Function at 0x140012c00
Capabilities:
Create http request
Create thread
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x268]
sub rsp, 0x340
mov rax, qword [0x140070070]
xor rax, rsp
mov qword [rbp + 0x230], rax
mov eax, dword [0x1400733e8]
lea rdi, [0x140053410]
mov r12d, 1
test r12b, al
jne 0x140012c65
or eax, r12d
mov dword [0x1400733e8], eax
call fcn.1400068ec
mov rcx, rdi
call fcn.14002bb88
mov rax, qword [0x140073358]
mov r14d, dword [rax + 0x40]
call fcn.14001e830
mov rcx, rax
mov edx, r14d
call fcn.14001e898
xor r13d, r13d
test eax, eax
je 0x140012da9
call fcn.1400064a8
mov rcx, rax
test rax, rax
je 0x14001375a
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x58], rax
call fcn.14001e830
mov rcx, rax
mov eax, r14d
and eax, 0xf0000000
cmp eax, 0xe0000000
jne 0x140012d07
mov rcx, qword [rcx]
mov rax, qword [rcx + 8]
mov rdx, rcx
jmp 0x140012ce0
cmp dword [rax + 0x20], r14d
jae 0x140012cda
mov rax, qword [rax + 0x10]
jmp 0x140012ce0
mov rdx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], r13b
je 0x140012cce
cmp byte [rdx + 0x19], r13b
jne 0x140012d07
cmp r14d, dword [rdx + 0x20]
jb 0x140012d07
cmp rcx, rdx
je 0x140012d07
add rdx, 0x38
lea rcx, [rsp + 0x58]
call fcn.14000d760
jmp 0x140012d27
lea rcx, [0x140061042]
call fcn.1400328d0
mov r8d, eax
lea rdx, [0x140061042]
lea rcx, [rsp + 0x58]
call fcn.14000de50
mov eax, dword [0x140073480]
test r12b, al
jne 0x140012d73
or eax, r12d
mov dword [0x140073480], eax
call fcn.140015060
lea rcx, [0x140053460]
call fcn.14002bb88
nop
mov eax, dword [0x140073480]
test r12b, al
jne 0x140012d73
or eax, r12d
mov dword [0x140073480], eax
call fcn.140015060
lea rcx, [0x140053460]
call fcn.14002bb88
nop
mov r8d, dword [0x140073400]
mov rbx, qword [rsp + 0x58]
mov rdx, rbx
lea rcx, [0x140073400]
call fcn.14001522c
nop
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140012da9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rdx, [0x140061390]
lea rcx, [0x14005f4f8]
call fcn.140025b7c
mov eax, dword [0x140073498]
test r12b, al
jne 0x140012e04
or eax, r12d
mov dword [0x140073498], eax
mov dword [0x140073490], r13d
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, str.QQ_Bug_Report_Tool
call qword [sym.imp.WININET.dll_InternetOpenA]
mov qword [0x140073488], rax
lea rcx, [0x140053498]
call fcn.14002bb88
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r13d
lea r9, [0x14005f5a4]
lea r8, [0x14001d9b8]
xor edx, edx
xor ecx, ecx
call fcn.14003efb4
mov rsi, rax
test rax, rax
je 0x140012e3c
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x140012e52
lea rdx, [0x140063c98]
lea rcx, [0x14005f6f0]
call fcn.140025b7c
mov rsi, r13
mov ebx, r13d
add ebx, r12d
mov eax, dword [0x140073498]
test r12b, al
jne 0x140012ea0
or eax, r12d
mov dword [0x140073498], eax
mov dword [0x140073490], r13d
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, str.QQ_Bug_Report_Tool
call qword [sym.imp.WININET.dll_InternetOpenA]
mov qword [0x140073488], rax
lea rcx, [0x140053498]
call fcn.14002bb88
cmp dword [0x140073490], r13d
jne 0x140012eb9
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp ebx, 0x14
jb 0x140012e55
mov eax, dword [0x1400733e8]
test r12b, al
jne 0x140012ee0
or eax, r12d
mov dword [0x1400733e8], eax
call fcn.1400068ec
mov rcx, rdi
call fcn.14002bb88
mov eax, dword [0x1400733e8]
mov rdx, qword [0x140073358]
mov r15d, dword [rdx + 4]
test r12b, al
jne 0x140012f0d
or eax, r12d
mov dword [0x1400733e8], eax
call fcn.1400068ec
mov rcx, rdi
call fcn.14002bb88
mov rdx, qword [0x140073358]
mov rdx, qword [rdx + 0x840]
lea rcx, [rsp + 0x60]
call fcn.14000d338
nop
mov eax, dword [0x1400733e8]
test r12b, al
jne 0x140012f40
or eax, r12d
mov dword [0x1400733e8], eax
call fcn.1400068ec
mov rcx, rdi
call fcn.14002bb88
lea rdx, [0x140073380]
lea rcx, [rbp - 0x70]
call fcn.14000d3c8
nop
mov rdx, qword [rsp + 0x60]
lea rcx, [rbp - 0x78]
call fcn.1400224ec
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rax]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
mov rdx, qword [rbp - 0x78]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140012fa2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rbp - 0x70]
test edi, edi
jne 0x140013096
mov dword [rsp + 0x34], r13d
mov dword [rsp + 0x30], r13d
mov dword [rsp + 0x48], 4
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, str.FullDump
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [rsp + 0x30], 4
jne 0x14001307a
cmp dword [rsp + 0x34], r12d
jne 0x14001307a
mov edi, 0x64
mov r8d, edi
xor edx, edx
lea rcx, [rbp + 0x1c0]
call fcn.14002dc80
mov dword [rsp + 0x4c], edi
mov dword [rsp + 0x50], r12d
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x1c0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
xor r8d, r8d
lea rdx, str.HASH
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov word [rbp + 0x222], r13w
lea rdx, [rbp + 0x1c0]
mov rcx, rbx
call fcn.14003f094
test eax, eax
jne 0x14001307a
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, r12d
jmp 0x14001309c
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x30], 4
jne 0x140013096
cmp dword [rsp + 0x34], 2
mov edi, r12d
je 0x14001309c
mov edi, dword [0x140073338]
lea rdx, [rbx - 0x18]
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x1400130ba
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x1400130d9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
test edi, edi
je 0x1400132f5
test r15b, 2
je 0x14001315a
mov eax, dword [0x1400733e8]
test r12b, al
jne 0x14001310c
or eax, r12d
mov dword [0x1400733e8], eax
call fcn.1400068ec
lea rcx, [0x140053410]
call fcn.14002bb88
mov dword [rsp + 0x54], r13d
lea rax, [rsp + 0x54]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r13d
xor r9d, r9d
lea r8, [0x140008cd4]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
test rax, rax
je 0x1400132f5
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400132f5
lea rcx, [rbp + 0x190]
call fcn.140022ad8
nop
mov eax, dword [0x1400733e8]
test r12b, al
jne 0x14001318c
or eax, r12d
mov dword [0x1400733e8], eax
call fcn.1400068ec
lea rcx, [0x140053410]
call fcn.14002bb88
mov rdx, qword [0x140073358]
mov rdx, qword [rdx + 0x848]
lea rcx, [rsp + 0x68]
call fcn.14000d338
nop
mov r8, qword [rsp + 0x68]
lea rdx, str.AppCallName
lea rcx, [rbp + 0x190]
call fcn.140022bc8
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x1400131dd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rdx, [0x1400613b0]
lea rcx, [rbp - 0x60]
call fcn.140021a08
nop
mov r8, rax
lea rdx, [0x1400609ec]
lea rcx, [rbp - 0x68]
call fcn.14000cdf8
nop
mov rdx, qword [rax]
lea rcx, [rbp + 0x190]
call fcn.1400230ec
mov rbx, rax
lea rax, [0x14005f410]
mov qword [rbp - 0x50], rax
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x38], xmm0
mov dword [rbp - 0x28], r13d
mov dword [rbp - 0x24], r12d
call fcn.1400064a8
mov rcx, rax
test rax, rax
je 0x14001374f
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x20], rax
test rbx, rbx
je 0x14001326b
mov rcx, rbx
call fcn.140032038
mov r8d, eax
mov rdx, rbx
lea rcx, [rbp - 0x20]
call fcn.1400060fc
nop
mov rdx, qword [rbp - 0x68]
add rdx, 0xffffffffffffffe8
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x14001328d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 0x60]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x1400132ab
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rax, [rbp - 0x50]
mov qword [0x1400732e8], rax
call fcn.140021ad8
mov rcx, rax
mov qword [rsp + 0x20], r13
lea r9, [0x14000f668]
xor r8d, r8d
mov edx, 0x89
call qword [sym.imp.USER32.dll_DialogBoxParamW]
mov qword [0x1400732e8], r13
lea rcx, [rbp - 0x50]
call fcn.1400059d4
nop
lea rcx, [rbp + 0x190]
call fcn.140022b38
mov rcx, qword [0x1400732d8]
test rcx, rcx
je 0x14001331e
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [0x1400732d8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x1400732d8], r13
mov rcx, qword [0x1400732d0]
test rcx, rcx
je 0x140013347
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [0x1400732d0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x1400732d0], r13
lea rdx, [0x1400613c8]
lea rcx, [0x14005f4f8]
call fcn.140025b7c
mov eax, dword [0x1400733e8]
test r12b, al
jne 0x14001337f
or eax, r12d
mov dword [0x1400733e8], eax
call fcn.1400068ec
lea rcx, [0x140053410]
call fcn.14002bb88
mov rcx, qword [0x140073370]
call qword [sym.imp.KERNEL32.dll_SetEvent]
test rsi, rsi
je 0x1400133a8
mov edx, 0x7d0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, r15d
not ebx
and ebx, r12d
test r15b, 2
je 0x140013636
mov eax, dword [0x140073480]
test r12b, al
jne 0x1400133e0
or eax, r12d
mov dword [0x140073480], eax
call fcn.140015060
lea rcx, [0x140053460]
call fcn.14002bb88
nop
lea rdx, [0x140073400]
lea rcx, [rbp + 0x80]
call fcn.14000c0d8
nop
cmp dword [rbp + 0x80], r13d
jne 0x1400134cf
lea rdx, str.no_ui__but_need_detail
lea rcx, [0x14005f4f8]
call fcn.140025b7c
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov eax, dword [0x1400733e8]
test r12b, al
jne 0x140013443
or eax, r12d
mov dword [0x1400733e8], eax
call fcn.1400068ec
lea rcx, [0x140053410]
call fcn.14002bb88
mov rdx, qword [0x140073358]
add rdx, 0x7c8
lea rcx, [rsp + 0x70]
call fcn.14000d338
nop
lea rdx, [0x140061044]
lea rcx, [rbp - 0x58]
call fcn.14000d338
mov rdi, rax
mov ecx, dword [0x140073498]
test r12b, cl
jne 0x1400134b8
or ecx, r12d
mov dword [0x140073498], ecx
mov dword [0x140073490], r13d
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, str.QQ_Bug_Report_Tool
