Function at 0x1400011c0
Capabilities:
Create a process with modified i/o handles and window
Create process on windows
Enumerate processes
Persist via run registry key
Query or enumerate registry value
Set console window title
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rsp - 0x2b0]
sub rsp, 0x3b0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x2a0], rax
xor esi, esi
call qword [sym.imp.KERNEL32.dll_FreeConsole]
lea rcx, str.Windows_Audio_Device_Graph_Driver
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
lea rax, [rbp - 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
jne 0x140001288
mov dword [rbp + 0x30], esi
lea rax, [rbp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rbp + 0x58]
xor r8d, r8d
lea rdx, str.Windows_Audio_Device_Graph_Driver
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x1400012b6
lea rdx, str.Registry_entry_already_exists._Exiting.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001830
jmp 0x1400012a6
lea rdx, str.Failed_to_open_Registry_key._Error_code:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001830
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___long_int____ptr64]
lea rdx, [0x140001a00]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rax, [rbp - 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
jne 0x140001367
mov dword [rsp + 0x28], 0x74
lea rax, str.C:WindowsSystem32Windows_Audio_Device_Graph_Driver.exe
mov qword [rsp + 0x20], rax
lea r9d, [rbx + 1]
xor r8d, r8d
lea rdx, str.Windows_Audio_Device_Graph_Driver
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
test eax, eax
jne 0x14000132d
lea rdx, str.Entry_added_to_the_Registry_successfully.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001830
jmp 0x14000134b
lea rdx, str.Failed_to_set_Registry_value._Error_code:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001830
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___long_int____ptr64]
lea rdx, [0x140001a00]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140001395
lea rdx, str.Failed_to_open_Registry_key._Error_code:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001830
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___long_int____ptr64]
mov rcx, rax
lea rdx, [0x140001a00]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea r12, [0x14000366e]
lea r14, [0x14000366c]
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
mov dword [rbp + 0x60], 0x238
lea rdx, [rbp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
nop word [rax + rax]
lea rdx, str.fivem.exe
lea rcx, [rbp + 0x8c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
mov rcx, rbx
test eax, eax
je 0x14000140f
lea rdx, [rbp + 0x60]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400013d0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400013a3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], rsi
mov qword [rbp - 0x78], rsi
mov ecx, 0x30
call fcn.140001c50
mov rdi, rax
mov qword [rsp + 0x70], rax
mov qword [rbp - 0x80], 0x11
mov qword [rbp - 0x78], 0x17
movups xmm0, xmmword [str.C:_alauncher.exe]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x1400034b0]
movups xmmword [rax + 0x10], xmm1
movzx ecx, word [0x1400034c0]
mov word [rax + 0x20], cx
mov word [rax + 0x22], si
mov qword [rbp - 0x80], 0x12
cmp r12, rax
jbe 0x140001496
add rax, 0x22
cmp r14, rax
ja 0x140001496
cmp rdi, r14
ja 0x14000148b
mov rbx, rsi
jmp 0x14000149b
mov rbx, rdi
sub rbx, r14
sar rbx, 1
jmp 0x14000149b
mov ebx, 1
lea rcx, [rdi + 2]
mov r8d, 0x24
mov rdx, rdi
call sub.VCRUNTIME140.dll_memmove
add rbx, rbx
mov r8, rbx
mov rdx, r14
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rdi + rbx]
mov r8d, 2
sub r8, rbx
lea rdx, [r14 + 2]
add rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rsp + 0x70]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rsi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x68]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x14000154a
lea rax, [rcx + 1]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x50]
cmp rdx, 7
cmova rax, qword [rsp + 0x50]
mov dword [rax + rcx*2], 0x22
lea rax, [rsp + 0x50]
jmp 0x140001562
mov qword [rsp + 0x20], 1
mov edx, 1
lea rcx, [rsp + 0x50]
call fcn.140001a40
xorps xmm0, xmm0
movups xmmword [rbp + 0x38], xmm0
mov qword [rbp + 0x48], rsi
mov qword [rbp + 0x50], rsi
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x38], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x48], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
mov rdx, qword [rsp + 0x68]
cmp rdx, 7
jbe 0x1400015d1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400015cc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000173a
call fcn.140001c8c
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], si
mov rdx, qword [rbp - 0x78]
cmp rdx, 7
jbe 0x140001625
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001620
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001741
call fcn.140001c8c
mov qword [rbp - 0x80], rsi
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], si
mov dword [rbp - 0x40], 0x68
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
movups xmmword [rbp - 8], xmm0
movups xmmword [rbp + 8], xmm0
movups xmmword [rbp + 0x18], xmm0
mov word [rbp], si
mov dword [rbp - 4], 0x101
movdqa xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x20], rsi
lea rdx, [rbp + 0x38]
cmp qword [rbp + 0x50], 7
cmova rdx, qword [rbp + 0x38]
lea rax, [rbp - 0x60]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1400016ca
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400016ee
lea rdx, str.Failed_to_start_the_other_application.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001830
mov rcx, rax
lea rdx, [0x140001a00]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp + 0x50]
cmp rdx, 7
jbe 0x14000172a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001725
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001748
call fcn.140001c8c
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400013a3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3