Function at 0x140001000
Capabilities:
Create directory
Extract resource via kernel32 functions
Get common file path
Get installed programs
Get startup folder
Persist via lnk shortcut
Query or enumerate registry value
Set registry value
Terminate process
Write file on windows
Write file to startup folder

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x68
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
xor ecx, ecx
mov qword [0x1400033e8], rax
call qword [sym.imp.ole32.dll_CoInitialize]
xor r9d, r9d
lea r12, [0x1400031e0]
mov rdx, r12
xor ecx, ecx
lea r8d, [r9 + 0x1c]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea rdx, str.darkpad
mov rcx, r12
call sub.msvcrt.dll_wcscat
xor edx, edx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea rdx, [0x140002360]
mov rcx, r12
call sub.msvcrt.dll_wcscat
and qword [rsp + 0x30], 0
mov r15d, 0x80
mov r14d, 0x40000000
mov dword [rsp + 0x28], r15d
mov edx, r14d
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rcx, qword [0x1400033e8]
lea r13d, [r15 - 0x76]
mov r8d, r13d
lea edx, [r15 - 0x3a]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdx, rax
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdx, rbx
xor ecx, ecx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
and qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, eax
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rbp - 0x20]
xor edx, edx
lea r9, [0x140002748]
mov qword [rsp + 0x20], rax
lea r8d, [r15 - 0x7f]
lea rcx, [0x140002768]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov rcx, qword [rbp - 0x20]
mov rdx, r12
mov rax, qword [rcx]
call qword [rax + 0xa0]
mov rcx, qword [rbp - 0x20]
lea r12, [0x140002380]
mov rdx, r12
mov rax, qword [rcx]
call qword [rax + 0x38]
mov rcx, qword [rbp - 0x20]
lea r8, [rbp - 0x18]
lea rdx, [0x140002758]
mov rax, qword [rcx]
call qword [rax]
lea r9, [rbp - 0x10]
xor r8d, r8d
xor edx, edx
lea rcx, [0x140002738]
call sub.SHELL32.dll_SHGetKnownFolderPath
lea rax, [0x140002390]
mov r9, qword [rbp - 0x10]
lea rbx, [0x1400031e0]
mov rcx, rbx
mov qword [rsp + 0x20], rax
lea r8, [0x1400023b0]
mov edx, 0x104
call sub.msvcrt.dll__snwprintf
mov rcx, qword [rbp - 0x18]
lea r8d, [r15 - 0x7f]
mov rdx, rbx
mov rax, qword [rcx]
call qword [rax + 0x30]
mov rcx, qword [rbp - 0x18]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x20]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
xor r9d, r9d
lea r8d, [r15 - 0x64]
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea rdx, str.darkpaduninstaller.exe
mov rcx, rbx
call sub.msvcrt.dll_wcscat
and qword [rsp + 0x30], 0
mov edx, r14d
lea r14, [0x1400031e0]
mov dword [rsp + 0x28], r15d
mov rcx, r14
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rcx, qword [0x1400033e8]
lea edx, [r15 - 0x39]
mov r8d, r13d
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdx, rax
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdx, rbx
xor ecx, ecx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
xor r15d, r15d
xor r9d, r9d
mov r8d, eax
mov qword [rsp + 0x20], r15
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8, [rbp - 0x28]
mov rcx, 0xffffffff80000001
lea rdx, [0x1400023f8]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov rcx, qword [rbp - 0x28]
lea esi, [r13 - 6]
lea rax, [rbp + 0x50]
mov dword [rsp + 0x28], esi
mov r9d, esi
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp + 0x50], 1
lea rdx, [0x140002420]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rax, [rbp + 0x50]
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
lea rdx, [0x140002438]
mov r9d, esi
xor r8d, r8d
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp - 0x28]
lea rax, [rbp + 0x50]
mov dword [rsp + 0x28], esi
lea rdx, [0x140002450]
mov r9d, esi
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp + 0x50], r15d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [0x1400033e8]
lea edx, [rsi + 0x44]
mov r8d, r13d
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdx, rax
xor ecx, ecx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdx, rdi
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, qword [rbp - 0x28]
lea r9d, [r13 - 7]
mov dword [rsp + 0x28], eax
