Function at 0x100006630
Capabilities:
Create process on windows
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1c0
mov rax, qword [0x10001a100]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
mov rcx, qword [0x10001db10]
lea rdx, [0x10001d6d0]
mov r8d, 0x103
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor r15d, r15d
cmp eax, r15d
jne 0x10000668e
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x100006c4c
lea r13, [0x1000019a8]
mov word [0x10001d8d6], r15w
mov edi, r15d
mov r14, r15
lea rbp, [0x100000000]
mov esi, 1
mov qword [rsp + 0x78], r13
mov r9d, dword [r13]
lea r8, [0x100001ac0]
lea rcx, [0x10001da20]
mov edx, 0x28
lea rbx, [0x10001bd40]
call fcn.100004f90
cmp eax, r15d
mov r11d, eax
jl 0x100006c4c
mov r8, qword [r14 + rbp + 0x1bde8]
cmp r8, r15
je 0x10000673b
lea rax, [0x10001d630]
mov edx, 0x28
mov r11d, r15d
mov rcx, rax
sub r8, rax
lea rax, [rdx + 0x7fffffd6]
cmp rax, r15
je 0x100006728
movzx eax, word [r8 + rcx]
cmp ax, r15w
je 0x100006728
mov word [rcx], ax
add rcx, 2
sub rdx, rsi
jne 0x100006705
cmp rdx, r15
jne 0x100006737
sub rcx, 2
mov r11d, 0x8007007a
mov word [rcx], r15w
cmp r11d, r15d
jl 0x100006c49
mov r8, qword [r14 + rbp + 0x1bf68]
lea rax, [0x10001d8e0]
mov edx, 0x64
sub r8, rax
mov rcx, rax
mov r11d, r15d
lea rax, [rdx + 0x7fffff9a]
cmp rax, r15
je 0x100006784
movzx eax, word [r8 + rcx]
cmp ax, r15w
je 0x100006784
mov word [rcx], ax
add rcx, 2
sub rdx, rsi
jne 0x100006761
cmp rdx, r15
jne 0x100006793
sub rcx, 2
mov r11d, 0x8007007a
cmp r11d, r15d
mov word [rcx], r15w
jl 0x100006c49
cmp qword [0x10001bd40], r15
je 0x1000068b6
lea rax, [rbx + 8]
cmp qword [rax], r15
je 0x1000068ad
cmp qword [rbx + 0x10], r15
je 0x1000068ad
mov r8, qword [rbx]
mov r9, qword [rax]
lea rcx, [rsp + 0x110]
mov edx, 0x50
mov rbx, rax
call fcn.100004f90
cmp eax, r15d
jl 0x100006c4c
mov qword [rsp + 0x40], r15
lea rax, [rsp + 0x60]
lea rdx, [rsp + 0x110]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000000
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], r15d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, r15d
jne 0x10000685c
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x60]
mov r9d, esi
lea eax, [rax + rax + 2]
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x28], eax
mov rax, qword [rbx + 8]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, r15d
je 0x10000685e
add edi, esi
mov rcx, qword [rbx + 0x10]
cmp rcx, r15
je 0x10000689e
add rcx, 2
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rsp + 0x60]
lea eax, [rax + rax + 2]
mov r9d, esi
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov rax, qword [rbx + 0x18]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, r15d
je 0x10000689e
add edi, esi
mov rcx, qword [rsp + 0x60]
add rbx, 0x20
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp qword [rbx], r15
jne 0x1000067ad
cmp dword [0x10001db24], r15d
je 0x100006a07
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x68]
xor r9d, r9d
mov r8d, esi
mov qword [rsp + 0x68], r15
mov dword [rsp + 0x50], r15d
call fcn.1000063ac
cmp eax, r15d
jne 0x1000069c3
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x50], r15
mov r12d, r15d
mov ebp, r15d
mov dword [rsp + 0x80], 0x18
mov dword [rsp + 0x90], r15d
mov qword [rsp + 0x88], rax
mov r13d, 1
mov eax, ebp
mov ebx, 2
neg eax
sbb esi, esi
add esi, 2
cmp esi, ebx
je 0x10000693e
mov dl, r13b
mov ecx, esi
call fcn.100005150
cmp al, r15b
cmovne ebx, esi
mov qword [rsp + 0x40], r15
lea rax, [rsp + 0x50]
cmp ebp, r15d
mov qword [rsp + 0x38], rax
cmovne r12d, r13d
lea rax, [rsp + 0x80]
mov qword [rsp + 0x30], rax
lea rdx, [0x100001b10]
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0x2011f
mov dword [rsp + 0x20], r15d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, r15d
mov esi, eax
cmove r12d, r13d
cmp ebx, 2
je 0x10000699f
xor edx, edx
mov ecx, ebx
call fcn.100005150
mov ebp, r13d
cmp r12d, r15d
je 0x10000691c
mov r13, qword [rsp + 0x78]
cmp esi, r15d
je 0x100006b4c
mov rsi, rbp
lea rbp, [0x100000000]
add edi, esi
call fcn.10000a9dc
cmp al, r15b
je 0x1000069e6
lea rcx, [0x10001bf20]
call fcn.10000645c
mov ecx, r15d
cmp al, r15b
sete cl
add edi, ecx
call fcn.10000a9dc
cmp al, r15b
je 0x100006a07
lea rcx, [0x10001bd18]
call fcn.10000645c
mov ecx, r15d
cmp al, r15b
sete cl
add edi, ecx
lea rax, [rsp + 0x70]
lea rdx, [0x100001bb8]
mov r9d, esi
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, r15d
jne 0x100006b1c
mov rcx, qword [rsp + 0x70]
lea rax, [rsp + 0x58]
lea rdx, [0x100001bd8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x5c]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x58], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r15d
jne 0x100006b11
cmp dword [rsp + 0x5c], esi
jne 0x100006b11
xor edx, edx
lea rcx, [rsp + 0xa0]
lea r8d, [rdx + 0x68]
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x80]
lea rcx, [0x100001c08]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xa0]
xor r9d, r9d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], r15d
mov dword [rsp + 0xa0], 0x68
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, r15d
je 0x100006b11
mov rcx, qword [rsp + 0x80]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add r13, 0x10
lea rax, [0x1000019b8]
add r14, 8
cmp r13, rax
mov qword [rsp + 0x78], r13
jl 0x1000066b4
cmp edi, r15d
je 0x100006c09
mov eax, 0x80040201
jmp 0x100006c4c
lea rbp, [0x10001d6d0]
mov r12d, 0x5c
mov rcx, rbp
mov edx, r12d
call qword [sym.imp.msvcrt.dll_wcsrchr]
mov rbx, rax
cmp rax, r15
je 0x100006bb6
cmp rax, rbp
je 0x100006bb6
mov rcx, rbp
mov word [rax], r15w
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x50]
lea esi, [r12 - 0x5b]
lea eax, [rax + rax + 2]
lea rdx, [0x100001b78]
mov r9d, esi
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, r15d
je 0x100006bb0
add edi, esi
mov word [rbx], r12w
jmp 0x100006bbd
mov esi, 1
add edi, esi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x50]
lea rdx, [0x100001ba0]
lea eax, [rax + rax + 2]
mov r9d, esi
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, r15d
je 0x100006bf2
add edi, esi
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rbp, [0x100000000]
jmp 0x1000069c5
mov rax, qword [0x10001db38]
cmp rax, r15
jne 0x100006c2e
lea rcx, [0x100001cc8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x10001db38], rax
cmp rax, r15
je 0x100006c45
lea rdx, [0x100001a60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp rax, r15
je 0x100006c45
call rax
xor eax, eax
jmp 0x100006c4c
mov eax, r11d
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.100017460
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret