Function at 0x140005470
Capabilities:
Create process on windows
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov rax, qword [0x1400d9080]
xor rax, rsp
mov qword [rbp + 0x80], rax
xor ecx, ecx
call fcn.1400162b0
mov qword [rbp - 0x48], rax
xor r14d, r14d
mov qword [rsp + 0x50], r14
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x68], xmm1
mov r8d, 0xb
lea rdx, [0x1400ceaa0]
lea rcx, [rsp + 0x50]
call fcn.140004fd0
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x50]
call fcn.140002600
lea rcx, [rsp + 0x50]
call fcn.140007890
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x80]
call fcn.140015450
mov rcx, qword [rbp - 0x78]
test rcx, rcx
je 0x140005529
mov rax, qword [rcx]
call qword [rax + 0x10]
test rax, rax
je 0x140005529
mov rcx, qword [rax]
mov r8, qword [rcx]
mov edx, 1
mov rcx, rax
call r8
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x14000554e
mov rax, qword [rcx]
call qword [rax + 0x10]
test rax, rax
je 0x14000554e
mov rcx, qword [rax]
mov r8, qword [rcx]
mov edx, 1
mov rcx, rax
call r8
mov rax, qword [0x1400db0c0]
movsxd rbx, dword [rax + 4]
lea r15, [0x1400db0c0]
add rbx, r15
mov cl, 1
call fcn.140015f90
mov qword [rbp - 0x78], rax
lea r8, [rbp - 0x80]
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.1400071b0
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x1400055a0
mov rax, qword [rcx]
call qword [rax + 0x10]
test rax, rax
je 0x1400055a0
mov r8, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r8]
mov rcx, qword [rbp - 0x78]
test rcx, rcx
je 0x1400055c2
mov rax, qword [rcx]
call qword [rax + 0x10]
test rax, rax
je 0x1400055c2
mov r8, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r8]
call qword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
jne 0x1400055ed
mov r9d, 0x10
lea r8, [0x1400ceab0]
lea rdx, str.Oops__You_need_to_run_this_program_as_admin___.__Its_okay__If_you_dont_have_perms__ask_your_parent_or_guardian_on_how_to_run_it_as_so_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x140005bdb
mov qword [rbp - 0x60], r14
mov qword [rbp - 0x58], r14
lea rax, [rbp - 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREWOW6432NodeMicrosoftEdgeUpdateClientsF3017226_FE2A_4295_8BDF_00C3A9A7E4C5
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
lea rax, [rbp - 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftEdgeUpdateClientsF3017226_FE2A_4295_8BDF_00C3A9A7E4C5
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test ebx, ebx
je 0x140005697
test eax, eax
je 0x140005697
mov r9d, 0x31
lea r8, [0x1400ced58]
lea rdx, str.You_seem_to_be_missing_the_Edge_WebView2_runtime._Do_you_want_to_install_it__The_installer_requires_Edge_WebView2_for_the_user_interface_to_work_correctly._Please_run_the_Edge_WebView2_runtime_setup_as_an_administrator_to_ensure_it_installs_correctly.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 1
jne 0x140005bdb
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r14
xor r9d, r9d
lea r8, str.https:__go.microsoft.com_fwlink_p__LinkId2124703
lea rdx, [0x1400cefd8]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x140005bdb
lea rdx, str.Registry_key_exists.
mov rcx, r15
call fcn.1400097e0
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
mov dl, 0xa
call fcn.140009010
movzx edx, al
mov rcx, rbx
call fcn.14000b1f0
mov rcx, rbx
call fcn.140008c70
mov rcx, qword [rbp - 0x60]
test rcx, rcx
je 0x1400056dc
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x1400056eb
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x18], r14
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp], xmm1
mov r8d, 0x28
lea rdx, str.cmd.exe__c_taskkill__F__IM_installer.exe
lea rcx, [rbp - 0x18]
call fcn.14000a580
mov qword [rbp - 0x40], r14
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x28], xmm1
mov r8d, 0x24
lea rdx, str.cmd.exe__c_taskkill__F__IM_setup.exe
lea rcx, [rbp - 0x40]
call fcn.14000a580
mov dword [rbp + 0x10], 0x68
xorps xmm0, xmm0
movups xmmword [rbp + 0x18], xmm0
movups xmmword [rbp + 0x28], xmm0
movups xmmword [rbp + 0x38], xmm0
movups xmmword [rbp + 0x48], xmm0
movups xmmword [rbp + 0x58], xmm0
movups xmmword [rbp + 0x68], xmm0
lea rdx, [rbp - 0x10]
cmp qword [rbp + 8], 7
cmova rdx, qword [rbp - 0x10]
lea rax, [rbp - 0x80]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1400057cb
mov edx, 0xffffffff
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp + 0x10], 0x68
xorps xmm0, xmm0
movups xmmword [rbp + 0x18], xmm0
movups xmmword [rbp + 0x28], xmm0
movups xmmword [rbp + 0x38], xmm0
movups xmmword [rbp + 0x48], xmm0
movups xmmword [rbp + 0x58], xmm0
movups xmmword [rbp + 0x68], xmm0
lea rdx, [rbp - 0x38]
cmp qword [rbp - 0x20], 7
cmova rdx, qword [rbp - 0x38]
lea rax, [rbp - 0x80]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140005859
mov edx, 0xffffffff
