Function at 0x1400047f0
Capabilities:
Accept command line arguments
Check mutex and terminate process on windows
Check mutex on windows
Create process on windows
Delete registry value
Get common file path
Persist via run registry key
Terminate process

Disassembly:
sub rsp, 0x378
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x60], rax
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0x58], rax
lea rdx, str.14349439_603B_44E2_A3B9_65D016FB28F7
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x14000491f
call fcn.14000f710
mov qword [rsp + 0x68], rax
cmp qword [rsp + 0x68], 0
je 0x14000485f
xor edx, edx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x70], 0
call qword [sym.imp.SHELL32.dll_IsUserAnAdmin]
cmp eax, 1
jne 0x140004894
lea r9, str.2CDA2422_1D98_48C8_A26C_E18C098A4493
mov r8d, 1
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x70], rax
jmp 0x1400048b0
lea r9, str.2CDA2422_1D98_48C8_A26C_E18C098A4493
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x70], rax
xor eax, eax
cmp eax, 1
je 0x1400048fd
mov qword [rsp + 0x78], 0
lea r8, str.658F1ACE_C9DA_4A8A_9854_90895CAE7A31
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov qword [rsp + 0x78], rax
cmp qword [rsp + 0x78], 0
je 0x1400048f9
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400048b0
jmp 0x1400048fd
cmp qword [rsp + 0x70], 0
je 0x140004910
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x1400056d1
lea rdx, str.2CA5BCE0_7982_487F_B842_952AE9F5B6F4
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140004a4e
lea r8, str.485329E0_22FB_4839_9712_4E875F218115
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov qword [rsp + 0x88], rax
cmp qword [rsp + 0x88], 0
je 0x14000498c
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x90], eax
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8, str.EBA9BA7B_9274_4748_8338_2B6CD525EEE2
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov qword [rsp + 0x80], rax
cmp qword [rsp + 0x80], 0
je 0x1400049db
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x94], eax
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp eax, 1
je 0x140004a34
mov qword [rsp + 0x98], 0
lea r8, str.658F1ACE_C9DA_4A8A_9854_90895CAE7A31
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov qword [rsp + 0x98], rax
cmp qword [rsp + 0x98], 0
je 0x140004a30
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400049db
jmp 0x140004a34
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 1
jmp 0x1400056d1
lea rdx, str.DC94068C_7F30_416D_9FAA_8141EBDA51D2
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140004b7d
lea r8, str.485329E0_22FB_4839_9712_4E875F218115
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov qword [rsp + 0xa8], rax
cmp qword [rsp + 0xa8], 0
je 0x140004abb
mov edx, 0xffffffff
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0xb0], eax
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8, str.EBA9BA7B_9274_4748_8338_2B6CD525EEE2
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov qword [rsp + 0xa0], rax
cmp qword [rsp + 0xa0], 0
je 0x140004b0a
mov edx, 0xffffffff
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0xb4], eax
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp eax, 1
je 0x140004b63
mov qword [rsp + 0xb8], 0
lea r8, str.658F1ACE_C9DA_4A8A_9854_90895CAE7A31
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov qword [rsp + 0xb8], rax
cmp qword [rsp + 0xb8], 0
je 0x140004b5f
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140004b0a
jmp 0x140004b63
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 1
jmp 0x1400056d1
lea rdx, str.445E617B_0185_47D9_971F_D367CFB6F2B9
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140004c0a
xor eax, eax
cmp eax, 1
je 0x140004bf0
mov qword [rsp + 0xc0], 0
lea r8, str.658F1ACE_C9DA_4A8A_9854_90895CAE7A31
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov qword [rsp + 0xc0], rax
cmp qword [rsp + 0xc0], 0
je 0x140004bec
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140004b97
jmp 0x140004bf0
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 1
jmp 0x1400056d1
lea rdx, str.7BD747CB_15FB_4183_9293_9729C875D4EF
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140004fde
mov qword [rsp + 0xd8], 0
lea rdx, [rsp + 0xc8]
lea rcx, [0x14003a1d0]
call fcn.140005d80
mov qword [rsp + 0xd0], rax
cmp qword [rsp + 0xd0], 0
je 0x140004fb8
lea rdx, [rsp + 0xe8]
lea rcx, [0x14003a1d0]
call fcn.140005fe0
mov qword [rsp + 0xe0], rax
cmp qword [rsp + 0xe0], 0
je 0x140004faa
mov edx, 0xfffe
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0xd8], rax
cmp qword [rsp + 0xd8], 0
je 0x140004faa
mov rdx, qword [rsp + 0xd8]
mov ecx, 0x7fff
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jbe 0x140004faa
