Function at 0x140008760
Capabilities:
Create process on windows
Enumerate process modules
Query or enumerate registry value

Disassembly:
push r12
push r14
push r15
mov eax, 0x16c0
call fcn.14000c3d0
sub rsp, rax
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x16e0], rbx
mov qword [rsp + 0x16e8], rsi
mov qword [rsp + 0x16f0], rdi
mov rax, qword [0x140046088]
xor rax, rsp
mov qword [rsp + 0x16b0], rax
cmp qword [0x140048e88], 0xa
jne 0x140008a87
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetSystemPowerStatus]
xor r12d, r12d
mov dword [rsp + 0x58], r12d
mov dword [rsp + 0x60], r12d
mov dword [rsp + 0x68], 4
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
lea r9d, [r12 + 0x10]
lea r8, str.ColorIntelligenceEnabled
lea rdx, str.SOFTWAREOEMQuick_Access
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x140008840
xor r9d, r9d
lea r8, str.ColorIntelligenceEnabled
lea rdx, str.SOFTWAREOEMQuick_Access
call fcn.1400073c0
test eax, eax
jne 0x140008840
mov r8d, dword [rsp + 0x68]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x58]
call fcn.14000e280
nop
movzx eax, byte [rsp + 0x70]
cmp al, 1
jne 0x140008a29
cmp dword [rsp + 0x58], 1
jne 0x140008a87
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x1290]
call fcn.14000f120
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x14a0]
call fcn.14000f120
mov r8d, 0x104
lea rdx, [rsp + 0x1290]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x1290]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea r9, str.PluginsColorIntelligenceCACE.exe
lea r8, [rsp + 0x1290]
lea rdx, [0x14003f1e8]
lea rcx, [rsp + 0x14a0]
call fcn.1400011f0
lea r8, [rsp + 0x60]
mov edx, 0x1000
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_K32EnumProcesses]
mov r14d, dword [rsp + 0x60]
shr r14d, 2
mov edi, r12d
test r14d, r14d
je 0x1400089d8
lea rsi, [rsp + 0x80]
lea r15, str.CACE.exe
nop word [rax + rax]
movups xmm0, xmmword [str._unknown_]
movaps xmmword [rsp + 0x1080], xmm0
mov eax, dword [0x14003f208]
mov dword [rsp + 0x1090], eax
xor edx, edx
mov r8d, 0x1f4
lea rcx, [rsp + 0x1094]
call fcn.14000f120
mov r8d, dword [rsi]
test r8d, r8d
je 0x140008997
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140008997
lea r9, [rsp + 0x6c]
mov r8d, 8
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x140008997
mov r9d, 0x104
lea r8, [rsp + 0x1080]
mov rdx, qword [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameW]
lea rdx, [rsp + 0x1080]
or rax, 0xffffffffffffffff
movzx ecx, word [rdx + rax*2 + 2]
cmp cx, word [r15 + rax*2 + 2]
jne 0x1400089c9
add rax, 2
cmp rax, 9
je 0x140008a87
movzx ecx, word [rdx + rax*2]
cmp cx, word [r15 + rax*2]
je 0x1400089a3
inc edi
add rsi, 4
cmp edi, r14d
jb 0x140008910
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8, [rsp + 0x14a0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
ja 0x140008a87
mov rcx, qword [0x140048b90]
test rcx, rcx
je 0x140008a87
lea r9, str.Execute_CACE_failed.
lea r8, str.WindowsMessageLoop::WindowsPowerBroadCast
mov edx, 2
call fcn.1400057d0
jmp 0x140008a87
test al, al
jne 0x140008a87
cmp dword [rsp + 0x58], 1
jne 0x140008a87
lea rdx, str.CACE
lea rcx, str.CACE
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x140008a87
nop dword [rax]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x10]
mov rcx, rax
call qword [sym.imp.USER32.dll_PostMessageW]
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str.CACE
lea rcx, str.CACE
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
jne 0x140008a50
mov rcx, qword [rsp + 0x16b0]
xor rcx, rsp
call fcn.14000ba00
lea r11, [rsp + 0x16c0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop r12
ret