Function at 0x1068950
Capabilities:
Create process on windows
Delete registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x580
mov rax, qword [0x0109d1a0]
xor rax, rsp
mov qword [rsp + 0x570], rax
mov rbp, rcx
mov qword [0x010aaa98], rcx
xor r15d, r15d
lea rcx, [0x01067488]
xor edx, edx
mov dword [rsp + 0x50], r15d
mov r14d, r15d
call qword [sym.imp.USER32.dll_FindWindowW]
mov esi, r15d
mov r13, rax
lea eax, [r15 + 1]
cmp r13, r15
cmovne esi, eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
cmp eax, r15d
mov r12d, eax
jne 0x1068a2f
lea ebx, [r15 + 0x64]
lea r8, [0x01067460]
lea rcx, [0x010aadd0]
mov rdx, rbx
call fcn.0107dbf8
lea r8, [0x01067488]
lea rcx, [0x010aad00]
mov rdx, rbx
call fcn.0107dbf8
lea rcx, [rsp + 0x50]
call fcn.0106a364
cmp eax, r15d
mov r12d, eax
jne 0x1068a2f
lea rcx, [rsp + 0x50]
call fcn.0106a6bc
cmp eax, r15d
mov r12d, eax
jne 0x1068a2f
call fcn.0106a1d8
cmp eax, 4
jge 0x1068b94
mov r12d, 0x800700d8
mov esi, 1
cmp dword [0x010aafd8], r15d
je 0x1068a5c
mov rcx, qword [0x010aaf50]
cmp rcx, r15
je 0x1068a4f
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x010aaaa0]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
cmp dword [0x010aaf60], r15d
je 0x1068a9a
mov rcx, qword [0x010aaf48]
cmp rcx, r15
je 0x1068a77
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x010aaff8]
cmp rcx, r15
je 0x1068a88
call fcn.0107e444
mov rcx, qword [0x010aaea8]
cmp rcx, r15
je 0x1068a9a
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rcx, [0x01067488]
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowW]
cmp rax, r15
je 0x1068ab6
mov rcx, rax
call fcn.0106b63c
mov rbx, qword [0x010aaf08]
cmp rbx, r15
je 0x1068ae3
mov rcx, qword [rbx + 8]
cmp rcx, r15
je 0x1068ad4
call fcn.0107d4f0
mov qword [rbx + 8], r15
mov rcx, rbx
call fcn.0107d4f0
mov qword [0x010aaf08], r15
mov rcx, qword [0x010aaf10]
cmp rcx, r15
je 0x1068afd
mov edx, esi
call fcn.010695c4
mov qword [0x010aaf10], r15
mov rcx, qword [0x010aaf20]
cmp rcx, r15
je 0x1068b18
mov rax, qword [rcx]
mov edx, esi
call qword [rax + 0x30]
mov qword [0x010aaf20], r15
mov rbx, qword [0x010aaf18]
cmp rbx, r15
je 0x1068b3b
mov rcx, rbx
call fcn.01072e94
mov rcx, rbx
call fcn.0107d4f0
mov qword [0x010aaf18], r15
mov rcx, qword [0x010aaf28]
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rcx, qword [0x010aaee8]
cmp rcx, r15
je 0x1068b60
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, r12d
mov rcx, qword [rsp + 0x570]
xor rcx, rsp
call fcn.0107dbd0
lea r11, [rsp + 0x580]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
cmp dword [0x010aafbc], r15d
je 0x1068ba7
call fcn.0107879c
jmp 0x1068a2f
mov edi, dword [rsp + 0x50]
mov ebx, esi
bt edi, 0x1d
jae 0x1068bbc
mov esi, 1
mov ebx, esi
jmp 0x1068c2b
bt edi, 0x1c
jae 0x1068dda
cmp esi, r15d
mov ebx, 1
je 0x1068c29
lea rdx, [0x010aadd0]
lea rcx, [0x010aad00]
call qword [sym.imp.USER32.dll_FindWindowW]
cmp rax, r15
je 0x1068c29
lea edx, [rbx + 0xf]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov esi, r15d
lea rdx, [0x010aadd0]
lea rcx, [0x010aad00]
call qword [sym.imp.USER32.dll_FindWindowW]
cmp rax, r15
je 0x1068c29
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
add esi, ebx
cmp esi, 0x64
jl 0x1068bfe
mov esi, ebx
test dil, 2
je 0x1068c52
lea rdx, [0x01068170]
mov rcx, 0xffffffff80000001
mov ebx, esi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp eax, r15d
je 0x1068c52
call qword [sym.imp.KERNEL32.dll_GetLastError]
test dil, 0x10
je 0x1068c64
mov ecx, pe_nt_image_headers64
mov ebx, esi
call fcn.01079578
test dil, 0x20
je 0x1068c76
mov ecx, 0x30
mov ebx, esi
call fcn.01079578
test dil, 0x40
je 0x1068c88
mov ecx, 0xc0
mov ebx, esi
call fcn.01079578
mov eax, dword [0x010aaef4]
test dil, 0x80
cmovne ebx, esi
bt edi, 8
cmovb ebx, esi
bt edi, 0xb
cmovb eax, esi
bt edi, 0xc
mov dword [0x010aaef4], eax
mov eax, dword [0x010aaef8]
cmovb eax, esi
bt edi, 0xd
mov dword [0x010aaef8], eax
mov eax, dword [0x010aaefc]
cmovb eax, esi
cmp ebx, r15d
mov dword [0x010aaefc], eax
jne 0x1068a34
lea rax, [0x01069ad8]
mov edx, 0x6b
mov rcx, rbp
mov dword [rsp + 0xa0], 0x50
mov dword [rsp + 0xa4], 3
mov dword [rsp + 0xb0], r15d
mov qword [rsp + 0xa8], rax
mov dword [rsp + 0xb4], r15d
mov qword [rsp + 0xb8], rbp
call qword [sym.imp.USER32.dll_LoadIconW]
mov edx, 0x7f00
xor ecx, ecx
mov qword [rsp + 0xc0], rax
call qword [sym.imp.USER32.dll_LoadCursorW]
mov rcx, qword [rsp + 0xb8]
mov qword [rsp + 0xc8], rax
lea rax, [0x010aad00]
mov edx, 0x6c
mov qword [rsp + 0xd0], 6
mov qword [rsp + 0xd8], r15
mov qword [rsp + 0xe0], rax
call qword [sym.imp.USER32.dll_LoadIconW]
lea rcx, [rsp + 0xa0]
mov qword [rsp + 0xe8], rax
call qword [sym.imp.USER32.dll_RegisterClassExW]
mov edx, edi
mov rcx, rbp
call fcn.010696c0
cmp eax, r15d
je 0x1068a34
cmp dword [0x010aafd0], r15d
je 0x1068de4
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0xbb80
mov r8d, 0x18
mov ecx, esi
call fcn.01074e88
xor ecx, ecx
mov edx, 0xac44
lea r8d, [rcx + 0x18]
call fcn.01074e88
jmp 0x1068a34
mov esi, 1
jmp 0x1068c2b
mov rcx, qword [0x010aaf10]
call fcn.01077d28
call fcn.010749a8
cmp al, r15b
jne 0x1068e06
mov rcx, qword [0x010aaf10]
call fcn.01078078
cmp dword [0x010aaf7c], r15d
je 0x1069082
lea rbx, [0x010668e8]
mov rdi, 0xffffffff80000001
lea r8, [rsp + 0x68]
mov rdx, rbx
mov rcx, rdi
mov qword [rsp + 0x68], r15
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov rcx, qword [rsp + 0x68]
cmp rcx, r15
jne 0x1068f04
cmp dword [0x010aaf34], 6
mov qword [rsp + 0x58], r15
jne 0x1068e60
cmp dword [0x010aaf38], 3
mov dword [rsp + 0x50], esi
je 0x1068e65
mov dword [rsp + 0x50], r15d
lea r8, [0x01066864]
lea rcx, [rsp + 0x170]
mov r9, rbx
mov edx, 0x200
call fcn.0107e8fc
mov qword [rsp + 0x40], r15
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
lea rdx, [rsp + 0x170]
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], r15d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, r15d
jne 0x1068f0a
lea r8, [rsp + 0x58]
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov rcx, qword [rsp + 0x58]
cmp rcx, r15
je 0x1068f04
mov edx, 4
lea rax, [rsp + 0x50]
xor r8d, r8d
mov dword [rsp + 0x28], edx
mov r9d, edx
lea rdx, [0x01068030]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.0107879c
lea r8, [rsp + 0x58]
mov rdx, rbx
mov rcx, rdi
mov qword [rsp + 0x58], r15
mov dword [rsp + 0x50], r15d
mov dword [rsp + 0x60], 4
mov dword [rsp + 0x64], 4
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov rcx, qword [rsp + 0x58]
cmp rcx, r15
je 0x1069082
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x64]
lea rdx, [0x01068048]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r15d
jne 0x1068f7b
mov ebx, r15d
jmp 0x1068fae
mov eax, dword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
lea rdx, [0x01068048]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x50]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x50], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, esi
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, r15d
je 0x1069082
mov ebx, 0x68
lea rcx, [rsp + 0xa0]
xor edx, edx
mov r8, rbx
call fcn.0107f150
lea rax, [rsp + 0x78]
lea rcx, [0x01068070]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xa0]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [0x010680f0]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
xor edx, edx
mov dword [rsp + 0x28], 0x8000020
mov dword [rsp + 0xa0], ebx
mov dword [rsp + 0xdc], 0x80
mov dword [rsp + 0x20], r15d
mov word [rsp + 0xe0], r15w
mov dword [rsp + 0x64], 0xff
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, r15d
je 0x1069082
mov rcx, qword [rsp + 0x78]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x78]
lea rdx, [rsp + 0x64]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.0106b32c
cmp eax, r15d
je 0x106911f
cmp dword [0x010aaf7c], r15d
je 0x1068a34
mov rcx, qword [0x010aaf10]
call fcn.01078efc
cmp dword [0x010aaf34], 6
jne 0x10690c7
mov eax, dword [0x010aaf38]
cmp eax, 3
je 0x10690c2
cmp eax, 4
jne 0x10690c7
call fcn.01074448
mov ecx, 0x7530
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword [0x0109d100]
lea rcx, [0x0109d100]
call qword [rax + 0x18]
lea rdx, [0x01066918]
lea rcx, [rsp + 0x58]
add rax, 0x18
test rdx, 0xffffffffffff0000
mov qword [rsp + 0x58], rax
jne 0x106910b
movzx edx, dx
call fcn.0106ba80
jmp 0x1069110
call fcn.0106b974
lea rcx, [rsp + 0x58]
call fcn.0106b71c
jmp 0x1068a34
cmp dword [0x010aafa0], r15d
je 0x1069135
cmp dword [0x010aafb4], r15d
jne 0x1068a34
cmp dword [0x010aafd8], r15d
mov rcx, qword [0x010aaf10]
mov rax, qword [rcx + 0x28]
mov qword [rsp + 0x110], rax
mov rax, qword [rcx + 0x30]
mov qword [rsp + 0x118], rax
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x120], rax
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x128], rax
mov rax, qword [rcx + 0x48]
mov qword [rsp + 0x130], rax
je 0x10691b2
lea rcx, [0x010aaaa0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea r8, [0x0106adc4]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
call fcn.0107ddb8
mov qword [0x010aaf50], rax
or ebp, 0xffffffff
xor r8d, r8d
lea rdx, [rsp + 0x110]
or r9d, 0xffffffff
lea ecx, [r8 + 5]
mov dword [rsp + 0x20], 0x4ff
call qword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
cmp eax, r15d
jne 0x10691f5
mov rcx, qword [0x010aaf10]
cmp rcx, r15
je 0x1069561
call fcn.01076600
jmp 0x1069561
cmp eax, esi
jne 0x106921b
mov rcx, qword [0x010aaf10]
cmp rcx, r15
je 0x1069561
mov rcx, qword [rcx + 0x68]
cmp rcx, r15
je 0x1069561
jmp 0x1069529
cmp eax, 2
jne 0x10694d8
mov rbx, qword [0x010aaf10]
cmp rbx, r15
je 0x1069561
cmp dword [0x010aaf78], r15d
jne 0x106925c
cmp dword [0x010aaf98], r15d
jne 0x106925c
cmp dword [0x010aafb8], r15d
jne 0x106925c
cmp dword [0x010aaf7c], r15d
je 0x1069561
mov rcx, qword [rbx + 0x18]
mov qword [rsp + 0x38], r15
lea rax, [rsp + 0x64]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x78]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x2206b8
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x64], r15d
mov dword [rsp + 0x78], r15d
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
cmp eax, r15d
je 0x1069561
cmp dword [rsp + 0x78], r15d
je 0x10692b1
mov dword [rbx + 0x50], esi
jmp 0x10692b5
mov dword [rbx + 0x50], r15d
cmp dword [0x010aaf78], r15d
jne 0x10692ef
cmp dword [0x010aaf7c], r15d
jne 0x10692ef
cmp dword [0x010aaf98], r15d
je 0x10694be
