Function at 0x1400047f0
Capabilities:
Accept command line arguments
Check mutex and terminate process on windows
Check mutex on windows
Create process on windows
Delete registry value
Get common file path
Persist via run registry key
Terminate process

Disassembly:
sub rsp, 0x378
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x60], rax
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0x58], rax
lea rdx, str.E02FA112_6770_442E_BBB4_4DD92BB63ED2
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x14000491f
call fcn.14000f710
mov qword [rsp + 0x68], rax
cmp qword [rsp + 0x68], 0
je 0x14000485f
xor edx, edx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x70], 0
call qword [sym.imp.SHELL32.dll_IsUserAnAdmin]
cmp eax, 1
jne 0x140004894
lea r9, str.2EF7A1C2_32FB_4E95_8CF7_4B180506FB8F
mov r8d, 1
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x70], rax
jmp 0x1400048b0
lea r9, str.2EF7A1C2_32FB_4E95_8CF7_4B180506FB8F
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x70], rax
xor eax, eax
cmp eax, 1
je 0x1400048fd
mov qword [rsp + 0x78], 0
lea r8, str.D8AA0A5E_AE26_4662_A26B_8BB27BF53653
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov qword [rsp + 0x78], rax
cmp qword [rsp + 0x78], 0
je 0x1400048f9
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400048b0
jmp 0x1400048fd
cmp qword [rsp + 0x70], 0
je 0x140004910
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x1400056d1
lea rdx, str.19BFDD92_582C_499B_A573_78DD63B69735
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140004a4e
lea r8, str.269E9B8F_1CE2_42A9_A359_B62F523BAB98
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov qword [rsp + 0x88], rax
cmp qword [rsp + 0x88], 0
je 0x14000498c
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x90], eax
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8, str.A9E31607_AC83_46AC_A298_40D9A8B4C3B3
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov qword [rsp + 0x80], rax
cmp qword [rsp + 0x80], 0
je 0x1400049db
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x94], eax
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp eax, 1
je 0x140004a34
mov qword [rsp + 0x98], 0
lea r8, str.D8AA0A5E_AE26_4662_A26B_8BB27BF53653
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov qword [rsp + 0x98], rax
cmp qword [rsp + 0x98], 0
je 0x140004a30
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400049db
jmp 0x140004a34
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 1
jmp 0x1400056d1
lea rdx, str.770FE778_BB61_4A4E_8F47_9FB5D8A34866
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140004b7d
lea r8, str.269E9B8F_1CE2_42A9_A359_B62F523BAB98
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov qword [rsp + 0xa8], rax
cmp qword [rsp + 0xa8], 0
je 0x140004abb
mov edx, 0xffffffff
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0xb0], eax
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8, str.A9E31607_AC83_46AC_A298_40D9A8B4C3B3
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov qword [rsp + 0xa0], rax
cmp qword [rsp + 0xa0], 0
je 0x140004b0a
mov edx, 0xffffffff
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0xb4], eax
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp eax, 1
je 0x140004b63
mov qword [rsp + 0xb8], 0
lea r8, str.D8AA0A5E_AE26_4662_A26B_8BB27BF53653
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov qword [rsp + 0xb8], rax
cmp qword [rsp + 0xb8], 0
je 0x140004b5f
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140004b0a
jmp 0x140004b63
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 1
jmp 0x1400056d1
lea rdx, str.C8C81F4B_5E13_45C0_A4F8_7E7590E92A71
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140004c0a
xor eax, eax
cmp eax, 1
je 0x140004bf0
mov qword [rsp + 0xc0], 0
lea r8, str.D8AA0A5E_AE26_4662_A26B_8BB27BF53653
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov qword [rsp + 0xc0], rax
cmp qword [rsp + 0xc0], 0
je 0x140004bec
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140004b97
jmp 0x140004bf0
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 1
jmp 0x1400056d1
lea rdx, str.E703FDA7_EBBC_4372_8948_8CE3FFCDB2A4
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140004fde
mov qword [rsp + 0xd8], 0
lea rdx, [rsp + 0xc8]
lea rcx, [0x14003a1d0]
call fcn.140005d80
mov qword [rsp + 0xd0], rax
cmp qword [rsp + 0xd0], 0
je 0x140004fb8
lea rdx, [rsp + 0xe8]
lea rcx, [0x14003a1d0]
call fcn.140005fe0
mov qword [rsp + 0xe0], rax
cmp qword [rsp + 0xe0], 0
je 0x140004faa
mov edx, 0xfffe
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0xd8], rax
cmp qword [rsp + 0xd8], 0
je 0x140004faa
mov rdx, qword [rsp + 0xd8]
mov ecx, 0x7fff
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jbe 0x140004faa
