Function at 0x140001200
Capabilities:
Create process on windows
Delete registry key
Delete registry value
Get common file path
Get file attributes
Get file size
Identify system language via api
Query or enumerate registry value
Read file on windows
Set registry value
Terminate process
Timestomp file

Disassembly:
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x160
call fcn.1400023e0
movzx eax, al
test eax, eax
jne 0x140001227
mov eax, 0xffffffff
jmp 0x140001917
xor eax, eax
test eax, eax
je 0x14000164a
xor ecx, ecx
call qword [sym.imp.GDI32.dll_DeleteObject]
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
xor ecx, ecx
call qword [sym.imp.ole32.dll_ReleaseStgMedium]
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoTaskMemFree]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadStringW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_RegisterClipboardFormatW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_InsertMenuItemW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_CharUpperW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadBitmapW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_DestroyMenu]
call qword [sym.imp.USER32.dll_CreatePopupMenu]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetDesktopFolder]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalSize]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalLock]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReadFile]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlVirtualUnwind]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindClose]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetFileTime]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea rcx, [rsp + 0x60]
call fcn.140001000
mov rdx, rax
lea rcx, [rsp + 0xe0]
call fcn.1400025f0
mov qword [rsp + 0x78], 0
mov dword [rsp + 0x70], 0
lea rcx, [rsp + 0x61]
call fcn.140001040
mov qword [rsp + 0x88], rax
lea rcx, [rsp + 0x62]
call fcn.140001020
mov rcx, rax
call fcn.140002970
mov qword [rsp + 0x90], rax
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x90]
call fcn.140001fb0
mov qword [rsp + 0x98], rax
mov dword [rsp + 0x50], 1
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0xe0]
lea rcx, [rsp + 0x78]
call qword [rsp + 0x98]
mov dword [rsp + 0x70], eax
lea rax, [rsp + 0x100]
mov rdi, rax
xor eax, eax
mov ecx, 0x58
rep stosb byte [rdi], al
mov qword [rsp + 0x100], 0x58
mov dword [rsp + 0x108], 0
call fcn.140003146
mov r8d, 0x20
mov edx, 8
mov rcx, qword [rax + 0x30]
call fcn.1400024d0
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
mov qword [rax], 0x28
mov eax, 0x20
imul rax, rax, 0
mov rcx, qword [rsp + 0x68]
mov qword [rcx + rax + 8], 0x20005
movzx eax, word [rsp + 0xe0]
mov ecx, 0x20
imul rcx, rcx, 0
mov rdx, qword [rsp + 0x68]
mov qword [rdx + rcx + 0x10], rax
mov eax, 0x20
imul rax, rax, 0
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0xe8]
mov qword [rcx + rax + 0x18], rdx
mov qword [rsp + 0x80], 0
lea rcx, [rsp + 0x63]
call fcn.140001060
mov rcx, rax
call fcn.140001ac0
mov qword [rsp + 0xa8], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0xa0], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x100]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0x1fffff
mov r8d, 0x1fffff
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0xf0]
call qword [rsp + 0xa8]
lea rcx, [rsp + 0x64]
call fcn.140001080
mov rcx, rax
call fcn.140001ac0
mov qword [rsp + 0xb8], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0xb0], rax
xor edx, edx
mov rcx, qword [rsp + 0xb0]
call qword [rsp + 0xb8]
call fcn.140003146
mov r8, qword [rsp + 0x68]
xor edx, edx
mov rcx, qword [rax + 0x30]
call fcn.140002550
lea rcx, [rsp + 0x65]
call fcn.1400010c0
mov qword [rsp + 0xc0], rax
lea rcx, [rsp + 0x66]
call fcn.1400010a0
mov rcx, rax
call fcn.140002970
mov qword [rsp + 0xc8], rax
mov rdx, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0xc8]
call fcn.140001fb0
mov qword [rsp + 0xd8], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0xd0], rax
mov rcx, qword [rsp + 0xd0]
call qword [rsp + 0xd8]
call fcn.140001ad0
mov eax, 0x6e
add rsp, 0x160
pop rdi
ret