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x50]
call fcn.140009a90
mov qword [rbp - 0x50], r14
lea rdi, [0x1400d9d60]
mov qword [rbp - 0x48], rdi
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x50]
call fcn.1400048a0
movzx ebx, al
cmp dword [rbp - 0x50], 0
jne 0x140005c35
lea rcx, [rsp + 0x50]
call fcn.140008570
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x50], r14
mov edx, 0x10
call fcn.14000ae50
mov rcx, r15
test bl, bl
je 0x140005995
lea rdx, str.Bloxshade_folder_true
call fcn.1400097e0
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
mov dl, 0xa
call fcn.140009010
movzx edx, al
mov rcx, rbx
call fcn.14000b1f0
mov rcx, rbx
call fcn.140008c70
lea rcx, [rsp + 0x50]
call fcn.140009a90
lea rcx, [rsp + 0x58]
cmp qword [rsp + 0x70], 7
cmova rcx, qword [rsp + 0x58]
call fcn.14000c690
mov rdx, rax
shr rdx, 0x20
movzx ecx, al
mov qword [rbp - 0x50], rcx
mov dword [rbp - 0x80], edx
mov qword [rbp - 0x78], rdi
movaps xmm0, xmmword [rbp - 0x80]
movdqa xmmword [rbp - 0x80], xmm0
cmp edx, 0x91
jne 0x140005941
lea r8, [rbp - 0x50]
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x50]
call fcn.140004cb0
cmp dword [rbp - 0x80], 0
jne 0x140005c4b
lea rcx, [rsp + 0x50]
call fcn.140008570
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x50], r14
mov edx, 0x10
call fcn.14000ae50
lea rcx, [rsp + 0x50]
call fcn.140009a90
mov qword [rbp - 0x50], r14
mov qword [rbp - 0x48], rdi
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x50]
call fcn.1400049b0
cmp dword [rbp - 0x50], 0
jne 0x140005c1f
jmp 0x1400059f2
lea rdx, str.Bloxshade_folder_false
call fcn.1400097e0
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
mov dl, 0xa
call fcn.140009010
movzx edx, al
mov rcx, rbx
call fcn.14000b1f0
mov rcx, rbx
call fcn.140008c70
lea rcx, [rsp + 0x50]
call fcn.140009a90
mov qword [rbp - 0x50], r14
mov qword [rbp - 0x48], rdi
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x50]
call fcn.1400049b0
cmp dword [rbp - 0x50], 0
jne 0x140005c09
lea rcx, [rsp + 0x50]
call fcn.140008570
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x50], r14
mov edx, 0x10
call fcn.14000ae50
lea r8, [0x1400cf0d0]
mov edx, 0x3e9
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
je 0x140005a91
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdi, rax
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
lea r8, str._setup.exe
lea rcx, [rsp + 0x50]
call fcn.140009380
lea r9, [rax + 8]
cmp qword [rax + 0x20], 0xf
jbe 0x140005a66
mov r9, qword [r9]
mov r8d, esi
mov rdx, rdi
mov rcx, rbx
call fcn.1400051e0
movzx ebx, al
lea rcx, [rsp + 0x50]
call fcn.140007890
test bl, bl
je 0x140005acb
lea rdx, str.setup.exe_extracted_successfully.
mov rcx, r15
jmp 0x140005a9f
lea rdx, str.Warning:_setup.exe_resource_not_found.
lea rcx, [0x1400db280]
call fcn.1400097e0
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
mov rbx, rax
mov dl, 0xa
add rcx, rax
call fcn.140009010
movzx edx, al
mov rcx, rbx
call fcn.14000b1f0
mov rcx, rbx
call fcn.140008c70
lea r8, [0x1400cf0d0]
mov edx, 0x3ea
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
je 0x140005b4c
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdi, rax
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
lea r8, str.installer.exe
lea rcx, [rsp + 0x50]
call fcn.140009380
lea r9, [rax + 8]
cmp qword [rax + 0x20], 0xf
jbe 0x140005b21
mov r9, qword [r9]
mov r8d, esi
mov rdx, rdi
mov rcx, rbx
call fcn.1400051e0
movzx ebx, al
lea rcx, [rsp + 0x50]
call fcn.140007890
test bl, bl
je 0x140005b86
lea rdx, str.installer.exe_extracted_successfully.
mov rcx, r15
jmp 0x140005b5a
lea rdx, str.Warning:_installer.exe_resource_not_found.
lea rcx, [0x1400db280]
call fcn.1400097e0
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
mov rbx, rax
mov dl, 0xa
add rcx, rax
call fcn.140009010
movzx edx, al
mov rcx, rbx
call fcn.14000b1f0
mov rcx, rbx
call fcn.140008c70
lea rcx, [0x1400dd058]
cmp qword [0x1400dd070], 0xf
cmova rcx, qword [0x1400dd058]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, [rbp - 0x40]
call fcn.140008570
mov rcx, qword [rbp - 0x40]
mov qword [rbp - 0x40], r14
mov edx, 0x10
call fcn.14000ae50
lea rcx, [rbp - 0x18]
call fcn.140008570
mov rcx, qword [rbp - 0x18]
mov qword [rbp - 0x18], r14
mov edx, 0x10
call fcn.14000ae50
xor eax, eax
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.1400489e0
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
lea r8, [rsp + 0x50]
lea rdx, [rbp - 0x50]
lea rcx, [0x1400cea30]
call fcn.140004020
int3
lea r8, [rsp + 0x50]
lea rdx, [rbp - 0x50]
lea rcx, [0x1400cea30]
call fcn.140004020
int3
lea r8, [rsp + 0x50]
lea rdx, [rbp - 0x50]
lea rcx, [0x1400cea24]
call fcn.140004020
int3
lea r8, [rsp + 0x50]
lea rdx, [rbp - 0x80]
lea rcx, [0x1400cea48]
call fcn.140004020
int3