Function at 0x1401331e0
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x37]
sub rsp, 0xd0
mov qword [rbp - 0x49], 0xfffffffffffffffe
mov rdi, rcx
xor r14d, r14d
mov ebx, r14d
mov qword [rbp - 0x69], rbx
mov dword [rbp - 0x61], r14d
mov qword [rbp - 0x59], r14
lea rcx, [rbp + 0x77]
call qword [sym.imp.mfc120u.dll_Ordinal_296]
nop
mov rax, qword [rdi + 0x18]
cmp dword [rax - 0x10], r14d
je 0x14013343e
mov r9d, 0x20019
mov r8, qword [rdi + 0x20]
mov rdx, 0xffffffff80000002
lea rcx, [rbp - 0x69]
call fcn.14008ff80
test eax, eax
jne 0x1401332fb
mov edx, Ordinal_261
lea rcx, [rbp + 0x77]
call qword [sym.imp.mfc120u.dll_Ordinal_4855]
mov rsi, rax
mov dword [rbp + 0x67], Ordinal_521
lea rax, [rbp + 0x67]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rbp + 0x6f]
xor r8d, r8d
mov rdx, qword [str.SerialNumber]
mov rbx, qword [rbp - 0x69]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401332aa
mov eax, dword [rbp + 0x6f]
dec eax
cmp eax, 1
ja 0x1401332aa
test rsi, rsi
je 0x1401332aa
cmp dword [rbp + 0x67], r14d
jne 0x1401332aa
mov word [rsi], r14w
or edx, 0xffffffff
lea rcx, [rbp + 0x77]
call qword [sym.imp.mfc120u.dll_Ordinal_12110]
test rbx, rbx
je 0x1401332cc
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, r14
mov qword [rbp - 0x69], rbx
mov dword [rbp - 0x61], r14d
xor r8d, r8d
mov rdx, qword [rdi + 0x18]
lea rcx, [rbp + 0x77]
call qword [sym.imp.mfc120u.dll_Ordinal_4467]
test eax, eax
jne 0x1401332ff
mov rax, qword [rbp + 0x77]
mov ecx, dword [rax - 0x10]
mov rax, qword [rdi + 0x18]
cmp ecx, dword [rax - 0x10]
je 0x14013343e
jmp 0x1401332ff
mov rbx, qword [rbp - 0x69]
mov eax, dword [rdi + 0x30]
dec eax
cmp eax, 2
ja 0x14013343e
lea rcx, [rbp + 0x67]
call qword [sym.imp.mfc120u.dll_Ordinal_296]
nop
lea rcx, [rbp + 0x6f]
call qword [sym.imp.mfc120u.dll_Ordinal_296]
nop
mov edx, Ordinal_261
lea rcx, [rbp + 0x67]
call qword [sym.imp.mfc120u.dll_Ordinal_4855]
mov rdx, rax
xor ecx, ecx
mov r8d, Ordinal_261
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
or edx, 0xffffffff
lea rcx, [rbp + 0x67]
call qword [sym.imp.mfc120u.dll_Ordinal_12110]
mov edx, 0x5c
lea rcx, [rbp + 0x67]
call qword [sym.imp.mfc120u.dll_Ordinal_12433]
mov r8d, eax
lea rdx, [rbp - 0x51]
lea rcx, [rbp + 0x67]
call qword [sym.imp.mfc120u.dll_Ordinal_7940]
nop
lea r8, str.ActivateSN.exe
mov rdx, rax
lea rcx, [rbp + 0x7f]
call fcn.1400afec0
nop
mov rdx, rax
lea rcx, [rbp + 0x67]
call qword [sym.imp.mfc120u.dll_Ordinal_1496]
nop
lea rcx, [rbp + 0x7f]
call qword [sym.imp.mfc120u.dll_Ordinal_1030]
nop
lea rcx, [rbp - 0x51]
call qword [sym.imp.mfc120u.dll_Ordinal_1030]
mov rax, qword [rdi + 0x20]
mov qword [rsp + 0x20], rax
mov r9, qword [rdi + 0x18]
mov r8, qword [str.SerialNumber]
lea rdx, str._s__s__s
lea rcx, [rbp + 0x6f]
call qword [sym.imp.mfc120u.dll_Ordinal_4612]
xor edx, edx
lea r8d, [rdx + 0x70]
lea rcx, [rbp - 0x39]
call sub.MSVCR120.dll_memset
mov dword [rbp - 0x39], 0x70
lea rax, str.open
mov qword [rbp - 0x29], rax
mov rax, qword [rbp + 0x67]
mov qword [rbp - 0x21], rax
mov rax, qword [rbp + 0x6f]
mov qword [rbp - 0x19], rax
mov dword [rbp - 9], 1
mov dword [rbp - 0x35], 0x40
lea rcx, [rbp - 0x39]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x140133428
or edx, 0xffffffff
mov rcx, qword [rbp + 0x2f]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
lea rcx, [rbp + 0x6f]
call qword [sym.imp.mfc120u.dll_Ordinal_1030]
nop
lea rcx, [rbp + 0x67]
call qword [sym.imp.mfc120u.dll_Ordinal_1030]
nop
lea rcx, [rbp + 0x77]
call qword [sym.imp.mfc120u.dll_Ordinal_1030]
nop
test rbx, rbx
je 0x140133457
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0xd0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret