Function at 0x7ff6749de530
Capabilities:
Create process on windows
Delete file
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x810]
sub rsp, 0x910
mov rax, qword [0x7ff675045040]
xor rax, rsp
mov qword [rbp + 0x800], rax
xorps xmm0, xmm0
lea rcx, [rbp - 0x38]
xor eax, eax
movups xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x28], rax
call fcn.7ff6749de380
xorps xmm0, xmm0
lea rdx, [0x7ff675006888]
xorps xmm1, xmm1
lea rcx, [rsp + 0x50]
movdqu xmmword [rbp - 0x58], xmm0
movdqu xmmword [rbp - 0x48], xmm1
call fcn.7ff6749ddba0
lea rdx, [rsp + 0x50]
mov qword [rbp - 0x60], 0xffffffff80000001
lea rcx, [rbp - 0x58]
call fcn.7ff6749ddce0
mov rdx, qword [rsp + 0x68]
cmp rdx, 7
jbe 0x7ff6749de5f7
mov rcx, qword [rsp + 0x50]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff6749de5f2
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff6749deb1f
call fcn.7ff674a3e32c
xor edi, edi
lea rdx, [0x7ff6750068a0]
xorps xmm0, xmm0
lea rcx, [rsp + 0x50]
movups xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x20], di
lea r13d, [rdi + 7]
call fcn.7ff6749ddba0
cmp qword [rbp - 0x40], r13
lea rax, [rsp + 0x70]
mov rcx, qword [rbp - 0x60]
lea rdx, [rbp - 0x58]
cmova rdx, qword [rbp - 0x58]
lea r9d, [rdi + 1]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.advapi32.dll_RegOpenKeyExW]
test eax, eax
je 0x7ff6749de64c
mov bl, 1
jmp 0x7ff6749de733
cmp qword [rsp + 0x68], r13
lea rax, [rbp - 0x68]
mov rcx, qword [rsp + 0x70]
lea rdx, [rsp + 0x50]
cmova rdx, qword [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
lea rax, [rbp]
mov dword [rbp - 0x68], 0x800
mov qword [rsp + 0x20], rax
call qword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
je 0x7ff6749de69c
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.advapi32.dll_RegCloseKey]
mov bl, 1
jmp 0x7ff6749de733
lea rdx, [rbp]
lea rcx, [rsp + 0x78]
call fcn.7ff6749ddba0
lea rcx, [rbp - 0x20]
cmp rcx, rax
je 0x7ff6749de6d3
movups xmm1, xmmword [rax + 0x10]
movups xmm0, xmmword [rax]
mov qword [rax + 0x18], r13
psrldq xmm1, 8
movq r13, xmm1
mov qword [rax + 0x10], rdi
movups xmmword [rbp - 0x20], xmm0
mov word [rax], di
mov rdx, qword [rbp - 0x70]
cmp rdx, 7
jbe 0x7ff6749de714
mov rcx, qword [rsp + 0x78]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff6749de70f
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff6749deb0d
call fcn.7ff674a3e32c
movdqa xmm0, xmmword [0x7ff67500ade0]
mov rcx, qword [rsp + 0x70]
movdqu xmmword [rbp - 0x78], xmm0
mov word [rsp + 0x78], di
call qword [sym.imp.advapi32.dll_RegCloseKey]
xor bl, bl
mov rdx, qword [rsp + 0x68]
cmp rdx, 7
jbe 0x7ff6749de775
mov rcx, qword [rsp + 0x50]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff6749de770
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff6749deb13
call fcn.7ff674a3e32c
test bl, bl
je 0x7ff6749de8eb
lea rdx, [0x7ff6750068b0]
lea rcx, [rsp + 0x50]
call fcn.7ff6749ddba0
lea rdx, [0x7ff6750068a0]
lea rcx, [rsp + 0x78]
call fcn.7ff6749ddba0
cmp qword [rbp - 0x40], 7
lea rax, [rsp + 0x70]
mov rcx, qword [rbp - 0x60]
lea rdx, [rbp - 0x58]
cmova rdx, qword [rbp - 0x58]
xor r9d, r9d
mov qword [rsp + 0x40], rdi
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], edi
call qword [sym.imp.advapi32.dll_RegCreateKeyExW]
test eax, eax
jne 0x7ff6749de830
mov eax, dword [rsp + 0x60]
lea rcx, [rsp + 0x50]
inc eax
lea rdx, [rsp + 0x78]
cmp qword [rsp + 0x68], 7
mov r9d, 1
mov dword [rsp + 0x28], eax
cmova rcx, qword [rsp + 0x50]
cmp qword [rbp - 0x70], 7
mov qword [rsp + 0x20], rcx
cmova rdx, qword [rsp + 0x78]
xor r8d, r8d
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.advapi32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.advapi32.dll_RegCloseKey]
mov rdx, qword [rbp - 0x70]
cmp rdx, 7
jbe 0x7ff6749de871
mov rcx, qword [rsp + 0x78]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff6749de86c
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff6749deb19
call fcn.7ff674a3e32c
mov rdx, qword [rsp + 0x68]
movdqa xmm0, xmmword [0x7ff67500ade0]
mov word [rsp + 0x78], di
movdqu xmmword [rbp - 0x78], xmm0
cmp rdx, 7
jbe 0x7ff6749de8c5
mov rcx, qword [rsp + 0x50]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff6749de8c0
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff6749deb19
call fcn.7ff674a3e32c
mov dword [rsp + 0x28], 1
lea r8, [0x7ff6750068b8]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
lea rdx, [0x7ff6750068f8]
xor ecx, ecx
call qword [sym.imp.shell32.dll_ShellExecuteW]
mov rbx, qword [rbp - 0x38]
mov r12, qword [rbp - 0x30]
cmp rbx, r12
je 0x7ff6749de980
nop dword [rax]
mov r15, qword [rbx + 0x18]
mov rdi, rbx
mov r14, qword [rbx + 0x10]
cmp r15, 0xf
jbe 0x7ff6749de914
mov rdi, qword [rbx]
cmp r14, 9
jb 0x7ff6749de975
lea rsi, [r14 + rdi]
mov edx, 0x2d
lea r8, [rsi - 8]
mov rcx, rdi
sub r8, rdi
call fcn.7ff674cf7100
test rax, rax
je 0x7ff6749de975
nop word [rax + rax]
movabs rcx, 0x6574656c65642d2d
cmp qword [rax], rcx
jne 0x7ff6749de959
cmp byte [rax + 8], 0x3d
je 0x7ff6749dea65
inc rax
lea r8, [rsi - 8]
sub r8, rax
mov rcx, rax
mov edx, 0x2d
call fcn.7ff674cf7100
test rax, rax
jne 0x7ff6749de940
xor edi, edi
add rbx, 0x20
cmp rbx, r12
jne 0x7ff6749de900
jmp 0x7ff6757c817c
sub rax, rdi
xor edi, edi
cmp rax, 0xffffffffffffffff
je 0x7ff6749de977
lea rax, [r14 - 9]
mov qword [rbp - 0x78], rdi
mov r8, 0xffffffffffffffff
mov qword [rbp - 0x70], rdi
cmp rax, r8
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
cmovb r8, rax
mov rdx, rbx
cmp r15, 0xf
jbe 0x7ff6749deaa2
mov rdx, qword [rbx]
add rdx, 9
lea rcx, [rsp + 0x78]
call fcn.7ff6749dde80
cmp qword [rbp - 0x70], 0xf
lea rcx, [rsp + 0x78]
cmova rcx, qword [rsp + 0x78]
call qword [sym.imp.kernel32.dll_DeleteFileA]
mov rdx, qword [rbp - 0x70]
cmp rdx, 0xf
jbe 0x7ff6749de977
mov rcx, qword [rsp + 0x78]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff6749deafd
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff6749deb07
call fcn.7ff674a3e32c
jmp 0x7ff6749de977
call fcn.7ff674cd5b3c
int3
call fcn.7ff674cd5b3c
int3
call fcn.7ff674cd5b3c
int3
call fcn.7ff674cd5b3c
int3
call fcn.7ff674cd5b3c
int3