lea rdx, [0x140002468]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r8, [rbp - 0x28]
mov rcx, 0xffffffff80000001
lea rdx, [0x140002480]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov rcx, qword [rbp - 0x28]
lea rdx, str.DisplayName
mov dword [rsp + 0x28], 0x10
xor r8d, r8d
mov qword [rsp + 0x20], r12
lea r12d, [r13 - 9]
mov r9d, r12d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp - 0x28]
lea rax, [0x140002510]
mov dword [rsp + 0x28], esi
lea rdx, str.DisplayVersion
mov r9d, r12d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp - 0x28]
lea rax, [0x140002538]
lea ebx, [rsi + 0x18]
mov r9d, r12d
mov dword [rsp + 0x28], ebx
lea rdx, str.Publisher
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, r14
call sub.msvcrt.dll_wcslen
mov r9d, r12d
lea rdx, str.UninstallString
xor r8d, r8d
lea ecx, [rax*2 + 2]
mov dword [rsp + 0x28], ecx
mov rcx, qword [rbp - 0x28]
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor r9d, r9d
mov r8d, ebx
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea rdx, str.darkpad
mov rcx, r14
call sub.msvcrt.dll_wcscat
mov rcx, r14
call sub.msvcrt.dll_wcslen
mov r9d, r12d
lea rdx, str.InstallLocation
xor r8d, r8d
lea ecx, [rax*2 + 2]
mov dword [rsp + 0x28], ecx
mov rcx, qword [rbp - 0x28]
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rdx, [0x140002360]
mov rcx, r14
call sub.msvcrt.dll_wcscat
mov rcx, r14
call sub.msvcrt.dll_wcslen
mov r9d, r12d
lea rdx, str.DisplayIcon
xor r8d, r8d
lea ecx, [rax*2 + 2]
mov dword [rsp + 0x28], ecx
mov rcx, qword [rbp - 0x28]
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp - 0x28]
lea rax, [rbp + 0x50]
mov dword [rsp + 0x28], esi
lea rdx, str.EstimatedSize
mov r9d, esi
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp + 0x50], 0x14
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, r15d
lea rbx, section..data
mov esi, 0x208
lea r13, [0x140002690]
mov r9, qword [rbx]
lea r8, [0x1400025f0]
mov edx, 0x104
mov rcx, r14
call sub.msvcrt.dll__snwprintf
lea r8, [rbp - 0x28]
mov rdx, r14
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x1400016ba
mov dword [rbp + 0x58], 0x61
jmp 0x140001589
cmp dword [rbp + 0x60], r12d
jne 0x140001641
mov ecx, dword [rbp + 0x48]
test ecx, ecx
je 0x140001641
lea eax, [rcx - 0x16]
test eax, 0xfffffffd
jne 0x140001573
mov r8d, ecx
mov rdx, r13
shr r8, 1
mov rcx, r14
call sub.msvcrt.dll__wcsnicmp
test eax, eax
je 0x1400015d4
movzx eax, word [rbp + 0x58]
add ax, r12w
mov word [rbp + 0x58], ax
cmp ax, 0x7a
ja 0x1400016b0
mov rcx, qword [rbp - 0x28]
lea rax, [rbp + 0x48]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x60]
xor r8d, r8d
mov qword [rsp + 0x20], r14
lea rdx, [rbp + 0x58]
mov dword [rbp + 0x48], esi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14000153f
mov rcx, qword [rbp - 0x28]
lea rdx, [rbp + 0x58]
mov dword [rsp + 0x28], 0x18
mov r9d, r12d
xor r8d, r8d
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp - 0x28]
lea rax, [rbp + 0x48]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x60]
xor r8d, r8d
mov qword [rsp + 0x20], r14
lea rdx, [0x140002728]
mov dword [rbp + 0x48], esi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx r8d, word [rbp + 0x58]
test eax, eax
jne 0x140001673
mov eax, dword [rbp + 0x48]
mov rcx, r15
shr eax, 1
je 0x14000166f
mov edx, eax
cmp word [r14 + rcx*2], r8w
je 0x1400016b0
add rcx, r12
cmp rcx, rdx
jl 0x140001612
mov edx, eax
mov ecx, eax
cmp word [r14 + rax*2 - 2], r15w
jne 0x14000167b
mov word [r14 + rax*2 - 2], r8w
mov ecx, r12d
mov word [r14 + rax*2], r15w
jmp 0x14000168b
mov r9, qword [rbx]
lea r8, [0x1400026b0]
mov edx, 0x104
mov rcx, r14
call sub.msvcrt.dll__snwprintf
xor r9d, r9d
lea r8, [0x140002718]
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x1400016b0
mov edx, eax
jmp 0x140001679
mov edx, r15d
mov eax, r15d
mov ecx, eax
mov word [r14 + rcx*2], r8w
mov word [r14 + rcx*2 + 2], r15w
mov ecx, 2
lea eax, [rcx + rdx]
mov r9d, r12d
mov rcx, qword [rbp - 0x28]
lea rdx, [0x140002728]
add eax, eax
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add edi, r12d
add rbx, 8
cmp edi, 0x39
jb 0x140001503
call qword [sym.imp.ole32.dll_CoUninitialize]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]