Function at 0x100006680
Capabilities:
Create process on windows
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1c0
mov rax, qword [0x10001a100]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
mov rcx, qword [0x10001db60]
lea rdx, [0x10001d720]
mov r8d, 0x103
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor r15d, r15d
cmp eax, r15d
jne 0x1000066de
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x100006c9c
lea r13, [0x1000019a8]
mov word [0x10001d926], r15w
mov edi, r15d
mov r14, r15
lea rbp, [0x100000000]
mov esi, 1
mov qword [rsp + 0x78], r13
mov r9d, dword [r13]
lea r8, [0x100001ac0]
lea rcx, [0x10001da70]
mov edx, 0x28
lea rbx, [0x10001bd60]
call fcn.100004fe0
cmp eax, r15d
mov r11d, eax
jl 0x100006c9c
mov r8, qword [r14 + rbp + 0x1bfa8]
cmp r8, r15
je 0x10000678b
lea rax, [0x10001d680]
mov edx, 0x28
mov r11d, r15d
mov rcx, rax
sub r8, rax
lea rax, [rdx + 0x7fffffd6]
cmp rax, r15
je 0x100006778
movzx eax, word [r8 + rcx]
cmp ax, r15w
je 0x100006778
mov word [rcx], ax
add rcx, 2
sub rdx, rsi
jne 0x100006755
cmp rdx, r15
jne 0x100006787
sub rcx, 2
mov r11d, 0x8007007a
mov word [rcx], r15w
cmp r11d, r15d
jl 0x100006c99
mov r8, qword [r14 + rbp + 0x1bfb0]
lea rax, [0x10001d930]
mov edx, 0x64
sub r8, rax
mov rcx, rax
mov r11d, r15d
lea rax, [rdx + 0x7fffff9a]
cmp rax, r15
je 0x1000067d4
movzx eax, word [r8 + rcx]
cmp ax, r15w
je 0x1000067d4
mov word [rcx], ax
add rcx, 2
sub rdx, rsi
jne 0x1000067b1
cmp rdx, r15
jne 0x1000067e3
sub rcx, 2
mov r11d, 0x8007007a
cmp r11d, r15d
mov word [rcx], r15w
jl 0x100006c99
cmp qword [0x10001bd60], r15
je 0x100006906
lea rax, [rbx + 8]
cmp qword [rax], r15
je 0x1000068fd
cmp qword [rbx + 0x10], r15
je 0x1000068fd
mov r8, qword [rbx]
mov r9, qword [rax]
lea rcx, [rsp + 0x110]
mov edx, 0x50
mov rbx, rax
call fcn.100004fe0
cmp eax, r15d
jl 0x100006c9c
mov qword [rsp + 0x40], r15
lea rax, [rsp + 0x60]
lea rdx, [rsp + 0x110]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000000
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], r15d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, r15d
jne 0x1000068ac
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x60]
mov r9d, esi
lea eax, [rax + rax + 2]
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x28], eax
mov rax, qword [rbx + 8]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, r15d
je 0x1000068ae
add edi, esi
mov rcx, qword [rbx + 0x10]
cmp rcx, r15
je 0x1000068ee
add rcx, 2
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rsp + 0x60]
lea eax, [rax + rax + 2]
mov r9d, esi
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov rax, qword [rbx + 0x18]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, r15d
je 0x1000068ee
add edi, esi
mov rcx, qword [rsp + 0x60]
add rbx, 0x20
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp qword [rbx], r15
jne 0x1000067fd
cmp dword [0x10001db74], r15d
je 0x100006a57
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x68]
xor r9d, r9d
mov r8d, esi
mov qword [rsp + 0x68], r15
mov dword [rsp + 0x50], r15d
call fcn.1000063fc
cmp eax, r15d
jne 0x100006a13
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x50], r15
mov r12d, r15d
mov ebp, r15d
mov dword [rsp + 0x80], 0x18
mov dword [rsp + 0x90], r15d
mov qword [rsp + 0x88], rax
mov r13d, 1
mov eax, ebp
mov ebx, 2