lea r8, str.CEA7A0C0_23F4_4ABD_BDAD_2931C2E31F6E
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xf0], rax
cmp qword [rsp + 0xf0], 0
je 0x140004f9c
xor edx, edx
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0xf8], eax
cmp dword [rsp + 0xf8], 0
je 0x140004d29
cmp dword [rsp + 0xf8], 0x80
jne 0x140004f80
lea r8, str.D8AA0A5E_AE26_4662_A26B_8BB27BF53653
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov qword [rsp + 0x190], rax
cmp qword [rsp + 0x190], 0
je 0x140004d6b
mov rcx, qword [rsp + 0x190]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140004d29
cmp dword [0x14003c040], 1
jne 0x140004db7
lea r8, [rsp + 0x1d0]
lea rdx, [0x140025e50]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x140004db7
lea rdx, [0x14003c114]
mov rcx, qword [rsp + 0x1d0]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x1d0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x14003c03c], 1
jne 0x140004e03
lea r8, [rsp + 0x1d8]
lea rdx, [0x140025eb0]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x140004e03
lea rdx, str.AB1F3E47_AEF1_400E_A108_233A046C3A34
mov rcx, qword [rsp + 0x1d8]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x1d8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r8d, gethostname
xor edx, edx
lea rcx, [rsp + 0x198]
call fcn.140019ba0
mov dword [rsp + 0x1a0], 3
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x1a8], rax
mov eax, 0x614
mov word [rsp + 0x1b8], ax
mov dword [rsp + 0x118], 0
lea rcx, [rsp + 0x198]
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
je 0x140004e86
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rsp + 0x118]
inc eax
mov dword [rsp + 0x118], eax
cmp dword [rsp + 0x118], 0xa
jle 0x140004e84
jmp 0x140004e86
jmp 0x140004e4b
mov r8d, gethostname
xor edx, edx
lea rcx, [rsp + 0x198]
call fcn.140019ba0
mov dword [rsp + 0x1a0], 3
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x1a8], rax
mov eax, 0x614
mov word [rsp + 0x1b8], ax
mov dword [rsp + 0x118], 0
lea rcx, [rsp + 0x198]
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
je 0x140004f09
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rsp + 0x118]
inc eax
mov dword [rsp + 0x118], eax
cmp dword [rsp + 0x118], 0xa
jle 0x140004f07
jmp 0x140004f09
jmp 0x140004ece
mov r8d, 0x68
xor edx, edx
lea rcx, [rsp + 0x120]
call fcn.140019ba0
mov dword [rsp + 0x120], WSAGetLastError
lea rax, [rsp + 0x100]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x120]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 0x10]
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp qword [rsp + 0xd8], 0
je 0x140004fd1
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rdx, str.1CFBB6F7_22A9_43CA_8DF5_FE67F0397DF7
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140005454
mov qword [rsp + 0x1f0], 0
mov qword [rsp + 0x1f8], 0
lea rdx, [rsp + 0x1e0]
lea rcx, [0x14003a1d0]
call fcn.140005d80
mov qword [rsp + 0x1e8], rax
cmp qword [rsp + 0x1e8], 0
je 0x140005415
lea rdx, [rsp + 0x208]
lea rcx, [0x14003a1d0]
call fcn.140005fe0
mov qword [rsp + 0x200], rax
cmp qword [rsp + 0x200], 0
je 0x140005407
mov edx, 0xfffe
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x1f8], rax
cmp qword [rsp + 0x1f8], 0
je 0x140005407
mov rdx, qword [rsp + 0x1f8]
mov ecx, 0x7fff
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jbe 0x140005407
mov edx, 0xfffe
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x1f0], rax
cmp qword [rsp + 0x1f0], 0
je 0x1400053f9
mov r8d, reloc.WS2_32.dll_recv
xor edx, edx
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 0x18]
call fcn.14001a714
mov dword [rsp + 0x20c], eax
mov eax, dword [rsp + 0x20c]
mov dword [rsp + 0x28], eax
lea rax, str.D2419521_BA9A_4067_AC54_8F69651280A6
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x58]
mov r9, qword [rax + 0x10]
lea r8, str.__s___s__x
mov edx, 0x7fff
mov rcx, qword [rsp + 0x1f0]
call qword [sym.imp.SHLWAPI.dll_wnsprintfW]
lea r8, str.CEA7A0C0_23F4_4ABD_BDAD_2931C2E31F6E
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x210], rax
cmp qword [rsp + 0x210], 0
je 0x1400053f9
xor edx, edx
mov rcx, qword [rsp + 0x210]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x218], eax
cmp dword [rsp + 0x218], 0
je 0x140005187
cmp dword [rsp + 0x218], 0x80
jne 0x1400053dd
lea r8, str.D8AA0A5E_AE26_4662_A26B_8BB27BF53653
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov qword [rsp + 0x2b0], rax
cmp qword [rsp + 0x2b0], 0
je 0x1400051c9
mov rcx, qword [rsp + 0x2b0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140005187
cmp dword [0x14003c040], 1
jne 0x140005215
lea r8, [rsp + 0x2f0]
lea rdx, [0x140025f10]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x140005215
lea rdx, [0x14003c114]