lea r8, str.C21E1511_3B94_4311_A6D0_5D77E468DFC4
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0xf0], rax
cmp qword [rsp + 0xf0], 0
je 0x140004f9c
xor edx, edx
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0xf8], eax
cmp dword [rsp + 0xf8], 0
je 0x140004d29
cmp dword [rsp + 0xf8], 0x80
jne 0x140004f80
lea r8, str.658F1ACE_C9DA_4A8A_9854_90895CAE7A31
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov qword [rsp + 0x190], rax
cmp qword [rsp + 0x190], 0
je 0x140004d6b
mov rcx, qword [rsp + 0x190]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140004d29
cmp dword [0x14003c040], 1
jne 0x140004db7
lea r8, [rsp + 0x1d0]
lea rdx, [0x140025e50]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x140004db7
lea rdx, [0x14003c114]
mov rcx, qword [rsp + 0x1d0]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x1d0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x14003c03c], 1
jne 0x140004e03
lea r8, [rsp + 0x1d8]
lea rdx, [0x140025eb0]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x140004e03
lea rdx, [0x14003c162]
mov rcx, qword [rsp + 0x1d8]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x1d8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r8d, gethostname
xor edx, edx
lea rcx, [rsp + 0x198]
call fcn.140019ba0
mov dword [rsp + 0x1a0], 3
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x1a8], rax
mov eax, 0x614
mov word [rsp + 0x1b8], ax
mov dword [rsp + 0x118], 0
lea rcx, [rsp + 0x198]
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
je 0x140004e86
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rsp + 0x118]
inc eax
mov dword [rsp + 0x118], eax
cmp dword [rsp + 0x118], 0xa
jle 0x140004e84
jmp 0x140004e86
jmp 0x140004e4b
mov r8d, gethostname
xor edx, edx
lea rcx, [rsp + 0x198]
call fcn.140019ba0
mov dword [rsp + 0x1a0], 3
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x1a8], rax
mov eax, 0x614
mov word [rsp + 0x1b8], ax
mov dword [rsp + 0x118], 0
lea rcx, [rsp + 0x198]
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
je 0x140004f09
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rsp + 0x118]
inc eax
mov dword [rsp + 0x118], eax
cmp dword [rsp + 0x118], 0xa
jle 0x140004f07
jmp 0x140004f09
jmp 0x140004ece
mov r8d, 0x68
xor edx, edx
lea rcx, [rsp + 0x120]
call fcn.140019ba0
mov dword [rsp + 0x120], WSAGetLastError
lea rax, [rsp + 0x100]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x120]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 0x10]
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp qword [rsp + 0xd8], 0
je 0x140004fd1
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rdx, str.A32DF908_9C08_485C_89FE_64C54E6BB46A
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140005454
mov qword [rsp + 0x1f0], 0
mov qword [rsp + 0x1f8], 0
lea rdx, [rsp + 0x1e0]
lea rcx, [0x14003a1d0]
call fcn.140005d80
mov qword [rsp + 0x1e8], rax
cmp qword [rsp + 0x1e8], 0
je 0x140005415
lea rdx, [rsp + 0x208]
lea rcx, [0x14003a1d0]
call fcn.140005fe0
mov qword [rsp + 0x200], rax
cmp qword [rsp + 0x200], 0
je 0x140005407
mov edx, 0xfffe
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x1f8], rax
cmp qword [rsp + 0x1f8], 0
je 0x140005407
mov rdx, qword [rsp + 0x1f8]
mov ecx, 0x7fff
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jbe 0x140005407
mov edx, 0xfffe
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x1f0], rax
cmp qword [rsp + 0x1f0], 0
je 0x1400053f9
mov r8d, reloc.WS2_32.dll_recv
xor edx, edx
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 0x18]
call fcn.14001a714
mov dword [rsp + 0x20c], eax
mov eax, dword [rsp + 0x20c]
mov dword [rsp + 0x28], eax
lea rax, str.C8650542_6270_4713_87CA_0BC92237B96D
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x58]
mov r9, qword [rax + 0x10]
lea r8, str.__s___s__x
mov edx, 0x7fff
mov rcx, qword [rsp + 0x1f0]
call qword [sym.imp.SHLWAPI.dll_wnsprintfW]
lea r8, str.C21E1511_3B94_4311_A6D0_5D77E468DFC4
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsp + 0x210], rax
cmp qword [rsp + 0x210], 0
je 0x1400053f9
xor edx, edx
mov rcx, qword [rsp + 0x210]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x218], eax
cmp dword [rsp + 0x218], 0
je 0x140005187
cmp dword [rsp + 0x218], 0x80
jne 0x1400053dd
lea r8, str.658F1ACE_C9DA_4A8A_9854_90895CAE7A31
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov qword [rsp + 0x2b0], rax
cmp qword [rsp + 0x2b0], 0
je 0x1400051c9
mov rcx, qword [rsp + 0x2b0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140005187
cmp dword [0x14003c040], 1
jne 0x140005215
lea r8, [rsp + 0x2f0]
lea rdx, [0x140025f10]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x140005215
lea rdx, [0x14003c114]
