Function at 0x14001d390
Capabilities:
Create process on windows
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x17]
sub rsp, 0xf0
mov rax, qword [0x1401198e8]
xor rax, rsp
mov qword [rbp + 7], rax
mov byte [rbp - 0x79], r9b
mov r14, r8
mov qword [rbp - 0x71], rdx
xor ebx, ebx
mov dword [rbp - 0x75], ebx
mov dword [rbp - 0x39], ebx
xorps xmm0, xmm0
movups xmmword [rbp - 0x21], xmm0
mov qword [rbp - 0x21], rbx
mov dword [rbp - 0x19], ebx
mov qword [rbp - 0x11], rbx
call fcn.140008180
test rax, rax
je 0x14001dc6a
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rbp - 0x31], rax
mov rdx, r14
lea rcx, [rbp - 0x31]
call fcn.1400062d0
lea r13, [rbx - 1]
test al, al
jne 0x14001d43b
test r14, r14
jne 0x14001d41b
mov eax, ebx
jmp 0x14001d42b
mov rax, r13
nop
inc rax
cmp word [r14 + rax*2], 0
jne 0x14001d420
mov r8d, eax
mov rdx, r14
lea rcx, [rbp - 0x31]
call fcn.1400068f0
nop
mov qword [rbp - 0x61], rbx
mov rdi, qword [rbp - 0x31]
lea rax, [rdi - 0x18]
mov qword [rbp - 0x69], rax
mov rcx, qword [rdi - 0x18]
test rcx, rcx
je 0x14001d462
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x14001d473
call fcn.140008180
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x14001dc75
mov rax, qword [rcx]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x61], rbx
mov dword [rbp - 0x75], 1
movsxd r12, dword [rdi - 0x10]
lea rdx, str.SoftwareSysinternals_
mov rsi, r13
nop
inc rsi
cmp word [rdx + rsi*2], 0
jne 0x14001d4a0
lea r15d, [r12 + rsi]
test r15d, r15d
js 0x14001dc5f
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, r15d
or eax, ecx
jge 0x14001d4e0
mov edx, r15d
lea rcx, [rbp - 0x61]
call fcn.140006870
mov rbx, qword [rbp - 0x61]
lea rdx, str.SoftwareSysinternals_
movsxd rax, esi
lea rsi, [rax + rax]
test rsi, rsi
je 0x14001d50e
test rbx, rbx
jne 0x14001d503
call fcn.1400a31cc
mov dword [rax], 0x16
call fcn.1400a3060
jmp 0x14001d50e
mov r8, rsi
mov rcx, rbx
call fcn.14009d3c0
mov r8, r12
add r8, r8
lea rcx, [rsi + rbx]
je 0x14001d54a
test rcx, rcx
je 0x14001d53a
test rdi, rdi
je 0x14001d52e
mov rdx, rdi
call fcn.14009d3c0
jmp 0x14001d54a
xor edx, edx
call fcn.14009e880
test rdi, rdi
jne 0x14001d54a
call fcn.1400a31cc
mov dword [rax], 0x16
call fcn.1400a3060
cmp r15d, dword [rbx - 0xc]
jg 0x14001dc5f
mov dword [rbx - 0x10], r15d
movsxd rax, r15d
xor ecx, ecx
mov word [rbx + rax*2], cx
mov qword [rbp - 0x59], rcx
mov rcx, qword [rbx - 0x18]
test rcx, rcx
je 0x14001d57c
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x14001d58d
call fcn.140008180
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x14001dc80
mov rax, qword [rcx]
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rbp - 0x59], rdi
mov dword [rbp - 0x75], 3
lea rax, str.VirusTotal
mov rsi, r13
inc rsi
cmp word [rax + rsi*2], 0
jne 0x14001d5b5
movsxd r15, dword [rbx - 0x10]
lea r13d, [rsi + r15]
test r13d, r13d
js 0x14001dcb7
mov ecx, 1
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, r13d
or eax, ecx
jge 0x14001d5f2
mov edx, r13d
lea rcx, [rbp - 0x59]
call fcn.140006870
mov rdi, qword [rbp - 0x59]
add r15, r15
je 0x14001d62d
test rdi, rdi
je 0x14001d61d
mov r8, r15
mov rcx, rdi
test rbx, rbx
je 0x14001d611
mov rdx, rbx
call fcn.14009d3c0
jmp 0x14001d62d
xor edx, edx
call fcn.14009e880
test rbx, rbx
jne 0x14001d62d
call fcn.1400a31cc
mov dword [rax], 0x16
call fcn.1400a3060
movsxd r8, esi
add r8, r8
lea rcx, [r15 + rdi]
je 0x14001d65c
test rcx, rcx
jne 0x14001d650
call fcn.1400a31cc
mov dword [rax], 0x16
call fcn.1400a3060
jmp 0x14001d65c
lea rdx, str.VirusTotal
call fcn.14009d3c0
cmp r13d, dword [rdi - 0xc]
jg 0x14001dcb7
mov dword [rdi - 0x10], r13d
movsxd rax, r13d
xor esi, esi
mov word [rdi + rax*2], si
lea r9d, [rsi + 1]
mov r8, rdi
mov rdx, 0xffffffff80000001
lea rcx, [rbp - 0x21]
call fcn.140013900
nop
mov r13, 0xffffffffffffffff
mov eax, r13d
lock xadd dword [rdi - 8], eax
sub eax, 1
jg 0x14001d6ad
mov rcx, qword [rdi - 0x18]
mov rax, qword [rcx]
lea rdx, [rdi - 0x18]
call qword [rax + VariantCopy]
mov dword [rbp - 0x75], esi
mov eax, r13d
lock xadd dword [rbx - 8], eax
sub eax, 1
jg 0x14001d6cc
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
lea rdx, [rbx - 0x18]
call qword [rax + VariantCopy]
nop
mov eax, r13d
mov rdx, qword [rbp - 0x69]
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001d6e6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov r15, qword [rbp - 0x21]
test r15, r15
je 0x14001d732
mov dword [rbp - 0x29], 4
lea rax, [rbp - 0x29]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x39]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 9]
xor r8d, r8d
lea rdx, str.VirusTotalTermsAccepted
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r15, rsi
mov qword [rbp - 0x21], rsi
mov dword [rbp - 0x19], esi
cmp dword [rbp - 0x39], 0
jne 0x14001dc21
cmp byte [rbp + 0x77], 0
je 0x14001d74e
mov dword [rbp - 0x39], 1
jmp 0x14001d7e9
mov dword [rsp + 0x28], 0xa
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea r8, str.https:__www.virustotal.com_about_terms_of_service
lea rdx, str.open
mov rbx, qword [rbp - 0x71]
mov rcx, rbx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp byte [rbp - 0x79], 0
je 0x14001d821
lea rdx, str.You_must_agree_to_the_VirusTotal_Terms_of_Service_and_Privacy_Policy_before_ncontinuing._A_browser_window_will_open_to:_n_n_____https:__www.virustotal.com_about_terms_of_service
lea rcx, str._s_n_n
call fcn.1400231f0
lea rcx, str.Enter_y_to_agree:
call fcn.1400231f0
mov ecx, 1
call fcn.1400b3ff0
mov rcx, rax
call fcn.1400b47c8
mov edx, 5
lea rcx, [rbp - 5]
call fcn.1400b49a8
movzx eax, byte [rbp - 5]
sub al, 0x59
test al, 0xdf
je 0x14001d843
lea rdx, str.You_must_agree_to_VirusTotals_terms_of_service_to_use_VirusTotal_features.
lea rcx, str._ws_n
call fcn.1400231f0
cmp dword [rbp - 0x39], 0
je 0x14001dc5b
call fcn.140008180
test rax, rax
je 0x14001dc6a
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rbp - 0x51], rax
mov rdx, r14
lea rcx, [rbp - 0x51]
call fcn.1400062d0
test al, al
jne 0x14001d86b
test r14, r14
jne 0x14001d84c
mov eax, esi
jmp 0x14001d85b
mov r9d, 0x24
lea r8, str.VirusTotal_Terms_of_Service
lea rdx, str.You_must_agree_to_VirusTotals_terms_of_service_to_use_VirusTotal_features.
mov rcx, rbx
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x14001d7df
mov dword [rbp - 0x39], 1
jmp 0x14001d7e9
mov rax, r13
nop
inc rax
cmp word [r14 + rax*2], 0
jne 0x14001d850
mov r8d, eax
mov rdx, r14
lea rcx, [rbp - 0x51]
call fcn.1400068f0
nop
mov qword [rbp - 0x71], rsi
mov rbx, qword [rbp - 0x51]
lea rax, [rbx - 0x18]
mov qword [rbp - 0x49], rax
mov rcx, qword [rbx - 0x18]
test rcx, rcx
je 0x14001d892
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x14001d8a3
call fcn.140008180
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x14001dc8b
mov rax, qword [rcx]
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rbp - 0x71], rdi
mov dword [rbp - 0x75], 4
movsxd r12, dword [rbx - 0x10]
mov rsi, r13
lea rdx, str.SoftwareSysinternals_
nop
inc rsi
cmp word [rdx + rsi*2], 0
jne 0x14001d8d0
lea r14d, [r12 + rsi]
test r14d, r14d
js 0x14001dcac
mov ecx, 1
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, r14d
or eax, ecx
jge 0x14001d910
mov edx, r14d
lea rcx, [rbp - 0x71]
call fcn.140006870
mov rdi, qword [rbp - 0x71]
lea rdx, str.SoftwareSysinternals_
movsxd rax, esi
lea rsi, [rax + rax]
test rsi, rsi
je 0x14001d93e
test rdi, rdi
jne 0x14001d933
call fcn.1400a31cc
mov dword [rax], 0x16
call fcn.1400a3060
jmp 0x14001d93e
mov r8, rsi
mov rcx, rdi
call fcn.14009d3c0
mov r8, r12
add r8, r8
lea rcx, [rsi + rdi]
je 0x14001d97a
test rcx, rcx
je 0x14001d96a
test rbx, rbx
je 0x14001d95e
mov rdx, rbx
call fcn.14009d3c0
jmp 0x14001d97a
xor edx, edx
