Function at 0x100006600
Capabilities:
Create process on windows
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1c0
mov rax, qword [0x10001a100]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
mov rcx, qword [0x10001dae0]
lea rdx, [0x10001d6a0]
mov r8d, 0x103
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor r15d, r15d
cmp eax, r15d
jne 0x10000665e
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x100006c1c
lea r13, [0x1000019a8]
mov word [0x10001d8a6], r15w
mov edi, r15d
mov r14, r15
lea rbp, [0x100000000]
mov esi, 1
mov qword [rsp + 0x78], r13
mov r9d, dword [r13]
lea r8, [0x100001ac0]
lea rcx, [0x10001d9f0]
mov edx, 0x28
lea rbx, [0x10001bd10]
call fcn.100004f60
cmp eax, r15d
mov r11d, eax
jl 0x100006c1c
mov r8, qword [r14 + rbp + 0x1bdb8]
cmp r8, r15
je 0x10000670b
lea rax, [0x10001d600]
mov edx, 0x28
mov r11d, r15d
mov rcx, rax
sub r8, rax
lea rax, [rdx + 0x7fffffd6]
cmp rax, r15
je 0x1000066f8
movzx eax, word [r8 + rcx]
cmp ax, r15w
je 0x1000066f8
mov word [rcx], ax
add rcx, 2
sub rdx, rsi
jne 0x1000066d5
cmp rdx, r15
jne 0x100006707
sub rcx, 2
mov r11d, 0x8007007a
mov word [rcx], r15w
cmp r11d, r15d
jl 0x100006c19
mov r8, qword [r14 + rbp + 0x1bf38]
lea rax, [0x10001d8b0]
mov edx, 0x64
sub r8, rax
mov rcx, rax
mov r11d, r15d
lea rax, [rdx + 0x7fffff9a]
cmp rax, r15
je 0x100006754
movzx eax, word [r8 + rcx]
cmp ax, r15w
je 0x100006754
mov word [rcx], ax
add rcx, 2
sub rdx, rsi
jne 0x100006731
cmp rdx, r15
jne 0x100006763
sub rcx, 2
mov r11d, 0x8007007a
cmp r11d, r15d
mov word [rcx], r15w
jl 0x100006c19
cmp qword [0x10001bd10], r15
je 0x100006886
lea rax, [rbx + 8]
cmp qword [rax], r15
je 0x10000687d
cmp qword [rbx + 0x10], r15
je 0x10000687d
mov r8, qword [rbx]
mov r9, qword [rax]
lea rcx, [rsp + 0x110]
mov edx, 0x50
mov rbx, rax
call fcn.100004f60
cmp eax, r15d
jl 0x100006c1c
mov qword [rsp + 0x40], r15
lea rax, [rsp + 0x60]
lea rdx, [rsp + 0x110]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000000
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], r15d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, r15d
jne 0x10000682c
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x60]
mov r9d, esi
lea eax, [rax + rax + 2]
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x28], eax
mov rax, qword [rbx + 8]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, r15d
je 0x10000682e
add edi, esi
mov rcx, qword [rbx + 0x10]
cmp rcx, r15
je 0x10000686e
add rcx, 2
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rsp + 0x60]
lea eax, [rax + rax + 2]
mov r9d, esi
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov rax, qword [rbx + 0x18]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, r15d
je 0x10000686e
add edi, esi
mov rcx, qword [rsp + 0x60]
add rbx, 0x20
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp qword [rbx], r15
jne 0x10000677d
cmp dword [0x10001daf4], r15d
je 0x1000069d7
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x68]
xor r9d, r9d
mov r8d, esi
mov qword [rsp + 0x68], r15
mov dword [rsp + 0x50], r15d
call fcn.10000637c
cmp eax, r15d
jne 0x100006993
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x50], r15
mov r12d, r15d
mov ebp, r15d
mov dword [rsp + 0x80], 0x18
mov dword [rsp + 0x90], r15d
mov qword [rsp + 0x88], rax
mov r13d, 1
mov eax, ebp
mov ebx, 2
neg eax
sbb esi, esi
add esi, 2
cmp esi, ebx
je 0x10000690e
mov dl, r13b
mov ecx, esi
call fcn.100005120
cmp al, r15b
cmovne ebx, esi
mov qword [rsp + 0x40], r15
lea rax, [rsp + 0x50]
cmp ebp, r15d
mov qword [rsp + 0x38], rax
cmovne r12d, r13d
lea rax, [rsp + 0x80]
mov qword [rsp + 0x30], rax
lea rdx, [0x100001b10]
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0x2011f
mov dword [rsp + 0x20], r15d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, r15d
mov esi, eax
cmove r12d, r13d
cmp ebx, 2
je 0x10000696f
xor edx, edx
mov ecx, ebx
call fcn.100005120
mov ebp, r13d
cmp r12d, r15d
je 0x1000068ec
mov r13, qword [rsp + 0x78]
cmp esi, r15d
je 0x100006b1c
mov rsi, rbp
lea rbp, [0x100000000]
add edi, esi
call fcn.10000a9ac
cmp al, r15b
je 0x1000069b6
lea rcx, [0x10001bef0]
call fcn.10000642c
mov ecx, r15d
cmp al, r15b
sete cl
add edi, ecx
call fcn.10000a9ac
cmp al, r15b
je 0x1000069d7
lea rcx, [0x10001bce8]
call fcn.10000642c
mov ecx, r15d
cmp al, r15b
sete cl
add edi, ecx
lea rax, [rsp + 0x70]
lea rdx, [0x100001bb8]
mov r9d, esi
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, r15d
jne 0x100006aec
mov rcx, qword [rsp + 0x70]
lea rax, [rsp + 0x58]
lea rdx, [0x100001bd8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x5c]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x58], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r15d
jne 0x100006ae1
cmp dword [rsp + 0x5c], esi
jne 0x100006ae1
xor edx, edx
lea rcx, [rsp + 0xa0]
lea r8d, [rdx + 0x68]
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x80]
lea rcx, [0x100001c08]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xa0]
xor r9d, r9d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], r15d
mov dword [rsp + 0xa0], 0x68
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, r15d
je 0x100006ae1
mov rcx, qword [rsp + 0x80]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add r13, 0x10
lea rax, [0x1000019b8]
add r14, 8
cmp r13, rax
mov qword [rsp + 0x78], r13
jl 0x100006684
cmp edi, r15d
je 0x100006bd9
mov eax, 0x80040201
jmp 0x100006c1c
lea rbp, [0x10001d6a0]
mov r12d, 0x5c
mov rcx, rbp
mov edx, r12d
call qword [sym.imp.msvcrt.dll_wcsrchr]
mov rbx, rax
cmp rax, r15
je 0x100006b86
cmp rax, rbp
je 0x100006b86
mov rcx, rbp
mov word [rax], r15w
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x50]
lea esi, [r12 - 0x5b]
lea eax, [rax + rax + 2]
lea rdx, [0x100001b78]
mov r9d, esi
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, r15d
je 0x100006b80
add edi, esi
mov word [rbx], r12w
jmp 0x100006b8d
mov esi, 1
add edi, esi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x50]
lea rdx, [0x100001ba0]
lea eax, [rax + rax + 2]
mov r9d, esi
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, r15d
je 0x100006bc2
add edi, esi
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rbp, [0x100000000]
jmp 0x100006995
mov rax, qword [0x10001db08]
cmp rax, r15
jne 0x100006bfe
lea rcx, [0x100001cc8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x10001db08], rax
cmp rax, r15
je 0x100006c15
lea rdx, [0x100001a60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp rax, r15
je 0x100006c15
call rax
xor eax, eax
jmp 0x100006c1c
mov eax, r11d
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.1000170f0
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret