Function at 0x1400047f0
Capabilities:
Accept command line arguments
Check mutex and terminate process on windows
Check mutex on windows
Create process on windows
Delete registry value
Get common file path
Persist via run registry key
Terminate process

Disassembly:
sub rsp, 0x378
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x60], rax
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0x58], rax
lea rdx, str.B5F2205A_47C4_46D8_904F_B1BFE5054C2B
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x14000491f
call fcn.14000f710
mov qword [rsp + 0x68], rax
cmp qword [rsp + 0x68], 0
je 0x14000485f
xor edx, edx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x70], 0
call qword [sym.imp.SHELL32.dll_IsUserAnAdmin]
cmp eax, 1
jne 0x140004894
lea r9, str.1EB9D573_9DAE_4E5C_BFB1_0CD5058E6B35
mov r8d, 1
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x70], rax
jmp 0x1400048b0
lea r9, str.1EB9D573_9DAE_4E5C_BFB1_0CD5058E6B35
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x70], rax
xor eax, eax
cmp eax, 1
je 0x1400048fd
mov qword [rsp + 0x78], 0
lea r8, str.DB33CC10_974B_473B_AAFA_3810679736A2
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov qword [rsp + 0x78], rax
cmp qword [rsp + 0x78], 0
je 0x1400048f9
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400048b0
jmp 0x1400048fd
cmp qword [rsp + 0x70], 0
je 0x140004910
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x1400056d1
lea rdx, str.8F192386_A2B0_4CB4_BC4E_217DEFB1805D
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140004a4e
lea r8, str.03E6745F_C007_4563_8710_E3DE7E015356
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov qword [rsp + 0x88], rax
cmp qword [rsp + 0x88], 0
je 0x14000498c
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x90], eax
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8, str.F9AD881A_C864_4F43_87F8_AB5219D42911
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov qword [rsp + 0x80], rax
cmp qword [rsp + 0x80], 0
je 0x1400049db
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x94], eax
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp eax, 1
je 0x140004a34
mov qword [rsp + 0x98], 0
lea r8, str.DB33CC10_974B_473B_AAFA_3810679736A2
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov qword [rsp + 0x98], rax
cmp qword [rsp + 0x98], 0
je 0x140004a30
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400049db
jmp 0x140004a34
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 1
jmp 0x1400056d1
lea rdx, str.7BAF2E2F_D2EE_4527_B438_328C1ED599AF
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140004b7d
lea r8, str.03E6745F_C007_4563_8710_E3DE7E015356
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov qword [rsp + 0xa8], rax
cmp qword [rsp + 0xa8], 0
je 0x140004abb
mov edx, 0xffffffff
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0xb0], eax
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8, str.F9AD881A_C864_4F43_87F8_AB5219D42911
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov qword [rsp + 0xa0], rax
cmp qword [rsp + 0xa0], 0
je 0x140004b0a
mov edx, 0xffffffff
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0xb4], eax
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp eax, 1
je 0x140004b63
mov qword [rsp + 0xb8], 0
lea r8, str.DB33CC10_974B_473B_AAFA_3810679736A2
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov qword [rsp + 0xb8], rax
cmp qword [rsp + 0xb8], 0
je 0x140004b5f
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140004b0a
jmp 0x140004b63
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 1
jmp 0x1400056d1
lea rdx, str.5592B7EA_D311_4840_972F_79D284FE2011
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140004c0a
xor eax, eax
cmp eax, 1
je 0x140004bf0
mov qword [rsp + 0xc0], 0
lea r8, str.DB33CC10_974B_473B_AAFA_3810679736A2
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov qword [rsp + 0xc0], rax
cmp qword [rsp + 0xc0], 0
je 0x140004bec
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140004b97
jmp 0x140004bf0
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 1
jmp 0x1400056d1
lea rdx, str.B61954CC_7097_4028_9F47_28648C95137F
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140004fde
mov qword [rsp + 0xd8], 0
lea rdx, [rsp + 0xc8]
lea rcx, [0x14003a1d0]
call fcn.140005d80
mov qword [rsp + 0xd0], rax
cmp qword [rsp + 0xd0], 0
je 0x140004fb8
lea rdx, [rsp + 0xe8]
lea rcx, [0x14003a1d0]
call fcn.140005fe0
mov qword [rsp + 0xe0], rax
cmp qword [rsp + 0xe0], 0
je 0x140004faa
mov edx, 0xfffe
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0xd8], rax
cmp qword [rsp + 0xd8], 0
je 0x140004faa
mov rdx, qword [rsp + 0xd8]
mov ecx, 0x7fff
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jbe 0x140004faa
lea r8, str.CA71A61E_CA4F_4B8A_9B5E_9528CD9BDB05
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xf0], rax
cmp qword [rsp + 0xf0], 0
je 0x140004f9c
xor edx, edx
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0xf8], eax
cmp dword [rsp + 0xf8], 0
je 0x140004d29
cmp dword [rsp + 0xf8], 0x80
jne 0x140004f80
lea r8, str.DB33CC10_974B_473B_AAFA_3810679736A2
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov qword [rsp + 0x190], rax
cmp qword [rsp + 0x190], 0
je 0x140004d6b
mov rcx, qword [rsp + 0x190]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140004d29
cmp dword [0x14003c040], 1
jne 0x140004db7
lea r8, [rsp + 0x1d0]
lea rdx, [0x140025e50]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x140004db7
lea rdx, [0x14003c114]
mov rcx, qword [rsp + 0x1d0]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x1d0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x14003c03c], 1
jne 0x140004e03
lea r8, [rsp + 0x1d8]
lea rdx, [0x140025eb0]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x140004e03
lea rdx, [0x14003c162]
mov rcx, qword [rsp + 0x1d8]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x1d8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r8d, gethostname
xor edx, edx
lea rcx, [rsp + 0x198]
call fcn.140019ba0
mov dword [rsp + 0x1a0], 3
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x1a8], rax
mov eax, 0x614
mov word [rsp + 0x1b8], ax
mov dword [rsp + 0x118], 0
lea rcx, [rsp + 0x198]
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
je 0x140004e86
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rsp + 0x118]
inc eax
mov dword [rsp + 0x118], eax
cmp dword [rsp + 0x118], 0xa
jle 0x140004e84
jmp 0x140004e86
jmp 0x140004e4b
mov r8d, gethostname
xor edx, edx
lea rcx, [rsp + 0x198]
call fcn.140019ba0
mov dword [rsp + 0x1a0], 3
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x1a8], rax
mov eax, 0x614
mov word [rsp + 0x1b8], ax
mov dword [rsp + 0x118], 0
lea rcx, [rsp + 0x198]
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
je 0x140004f09
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rsp + 0x118]
inc eax
mov dword [rsp + 0x118], eax
cmp dword [rsp + 0x118], 0xa
jle 0x140004f07
jmp 0x140004f09
jmp 0x140004ece
mov r8d, 0x68
xor edx, edx
lea rcx, [rsp + 0x120]
call fcn.140019ba0
mov dword [rsp + 0x120], WSAGetLastError
lea rax, [rsp + 0x100]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x120]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 0x10]
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp qword [rsp + 0xd8], 0
je 0x140004fd1
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rdx, str.B2946F67_6B85_4A08_B5C2_DEF2C013BAEE
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140005454
mov qword [rsp + 0x1f0], 0
mov qword [rsp + 0x1f8], 0
lea rdx, [rsp + 0x1e0]
lea rcx, [0x14003a1d0]
call fcn.140005d80
mov qword [rsp + 0x1e8], rax
cmp qword [rsp + 0x1e8], 0
je 0x140005415
lea rdx, [rsp + 0x208]
lea rcx, [0x14003a1d0]
call fcn.140005fe0
mov qword [rsp + 0x200], rax
cmp qword [rsp + 0x200], 0
je 0x140005407
mov edx, 0xfffe
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x1f8], rax
cmp qword [rsp + 0x1f8], 0
je 0x140005407
mov rdx, qword [rsp + 0x1f8]
mov ecx, 0x7fff
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jbe 0x140005407
mov edx, 0xfffe
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x1f0], rax
cmp qword [rsp + 0x1f0], 0
je 0x1400053f9
mov r8d, reloc.WS2_32.dll_recv
xor edx, edx
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 0x18]
call fcn.14001a714
mov dword [rsp + 0x20c], eax
mov eax, dword [rsp + 0x20c]
mov dword [rsp + 0x28], eax
lea rax, str.25200812_79A6_4DAE_810C_5AD7D944C048
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x58]
mov r9, qword [rax + 0x10]
lea r8, str.__s___s__x
mov edx, 0x7fff
mov rcx, qword [rsp + 0x1f0]
call qword [sym.imp.SHLWAPI.dll_wnsprintfW]
lea r8, str.CA71A61E_CA4F_4B8A_9B5E_9528CD9BDB05
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x210], rax
cmp qword [rsp + 0x210], 0
je 0x1400053f9
xor edx, edx
mov rcx, qword [rsp + 0x210]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x218], eax
cmp dword [rsp + 0x218], 0
je 0x140005187
cmp dword [rsp + 0x218], 0x80
jne 0x1400053dd
lea r8, str.DB33CC10_974B_473B_AAFA_3810679736A2
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov qword [rsp + 0x2b0], rax
cmp qword [rsp + 0x2b0], 0
je 0x1400051c9
mov rcx, qword [rsp + 0x2b0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140005187
cmp dword [0x14003c040], 1
jne 0x140005215
lea r8, [rsp + 0x2f0]
lea rdx, [0x140025f10]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x140005215
lea rdx, [0x14003c114]
mov rcx, qword [rsp + 0x2f0]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x2f0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x14003c03c], 1
jne 0x140005261
lea r8, [rsp + 0x2f8]
lea rdx, [0x140025f70]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x140005261
lea rdx, [0x14003c162]
mov rcx, qword [rsp + 0x2f8]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x2f8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r8d, gethostname
xor edx, edx
lea rcx, [rsp + 0x2b8]
call fcn.140019ba0
mov dword [rsp + 0x2c0], 3
mov rax, qword [rsp + 0x1e8]
mov qword [rsp + 0x2c8], rax
mov eax, 0x614
mov word [rsp + 0x2d8], ax
mov dword [rsp + 0x238], 0
lea rcx, [rsp + 0x2b8]
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
je 0x1400052e4
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rsp + 0x238]
inc eax
mov dword [rsp + 0x238], eax
cmp dword [rsp + 0x238], 5
jle 0x1400052e2
jmp 0x1400052e4
jmp 0x1400052a9
mov r8d, gethostname
xor edx, edx
lea rcx, [rsp + 0x2b8]
call fcn.140019ba0
mov dword [rsp + 0x2c0], 3
mov rax, qword [rsp + 0x200]
mov qword [rsp + 0x2c8], rax
mov eax, 0x614
mov word [rsp + 0x2d8], ax
mov dword [rsp + 0x238], 0
lea rcx, [rsp + 0x2b8]
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
je 0x140005367
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rsp + 0x238]
inc eax
mov dword [rsp + 0x238], eax
cmp dword [rsp + 0x238], 5
jle 0x140005365
jmp 0x140005367
jmp 0x14000532c
mov r8d, 0x68
xor edx, edx
lea rcx, [rsp + 0x240]
call fcn.140019ba0
mov dword [rsp + 0x240], WSAGetLastError
lea rax, [rsp + 0x220]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x240]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x1f8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x1f0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov rcx, qword [rsp + 0x210]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, qword [rsp + 0x210]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x200]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x1e8]
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp qword [rsp + 0x1f0], 0
je 0x14000542e
mov rcx, qword [rsp + 0x1f0]
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp qword [rsp + 0x1f8], 0
je 0x140005447
mov rcx, qword [rsp + 0x1f8]
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rdx, str.5BB47D30_8E97_43DC_82E3_3AD346BF18A4
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1400056cc
lea rdx, [rsp + 0x300]
lea rcx, [0x14003a1d0]
call fcn.140005d80
mov qword [rsp + 0x308], rax
cmp qword [rsp + 0x308], 0
je 0x1400056c4
lea rdx, [rsp + 0x318]
lea rcx, [0x14003a1d0]
call fcn.140005fe0
mov qword [rsp + 0x310], rax
cmp qword [rsp + 0x310], 0
je 0x1400056b6
lea r8, str.DB33CC10_974B_473B_AAFA_3810679736A2
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov qword [rsp + 0x320], rax
cmp qword [rsp + 0x320], 0
je 0x14000550a
mov rcx, qword [rsp + 0x320]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400054c8
cmp dword [0x14003c040], 1
jne 0x140005556
lea r8, [rsp + 0x360]
lea rdx, [0x140025fd0]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x140005556
lea rdx, [0x14003c114]
mov rcx, qword [rsp + 0x360]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x360]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x14003c03c], 1
jne 0x1400055a2
lea r8, [rsp + 0x368]
lea rdx, [0x140026030]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x1400055a2
lea rdx, [0x14003c162]
mov rcx, qword [rsp + 0x368]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x368]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r8d, gethostname
xor edx, edx
lea rcx, [rsp + 0x328]
call fcn.140019ba0
mov dword [rsp + 0x330], 3
mov rax, qword [rsp + 0x308]
mov qword [rsp + 0x338], rax
mov eax, 0x614
mov word [rsp + 0x348], ax
mov dword [rsp + 0x31c], 0
lea rcx, [rsp + 0x328]
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
je 0x140005625
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rsp + 0x31c]
inc eax
mov dword [rsp + 0x31c], eax
cmp dword [rsp + 0x31c], 5
jle 0x140005623
jmp 0x140005625
jmp 0x1400055ea
mov r8d, gethostname
xor edx, edx
lea rcx, [rsp + 0x328]
call fcn.140019ba0
mov dword [rsp + 0x330], 3
mov rax, qword [rsp + 0x310]
mov qword [rsp + 0x338], rax
mov eax, 0x614
mov word [rsp + 0x348], ax
mov dword [rsp + 0x31c], 0
lea rcx, [rsp + 0x328]
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
je 0x1400056a8
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rsp + 0x31c]
inc eax
mov dword [rsp + 0x31c], eax
cmp dword [rsp + 0x31c], 5
jle 0x1400056a6
jmp 0x1400056a8
jmp 0x14000566d
mov rcx, qword [rsp + 0x310]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x308]
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, 1
add rsp, 0x378
ret