call fcn.14009e880
test rbx, rbx
jne 0x14001d97a
call fcn.1400a31cc
mov dword [rax], 0x16
call fcn.1400a3060
lea r12, [rdi - 0x18]
cmp r14d, dword [r12 + 0xc]
jg 0x14001dcac
mov dword [r12 + 8], r14d
movsxd rax, r14d
xor ecx, ecx
mov word [rdi + rax*2], cx
mov qword [rbp - 0x69], rcx
mov rcx, qword [r12]
test rcx, rcx
je 0x14001d9b2
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x14001d9c3
call fcn.140008180
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x14001dc96
mov rax, qword [rcx]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x69], rbx
mov dword [rbp - 0x75], 0xc
mov rsi, r13
lea rax, str.VirusTotal
nop dword [rax + rax]
inc rsi
cmp word [rax + rsi*2], 0
jne 0x14001d9f0
movsxd r13, dword [rdi - 0x10]
lea r14d, [rsi + r13]
test r14d, r14d
js 0x14001dca1
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, r14d
or eax, ecx
jge 0x14001da2d
mov edx, r14d
lea rcx, [rbp - 0x69]
call fcn.140006870
mov rbx, qword [rbp - 0x69]
add r13, r13
je 0x14001da68
test rbx, rbx
je 0x14001da58
mov r8, r13
mov rcx, rbx
test rdi, rdi
je 0x14001da4c
mov rdx, rdi
call fcn.14009d3c0
jmp 0x14001da68
xor edx, edx
call fcn.14009e880
test rdi, rdi
jne 0x14001da68
call fcn.1400a31cc
mov dword [rax], 0x16
call fcn.1400a3060
movsxd r8, esi
add r8, r8
lea rcx, [rbx + r13]
je 0x14001da97
test rcx, rcx
jne 0x14001da8b
call fcn.1400a31cc
mov dword [rax], 0x16
call fcn.1400a3060
jmp 0x14001da97
lea rdx, str.VirusTotal
call fcn.14009d3c0
lea rdi, [rbx - 0x18]
cmp r14d, dword [rdi + 0xc]
jg 0x14001dca1
mov dword [rdi + 8], r14d
movsxd rax, r14d
xor r14d, r14d
mov word [rbx + rax*2], r14w
mov qword [rbp - 0x41], r14
mov rsi, qword [rbp - 0x11]
test rsi, rsi
je 0x14001db40
cmp qword [rsi], r14
je 0x14001db3a
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001db94
lea rdx, str.RegCreateKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14001db94
mov qword [rsp + 0x50], r14
mov rdx, qword [rsi]
mov qword [rsp + 0x48], rdx
lea rdx, [rbp - 0x35]
mov qword [rsp + 0x40], rdx
lea rdx, [rbp - 0x41]
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, 0xffffffff80000001
call rax
jmp 0x14001db7a
cmp dword [rsi + 8], 0
je 0x14001db94
lea rax, [rbp - 0x35]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x41]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14001db94
test r15, r15
je 0x14001db8c
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, qword [rbp - 0x41]
mov qword [rbp - 0x21], rax
mov rbx, 0xffffffffffffffff
mov eax, ebx
lock xadd dword [rdi + 0x10], eax
sub eax, 1
jg 0x14001dbb4
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + VariantCopy]
nop
mov eax, ebx
lock xadd dword [r12 + 0x10], eax
sub eax, 1
jg 0x14001dbd0
mov rcx, qword [r12]
mov rax, qword [rcx]
mov rdx, r12
call qword [rax + VariantCopy]
nop
mov rdx, qword [rbp - 0x49]
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x14001dbe7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov r15, qword [rbp - 0x21]
test r15, r15
je 0x14001dc5b
mov dword [rbp - 0x31], 1
mov dword [rsp + 0x28], 4
lea rax, [rbp - 0x31]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.VirusTotalTermsAccepted
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov bl, 1
test r15, r15
je 0x14001dc31
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, bl
mov rcx, qword [rbp + 7]
xor rcx, rsp
call fcn.14009c570
mov rbx, qword [rsp + 0x130]
add rsp, 0xf0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
xor bl, bl
jmp 0x14001dc23
mov ecx, 0x80070057
call fcn.140007f00
nop
mov ecx, 0x80004005
call fcn.140007f00
nop
mov ecx, 0x80004005
call fcn.140007f00
nop
mov ecx, 0x80004005
call fcn.140007f00
nop
mov ecx, 0x80004005
call fcn.140007f00
nop
mov ecx, 0x80004005
call fcn.140007f00
nop
mov ecx, 0x80070057
call fcn.140007f00
nop
mov ecx, 0x80070057
call fcn.140007f00
nop
mov ecx, 0x80070057
call fcn.140007f00
int3