call qword [sym.imp.WININET.dll_InternetOpenA]
mov qword [0x140073488], rax
lea rcx, [0x140053498]
call fcn.14002bb88
nop
mov r9d, r12d
lea r8, [rsp + 0x70]
mov rdx, rdi
lea rcx, [0x140073488]
call fcn.14001dbe0
mov dword [rsp + 0x40], r13d
mov eax, dword [0x1400733e8]
test r12b, al
jne 0x1400134f9
or eax, r12d
mov dword [0x1400733e8], eax
call fcn.1400068ec
lea rcx, [0x140053410]
call fcn.14002bb88
lea rdx, [rsp + 0x40]
lea rcx, [0x140073350]
call fcn.14000c008
test eax, eax
je 0x1400135dc
mov eax, dword [0x1400733e8]
test r12b, al
jne 0x140013537
or eax, r12d
mov dword [0x1400733e8], eax
call fcn.1400068ec
lea rcx, [0x140053410]
call fcn.14002bb88
mov rdx, qword [0x140073358]
mov rdx, qword [rdx + 0x840]
lea rcx, [rbp - 0x80]
call fcn.14000d338
nop
mov eax, dword [0x1400733e8]
test r12b, al
jne 0x140013574
or eax, r12d
mov dword [0x1400733e8], eax
call fcn.1400068ec
lea rcx, [0x140053410]
call fcn.14002bb88
lea rdx, [0x140073380]
lea rcx, [rsp + 0x78]
call fcn.14000d3c8
nop
mov r8, qword [rbp - 0x80]
lea rdx, [rsp + 0x78]
mov ecx, dword [rsp + 0x40]
call fcn.140022038
nop
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
or edi, 0xffffffff
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, edi
test eax, eax
jg 0x1400135bc
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 0x80]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, edi
test eax, eax
jg 0x1400135ef
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
jmp 0x1400135ef
lea rdx, str.No_need_to_set_registry_FULLDUMP_flag.
lea rcx, [0x14005f4f8]
call fcn.140025b7c
test ebx, ebx
je 0x140013625
mov eax, dword [0x1400733e8]
test r12b, al
jne 0x140013618
or eax, r12d
mov dword [0x1400733e8], eax
call fcn.1400068ec
lea rcx, [0x140053410]
call fcn.14002bb88
lea rcx, [0x140073350]
call fcn.14000a904
nop
lea rcx, [rbp + 0x80]
call fcn.14000c360
jmp 0x14001371c
call fcn.14001e830
mov rcx, rax
mov edx, r14d
call fcn.14001e898
test eax, eax
je 0x140013698
xor edx, edx
lea rcx, [rbp + 0x100]
call fcn.14000fbf8
lea rcx, [rbp + 0x100]
mov qword [0x1400732e8], rcx
call fcn.140021ad8
mov rcx, rax
mov qword [rsp + 0x20], r13
lea r9, [0x14000f668]
xor r8d, r8d
mov edx, 0x83
call qword [sym.imp.USER32.dll_DialogBoxParamW]
mov qword [0x1400732e8], r13
lea rcx, [rbp + 0x100]
jmp 0x140013717
mov edx, ebx
lea rcx, [rbp - 0x10]
call fcn.14000fbf8
lea rax, [rbp - 0x10]
mov qword [0x1400732e8], rax
call fcn.140021ad8
mov rcx, rax
mov qword [rsp + 0x20], r13
lea r9, [0x14000f668]
xor r8d, r8d
mov edx, 0x83
call qword [sym.imp.USER32.dll_DialogBoxParamW]
mov qword [0x1400732e8], r13
cmp rax, r12
jne 0x140013713
cmp dword [rbp + 8], r13d
je 0x140013713
mov eax, dword [0x1400733e8]
test r12b, al
jne 0x140013707
or eax, r12d
mov dword [0x1400733e8], eax
call fcn.1400068ec
lea rcx, [0x140053410]
call fcn.14002bb88
lea rcx, [0x140073350]
call fcn.14000a904
lea rcx, [rbp - 0x10]
call fcn.14000fcd4
mov eax, r12d
mov rcx, qword [rbp + 0x230]
xor rcx, rsp
call fcn.14002b930
lea r11, [rsp + 0x340]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 0x80004005
call fcn.140006280
nop
mov ecx, 0x80004005
call fcn.140006280
int3