mov rcx, qword [rsp + 0x2f0]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x2f0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x14003c03c], 1
jne 0x140005261
lea r8, [rsp + 0x2f8]
lea rdx, [0x140025f70]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x140005261
lea rdx, [0x14003c162]
mov rcx, qword [rsp + 0x2f8]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x2f8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r8d, gethostname
xor edx, edx
lea rcx, [rsp + 0x2b8]
call fcn.140019ba0
mov dword [rsp + 0x2c0], 3
mov rax, qword [rsp + 0x1e8]
mov qword [rsp + 0x2c8], rax
mov eax, 0x614
mov word [rsp + 0x2d8], ax
mov dword [rsp + 0x238], 0
lea rcx, [rsp + 0x2b8]
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
je 0x1400052e4
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rsp + 0x238]
inc eax
mov dword [rsp + 0x238], eax
cmp dword [rsp + 0x238], 5
jle 0x1400052e2
jmp 0x1400052e4
jmp 0x1400052a9
mov r8d, gethostname
xor edx, edx
lea rcx, [rsp + 0x2b8]
call fcn.140019ba0
mov dword [rsp + 0x2c0], 3
mov rax, qword [rsp + 0x200]
mov qword [rsp + 0x2c8], rax
mov eax, 0x614
mov word [rsp + 0x2d8], ax
mov dword [rsp + 0x238], 0
lea rcx, [rsp + 0x2b8]
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
je 0x140005367
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rsp + 0x238]
inc eax
mov dword [rsp + 0x238], eax
cmp dword [rsp + 0x238], 5
jle 0x140005365
jmp 0x140005367
jmp 0x14000532c
mov r8d, 0x68
xor edx, edx
lea rcx, [rsp + 0x240]
call fcn.140019ba0
mov dword [rsp + 0x240], WSAGetLastError
lea rax, [rsp + 0x220]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x240]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x1f8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x1f0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov rcx, qword [rsp + 0x210]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, qword [rsp + 0x210]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x200]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x1e8]
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp qword [rsp + 0x1f0], 0
je 0x14000542e
mov rcx, qword [rsp + 0x1f0]
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp qword [rsp + 0x1f8], 0
je 0x140005447
mov rcx, qword [rsp + 0x1f8]
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rdx, str.97E07F76_FAE8_454F_B568_05B66020C0A0
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1400056cc
lea rdx, [rsp + 0x300]
lea rcx, [0x14003a1d0]
call fcn.140005d80
mov qword [rsp + 0x308], rax
cmp qword [rsp + 0x308], 0
je 0x1400056c4
lea rdx, [rsp + 0x318]
lea rcx, [0x14003a1d0]
call fcn.140005fe0
mov qword [rsp + 0x310], rax
cmp qword [rsp + 0x310], 0
je 0x1400056b6
lea r8, str.658F1ACE_C9DA_4A8A_9854_90895CAE7A31
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov qword [rsp + 0x320], rax
cmp qword [rsp + 0x320], 0
je 0x14000550a
mov rcx, qword [rsp + 0x320]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400054c8
cmp dword [0x14003c040], 1
jne 0x140005556
lea r8, [rsp + 0x360]
lea rdx, [0x140025fd0]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x140005556
lea rdx, [0x14003c114]
mov rcx, qword [rsp + 0x360]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x360]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x14003c03c], 1
jne 0x1400055a2
lea r8, [rsp + 0x368]
lea rdx, [0x140026030]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x1400055a2
lea rdx, [0x14003c162]
mov rcx, qword [rsp + 0x368]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x368]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r8d, gethostname
xor edx, edx
lea rcx, [rsp + 0x328]
call fcn.140019ba0
mov dword [rsp + 0x330], 3
mov rax, qword [rsp + 0x308]
mov qword [rsp + 0x338], rax
mov eax, 0x614
mov word [rsp + 0x348], ax
mov dword [rsp + 0x31c], 0
lea rcx, [rsp + 0x328]
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
je 0x140005625
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rsp + 0x31c]
inc eax
mov dword [rsp + 0x31c], eax
cmp dword [rsp + 0x31c], 5
jle 0x140005623
jmp 0x140005625
jmp 0x1400055ea
mov r8d, gethostname
xor edx, edx
lea rcx, [rsp + 0x328]
call fcn.140019ba0
mov dword [rsp + 0x330], 3
mov rax, qword [rsp + 0x310]
mov qword [rsp + 0x338], rax
mov eax, 0x614
mov word [rsp + 0x348], ax
mov dword [rsp + 0x31c], 0
lea rcx, [rsp + 0x328]
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
je 0x1400056a8
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rsp + 0x31c]
inc eax
mov dword [rsp + 0x31c], eax
cmp dword [rsp + 0x31c], 5
jle 0x1400056a6
jmp 0x1400056a8
jmp 0x14000566d
mov rcx, qword [rsp + 0x310]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x308]
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, 1
add rsp, 0x378
ret