400055a2
lea rdx, str.AB1F3E47_AEF1_400E_A108_233A046C3A34
mov rcx, qword [rsp + 0x368]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x368]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r8d, gethostname
xor edx, edx
lea rcx, [rsp + 0x328]
call fcn.140019ba0
mov dword [rsp + 0x330], 3
mov rax, qword [rsp + 0x308]
mov qword [rsp + 0x338], rax
mov eax, 0x614
mov word [rsp + 0x348], ax
mov dword [rsp + 0x31c], 0
lea rcx, [rsp + 0x328]
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
je 0x140005625
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rsp + 0x31c]
inc eax
mov dword [rsp + 0x31c], eax
cmp dword [rsp + 0x31c], 5
jle 0x140005623
jmp 0x140005625
jmp 0x1400055ea
mov r8d, gethostname
xor edx, edx
lea rcx, [rsp + 0x328]
call fcn.140019ba0
mov dword [rsp + 0x330], 3
mov rax, qword [rsp + 0x310]
mov qword [rsp + 0x338], rax
mov eax, 0x614
mov word [rsp + 0x348], ax
mov dword [rsp + 0x31c], 0
lea rcx, [rsp + 0x328]
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
je 0x1400056a8
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rsp + 0x31c]
inc eax
mov dword [rsp + 0x31c], eax
cmp dword [rsp + 0x31c], 5
jle 0x1400056a6
jmp 0x1400056a8
jmp 0x14000566d
mov rcx, qword [rsp + 0x310]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x308]
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, 1
add rsp, 0x378
ret