mov rcx, qword [rbx + 0x68]
cmp rcx, r15
je 0x10694be
mov rax, qword [rcx]
mov edx, dword [rbx + 0x50]
call qword [rax + 0x20]
jmp 0x10694be
cmp dword [0x010aaf34], 6
jne 0x1069327
mov eax, dword [0x010aaf38]
cmp eax, esi
jne 0x1069312
mov edx, dword [rbx + 0x50]
mov rcx, rbx
call fcn.01076954
jmp 0x10694be
cmp eax, 3
jne 0x1069327
mov edx, dword [rbx + 0x50]
mov rcx, rbx
call fcn.01076a34
jmp 0x10694aa
mov esi, dword [rbx + 0x50]
lea r8, [rsp + 0x68]
lea rdx, [0x01067c10]
mov rcx, 0xffffffff80000002
mov rdi, r15
mov qword [rsp + 0x68], r15
mov dword [rsp + 0x70], r15d
mov dword [rsp + 0x50], 4
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov rcx, qword [rsp + 0x68]
cmp rcx, r15
je 0x106939d
lea rax, [rsp + 0x50]
lea rdx, [0x01067c38]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r15d
jne 0x10694a5
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rbx
call fcn.01076fc0
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp qword [rbx + 0x100], r15
je 0x10693d9
lea rcx, [0x01067c60]
xor r8d, r8d
xor edx, edx
call qword [rbx + 0xc8]
mov ecx, 0xa
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x010aaf78], r15d
je 0x106940e
mov rax, qword [rbx + 0xd0]
cmp rax, r15
je 0x106947e
cmp esi, r15d
mov r8d, ebp
mov rcx, rdi
je 0x1069408
mov esi, 1
mov edx, esi
call rax
jmp 0x1069483
xor edx, edx
call rax
jmp 0x106947e
mov rax, qword [rbx + 0xd8]
mov dword [rsp + 0x60], r15d
mov dword [rsp + 0x58], ebp
cmp rax, r15
je 0x1069457
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x60]
mov rcx, rdi
call rax
cmp al, r15b
je 0x1069457
mov eax, dword [rsp + 0x60]
cmp eax, r15d
je 0x1069457
lea r8, [rbx + 0x124]
mov edx, 1
mov rcx, rbx
mov dword [r8], eax
call fcn.010766c8
cmp esi, r15d
mov rcx, rbx
je 0x1069470
call fcn.01076828
mov r8d, dword [rbx + 0x124]
mov rcx, rbx
jmp 0x1069473
xor r8d, r8d
mov r9d, ebp
mov rdx, rdi
call fcn.01076794
mov esi, 1
mov rax, qword [rbx + 0xf8]
cmp rax, r15
je 0x1069494
mov rcx, rdi
call rax
mov rcx, qword [rbx + 0x58]
cmp rcx, r15
je 0x10694aa
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x10694aa
mov esi, 1
cmp dword [0x010aafe0], r15d
je 0x10694be
mov edx, dword [rbx + 0x50]
mov rcx, rbx
call fcn.01078ff4
cmp dword [0x010aafb8], r15d
je 0x1069561
mov rcx, rbx
call fcn.01078230
jmp 0x1069561
cmp eax, 3
jne 0x1069505
mov rbx, qword [0x010aaf10]
cmp rbx, r15
je 0x1069561
cmp qword [rbx + 0x68], r15
je 0x1069561
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, qword [rbx + 0x68]
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x1069561
cmp eax, 4
jne 0x1069561
mov rbx, qword [0x010aaf10]
cmp rbx, r15
je 0x1069561
mov rcx, qword [rbx + 0x68]
cmp rcx, r15
je 0x1069561
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbx + 0x68]
mov rax, qword [rcx]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x40]
call qword [rax + 0x28]
jmp 0x1069561
cmp dword [rsp + 0x140], 0x12
je 0x1069582
lea rcx, [rsp + 0x138]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x138]
call qword [sym.imp.USER32.dll_DispatchMessageW]
lea rcx, [rsp + 0x138]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], esi
call qword [sym.imp.USER32.dll_PeekMessageW]
cmp eax, r15d
jne 0x106953b
jmp 0x10695ae
cmp r13, r15
mov r14d, esi
mov dword [0x010aaf04], esi
je 0x1069598
mov rcx, r13
call fcn.0106b63c
mov rcx, qword [0x010aacf0]
cmp rcx, r15
je 0x1068a34
call qword [sym.imp.KERNEL32.dll_ResetEvent]
cmp r14d, r15d
je 0x10691b5
jmp 0x1068a34