Function at 0x1401d7dd0
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
push rbp
push rdi
push r12
sub rsp, 0x680
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x670], rbx
mov qword [rbp + 0x678], rsi
mov rax, qword [0x14042d950]
xor rax, rbp
mov qword [rbp + reloc.MFC80U.DLL_Ordinal_1584], rax
mov rbx, rdx
mov rsi, rcx
mov edi, 4
lea rdx, str.APP:
mov r8, rdi
mov rcx, rbx
call qword [sym.imp.ntdll.dll__wcsnicmp]
test eax, eax
je 0x1401d7e3f
lea r8d, [rdi + 1]
lea rdx, str._APP:
mov rcx, rbx
call qword [sym.imp.ntdll.dll__wcsnicmp]
test eax, eax
jne 0x1401d7e53
mov edi, 5
movsxd rax, edi
mov rcx, rsi
lea rdx, [rbx + rax*2]
call fcn.1401d79a0
jmp 0x1401d80e5
lea rdx, [0x14036ff00]
xor esi, esi
xor r9d, r9d
mov r8, rbx
xor ecx, ecx
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], rsi
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp rax, 0x20
mov r12, rax
ja 0x1401d80db
lea rcx, [rbp + 0x12]
xor edx, edx
mov r8d, Ordinal_1040
mov word [rbp + 0x10], si
call sub.ntdll.dll_memset
lea rdx, [rbp + 8]
mov qword [rsp + 0x20], rdx
lea r9d, [rsi + 1]
lea rdx, str..htm
xor r8d, r8d
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov word [rbp + 0x10], si
test eax, eax
jne 0x1401d80db
mov rcx, qword [rbp + 8]
lea r9, [rbp]
lea r8, [rbp + 0x420]
xor edx, edx
mov dword [rbp], Ordinal_265
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x1401d80db
lea rdx, [rbp + 0x420]
lea rcx, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp + 0x10]
lea r9d, [rsi + 1]
lea rdx, [rbp + 0x10]
repne scasw ax, word [rdi]
mov rax, qword [str._shellopencommand]
xor r8d, r8d
mov qword [rdi - 2], rax
mov rax, qword [0x14036ff28]
mov rcx, 0xffffffff80000000
mov qword [rdi + 6], rax
mov rax, qword [0x14036ff30]
mov qword [rdi + 0xe], rax
mov rax, qword [0x14036ff38]
mov qword [rdi + 0x16], rax
mov rax, qword [0x14036ff40]
mov qword [rdi + 0x1e], rax
lea rax, [rbp + 8]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov word [rbp + 0x10], si
test eax, eax
jne 0x1401d80db
mov rcx, qword [rbp + 8]
lea r9, [rbp]
lea r8, [rbp + 0x420]
xor edx, edx
mov dword [rbp], Ordinal_265
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x1401d80db
lea rdx, [rbp + 0x420]
lea rcx, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.__1_
lea rcx, [rbp + 0x10]
call qword [sym.imp.ntdll.dll_wcsstr]
test rax, rax
mov r11, rax
jne 0x1401d8003
lea rdx, [0x14036ff54]
lea rcx, [rbp + 0x10]
call qword [sym.imp.ntdll.dll_wcsstr]
test rax, rax
mov r11, rax
jne 0x1401d8003
or rcx, 0xffffffffffffffff
lea rdi, [rbp + 0x10]
repne scasw ax, word [rdi]
not rcx
lea r11, [rbp + rcx*2 + 0xc]
jmp 0x1401d8006
mov word [rax], si
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r11
repne scasw ax, word [rdi]
mov eax, dword [0x14036bbfc]
or rcx, 0xffffffffffffffff
mov dword [rdi - 2], eax
xor eax, eax
mov rdi, r11
repne scasw ax, word [rdi]
xor ecx, ecx
nop
nop
movzx eax, word [rbx + rcx]
add rcx, 2
test ax, ax
mov word [rdi + rcx - 4], ax
jne 0x1401d8030
call qword [0x14042d970]
lea rcx, [rbp + 0x10]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r9d, [rax + 1]
cmp r9d, 0x3fffffff
jg 0x1401d80c7
movsxd rax, r9d
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x1401d807a
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call sub.ntdll.dll___chkstk
sub rsp, rcx
lea rdi, [rsp + 0x40]
test rdi, rdi
je 0x1401d80c7
lea eax, [r9 + r9]
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], eax
lea r8, [rbp + 0x10]
or r9d, 0xffffffff
xor edx, edx
mov ecx, ebx
mov qword [rsp + 0x20], rdi
mov byte [rdi], sil
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
cmove rdi, rsi
jmp 0x1401d80ca
mov rdi, rsi
mov edx, 5
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WinExec]
mov r12d, eax
cmp r12, 0x20
seta sil
mov eax, esi
mov rcx, qword [rbp + reloc.MFC80U.DLL_Ordinal_1584]
xor rcx, rbp
call fcn.140161080
mov rbx, qword [rbp + 0x670]
mov rsi, qword [rbp + 0x678]
lea rsp, [rbp + reloc.MFC80U.DLL_Ordinal_1600]
pop r12
pop rdi
pop rbp
ret