mov rcx, qword [rsp + 0x2f0]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x2f0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x14003c03c], 1
jne 0x140005261
lea r8, [rsp + 0x2f8]
lea rdx, [0x140025f70]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x140005261
lea rdx, str.AB1F3E47_AEF1_400E_A108_233A046C3A34
mov rcx, qword [rsp + 0x2f8]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x2f8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r8d, gethostname
xor edx, edx
lea rcx, [rsp + 0x2b8]
call fcn.140019ba0
mov dword [rsp + 0x2c0], 3
mov rax, qword [rsp + 0x1e8]
mov qword [rsp + 0x2c8], rax
mov eax, 0x614
mov word [rsp + 0x2d8], ax
mov dword [rsp + 0x238], 0
lea rcx, [rsp + 0x2b8]
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
je 0x1400052e4
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rsp + 0x238]
inc eax
mov dword [rsp + 0x238], eax
cmp dword [rsp + 0x238], 5
jle 0x1400052e2
jmp 0x1400052e4
jmp 0x1400052a9
mov r8d, gethostname
xor edx, edx
lea rcx, [rsp + 0x2b8]
call fcn.140019ba0
mov dword [rsp + 0x2c0], 3
mov rax, qword [rsp + 0x200]
mov qword [rsp + 0x2c8], rax
mov eax, 0x614
mov word [rsp + 0x2d8], ax
mov dword [rsp + 0x238], 0
lea rcx, [rsp + 0x2b8]
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
je 0x140005367
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rsp + 0x238]
inc eax
mov dword [rsp + 0x238], eax
cmp dword [rsp + 0x238], 5
jle 0x140005365
jmp 0x140005367
jmp 0x14000532c
mov r8d, 0x68
xor edx, edx
lea rcx, [rsp + 0x240]
call fcn.140019ba0
mov dword [rsp + 0x240], WSAGetLastError
lea rax, [rsp + 0x220]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x240]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x1f8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x1f0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov rcx, qword [rsp + 0x210]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, qword [rsp + 0x210]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x200]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x1e8]
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp qword [rsp + 0x1f0], 0
je 0x14000542e
mov rcx, qword [rsp + 0x1f0]
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp qword [rsp + 0x1f8], 0
je 0x140005447
mov rcx, qword [rsp + 0x1f8]
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rdx, str.B16D7E85_F28B_4449_8E59_EE138720543A
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1400056cc
lea rdx, [rsp + 0x300]
lea rcx, [0x14003a1d0]
call fcn.140005d80
mov qword [rsp + 0x308], rax
cmp qword [rsp + 0x308], 0
je 0x1400056c4
lea rdx, [rsp + 0x318]
lea rcx, [0x14003a1d0]
call fcn.140005fe0
mov qword [rsp + 0x310], rax
cmp qword [rsp + 0x310], 0
je 0x1400056b6
lea r8, str.D8AA0A5E_AE26_4662_A26B_8BB27BF53653
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov qword [rsp + 0x320], rax
cmp qword [rsp + 0x320], 0
je 0x14000550a
mov rcx, qword [rsp + 0x320]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400054c8
cmp dword [0x14003c040], 1
jne 0x140005556
lea r8, [rsp + 0x360]
lea rdx, [0x140025fd0]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x140005556
lea rdx, [0x14003c114]
mov rcx, qword [rsp + 0x360]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x360]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x14003c03c], 1
jne 0x1400055a2
lea r8, [rsp + 0x368]
lea rdx, [0x140026030]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x1400055a2
lea rdx, str.AB1F3E47_AEF1_400E_A108_233A046C3A34
mov rcx, qword [rsp + 0x368]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x368]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r8d, gethostname
xor edx, edx
lea rcx, [rsp + 0x328]
call fcn.140019ba0
mov dword [rsp + 0x330], 3
mov rax, qword [rsp + 0x308]
mov qword [rsp + 0x338], rax
mov eax, 0x614
mov word [rsp + 0x348], ax
mov dword [rsp + 0x31c], 0
lea rcx, [rsp + 0x328]
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
je 0x140005625
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rsp + 0x31c]
inc eax
mov dword [rsp + 0x31c], eax
cmp dword [rsp + 0x31c], 5
jle 0x140005623
jmp 0x140005625
jmp 0x1400055ea
mov r8d, gethostname
xor edx, edx
lea rcx, [rsp + 0x328]
call fcn.140019ba0
mov dword [rsp + 0x330], 3
mov rax, qword [rsp + 0x310]
mov qword [rsp + 0x338], rax
mov eax, 0x614
mov word [rsp + 0x348], ax
mov dword [rsp + 0x31c], 0
lea rcx, [rsp + 0x328]
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
je 0x1400056a8
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rsp + 0x31c]
inc eax
mov dword [rsp + 0x31c], eax
cmp dword [rsp + 0x31c], 5
jle 0x1400056a6
jmp 0x1400056a8
jmp 0x14000566d
mov rcx, qword [rsp + 0x310]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x308]
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, 1
add rsp, 0x378
ret