Function at 0x1401777f0
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x380
mov rax, qword [0x1404ee340]
xor rax, rsp
mov qword [rsp + 0x370], rax
cmp dword [rsp + 0x390], 1
jne 0x140177afc
lea rdx, str.SOFTWAREWOW6432NodeTencentMobileGamePC_
lea rcx, [rsp + 0xd0]
call fcn.1400dbad0
nop
lea rcx, [rsp + 0x150]
call fcn.14007a1c0
nop
mov edx, Ordinal_27
lea rcx, [rsp + 0xb8]
call fcn.140069370
lea rcx, [rsp + 0xb8]
call fcn.14017b040
nop
lea rcx, [rsp + 0xd0]
call fcn.1400a41f0
lea rcx, [rsp + 0x88]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jne 0x140177ab1
lea rax, [0x1404b8b24]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x90], 0
lea r8, [0x1404b8b1c]
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x130]
call fcn.14017c4b0
nop
lea rcx, [rsp + 0x130]
call fcn.1400a41f0
lea r8, [rsp + 0x80]
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jne 0x140177a6c
mov dword [rsp + 0x90], 0x1fe
lea rax, [rsp + 0x170]
mov rdi, rax
xor eax, eax
mov ecx, 0x1fe
rep stosb byte [rdi], al
lea rax, [rsp + 0x90]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x170]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.InstallPath
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jne 0x140177a5e
lea rdx, [rsp + 0x170]
lea rcx, [rsp + 0x110]
call fcn.1400dbad0
nop
lea r8, str.AndroidEmulatorEx.exe
lea rdx, [rsp + 0x110]
lea rcx, [rsp + 0x98]
call fcn.14017c4b0
nop
mov r9w, Ordinal_35
mov r8d, 1
xor edx, edx
lea rcx, [rsp + 0x98]
call fcn.14017b2a0
lea rdx, str..exe_
lea rcx, [rsp + 0x60]
call fcn.1400dbad0
nop
lea rdx, str..exe
lea rcx, [rsp + 0x40]
call fcn.1400dbad0
nop
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x98]
call fcn.1401776e0
nop
lea rcx, [rsp + 0x40]
call fcn.1400764e0
nop
lea rcx, [rsp + 0x60]
call fcn.1400764e0
lea r8, str.__vm_100
lea rdx, [rsp + 0x98]
lea rcx, [rsp + 0xf0]
call fcn.14017c4b0
nop
lea rcx, [rsp + 0xf0]
call fcn.140177770
nop
lea rcx, [rsp + 0xf0]
call fcn.1400764e0
nop
lea rcx, [rsp + 0x98]
call fcn.1400764e0
nop
lea rcx, [rsp + 0x110]
call fcn.1400764e0
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:WindowsGameloop_Anticheat_Disable.exe
lea rdx, [0x1404b8c58]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rcx, [rsp + 0x130]
call fcn.1400764e0
jmp 0x140177ac4
lea rdx, str._n____Please_Install_The_Emulator_Properly_n
lea rcx, [0x140554c50]
call fcn.14017c580
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rsp + 0xb8]
call fcn.14017b020
nop
lea rcx, [rsp + 0x150]
call fcn.1400764e0
nop
lea rcx, [rsp + 0xd0]
call fcn.1400764e0
mov rcx, qword [rsp + 0x370]
xor rcx, rsp
call fcn.1402217a0
add rsp, 0x380
pop rdi
ret