neg eax
sbb esi, esi
add esi, 2
cmp esi, ebx
je 0x10000698e
mov dl, r13b
mov ecx, esi
call fcn.1000051a0
cmp al, r15b
cmovne ebx, esi
mov qword [rsp + 0x40], r15
lea rax, [rsp + 0x50]
cmp ebp, r15d
mov qword [rsp + 0x38], rax
cmovne r12d, r13d
lea rax, [rsp + 0x80]
mov qword [rsp + 0x30], rax
lea rdx, [0x100001b10]
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0x2011f
mov dword [rsp + 0x20], r15d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, r15d
mov esi, eax
cmove r12d, r13d
cmp ebx, 2
je 0x1000069ef
xor edx, edx
mov ecx, ebx
call fcn.1000051a0
mov ebp, r13d
cmp r12d, r15d
je 0x10000696c
mov r13, qword [rsp + 0x78]
cmp esi, r15d
je 0x100006b9c
mov rsi, rbp
lea rbp, [0x100000000]
add edi, esi
call fcn.10000aa2c
cmp al, r15b
je 0x100006a36
lea rcx, [0x10001bf60]
call fcn.1000064ac
mov ecx, r15d
cmp al, r15b
sete cl
add edi, ecx
call fcn.10000aa2c
cmp al, r15b
je 0x100006a57
lea rcx, [0x10001be08]
call fcn.1000064ac
mov ecx, r15d
cmp al, r15b
sete cl
add edi, ecx
lea rax, [rsp + 0x70]
lea rdx, [0x100001bb8]
mov r9d, esi
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, r15d
jne 0x100006b6c
mov rcx, qword [rsp + 0x70]
lea rax, [rsp + 0x58]
lea rdx, [0x100001bd8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x5c]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x58], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r15d
jne 0x100006b61
cmp dword [rsp + 0x5c], esi
jne 0x100006b61
xor edx, edx
lea rcx, [rsp + 0xa0]
lea r8d, [rdx + 0x68]
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x80]
lea rcx, [0x100001c08]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xa0]
xor r9d, r9d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], r15d
mov dword [rsp + 0xa0], 0x68
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, r15d
je 0x100006b61
mov rcx, qword [rsp + 0x80]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add r13, 0x10
lea rax, [0x1000019b8]
add r14, 8
cmp r13, rax
mov qword [rsp + 0x78], r13
jl 0x100006704
cmp edi, r15d
je 0x100006c59
mov eax, 0x80040201
jmp 0x100006c9c
lea rbp, [0x10001d720]
mov r12d, 0x5c
mov rcx, rbp
mov edx, r12d
call qword [sym.imp.msvcrt.dll_wcsrchr]
mov rbx, rax
cmp rax, r15
je 0x100006c06
cmp rax, rbp
je 0x100006c06
mov rcx, rbp
mov word [rax], r15w
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x50]
lea esi, [r12 - 0x5b]
lea eax, [rax + rax + 2]
lea rdx, [0x100001b78]
mov r9d, esi
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, r15d
je 0x100006c00
add edi, esi
mov word [rbx], r12w
jmp 0x100006c0d
mov esi, 1
add edi, esi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x50]
lea rdx, [0x100001ba0]
lea eax, [rax + rax + 2]
mov r9d, esi
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, r15d
je 0x100006c42
add edi, esi
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rbp, [0x100000000]
jmp 0x100006a15
mov rax, qword [0x10001db88]
cmp rax, r15
jne 0x100006c7e
lea rcx, [0x100001cc8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x10001db88], rax
cmp rax, r15
je 0x100006c95
lea rdx, [0x100001a60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp rax, r15
je 0x100006c95
call rax
xor eax, eax
jmp 0x100006c9c
mov eax, r11d
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.100017610
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret