Function at 0x1400feb50
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x90
mov rax, qword [0x140191010]
xor rax, rsp
mov qword [rbp + 0x27], rax
xor r13d, r13d
mov dword [rbp - 1], r13d
mov qword [rbp - 0x19], r13
mov r15d, 0x40
mov edx, r15d
lea rcx, [rbp - 0x19]
call fcn.1400219d0
test al, al
je 0x1400ff3ef
mov rcx, qword [rbp - 0x19]
movups xmm0, xmmword [str.CentralSeamlessUrl]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [0x1401551e8]
movups xmmword [rcx + 0x10], xmm1
mov eax, dword [0x1401551f8]
mov dword [rcx + 0x20], eax
mov rax, qword [rbp - 0x19]
test rax, rax
je 0x1400ff3ef
mov rcx, qword [rax - 0xc]
test rcx, rcx
je 0x1400ff3ef
cmp qword [rcx + 0x10], 0x12
jb 0x1400ff3ef
mov qword [rcx + 8], Ordinal_21
mov rax, qword [rbp - 0x19]
mov word [rax + 0x24], r13w
mov rax, qword [rbp - 0x19]
test rax, rax
je 0x1400fec3d
mov rcx, qword [rax - 0xc]
test rcx, rcx
je 0x1400fec3d
cmp dword [rax - 0x10], 0xabcd
jne 0x1400ff3ef
cmp dword [rax - 4], 0xabcd
jne 0x1400ff3ef
mov rcx, qword [rcx + 0x10]
cmp dword [rax + rcx*2 + 2], 0xabcd
jne 0x1400ff3ef
lea rdx, [rbp - 0x19]
lea rcx, [rbp - 0x29]
call fcn.1400fe040
nop
mov rax, qword [rbp - 0x29]
test rax, rax
je 0x1400fec63
mov rcx, qword [rax - 0xc]
test rcx, rcx
je 0x1400fec63
mov rdi, qword [rcx + 8]
jmp 0x1400fec66
mov rdi, r13
lea rbx, [rdi + 0x2d]
test rax, rax
je 0x1400fec82
mov rcx, qword [rax - 0xc]
test rcx, rcx
je 0x1400fec82
mov rdx, qword [rcx + 0x10]
mov rcx, qword [rcx + 0x18]
jmp 0x1400fec88
mov rdx, r13
mov rcx, r15
mov r12d, 0x400
cmp rdx, rbx
jb 0x1400fec98
test rdx, rdx
jne 0x1400fecd2
mov rax, rbx
sub rax, rdx
cmp rax, rcx
cmovae rcx, rax
cmp rdx, r12
jae 0x1400fecb3
cmp rcx, rdx
cmovb rcx, rdx
jmp 0x1400fecba
cmp rcx, r12
cmovb rcx, r12
add rdx, rcx
lea rcx, [rbp - 0x29]
call fcn.1400219d0
test al, al
je 0x1400ff3e5
mov rax, qword [rbp - 0x29]
lea rcx, [rax + rdi*2]
movaps xmm0, xmmword [str._redirect_urlhttps:__central.bitdefender.com]
movups xmmword [rcx], xmm0
movaps xmm1, xmmword [0x140155470]
movups xmmword [rcx + 0x10], xmm1
movaps xmm0, xmmword [0x140155480]
movups xmmword [rcx + 0x20], xmm0
movaps xmm1, xmmword [0x140155490]
movups xmmword [rcx + 0x30], xmm1
movaps xmm0, xmmword [0x1401554a0]
movups xmmword [rcx + 0x40], xmm0
movsd xmm1, qword [0x1401554b0]
movsd qword [rcx + 0x50], xmm1
movzx eax, word [0x1401554b8]
mov word [rcx + 0x58], ax
mov rax, qword [rbp - 0x29]
mov word [rax + rbx*2], r13w
mov rax, qword [rbp - 0x29]
test rax, rax
je 0x1400fed45
mov rcx, qword [rax - 0xc]
test rcx, rcx
je 0x1400fed45
mov rdx, qword [rcx + 0x10]
jmp 0x1400fed48
mov rdx, r13
cmp rbx, rdx
ja 0x1400ff3e5
test rax, rax
je 0x1400fed5c
mov rcx, qword [rax - 0xc]
jmp 0x1400fed5f
mov rcx, r13
mov qword [rcx + 8], rbx
mov rax, qword [rbp - 0x29]
test rax, rax
je 0x1400fedac
mov rdx, qword [rax - 0xc]
test rdx, rdx
je 0x1400fedac
cmp dword [rax - 0x10], 0xabcd
jne 0x1400ff3e5
cmp dword [rax - 4], 0xabcd
jne 0x1400ff3e5
mov rcx, qword [rdx + 0x10]
cmp dword [rax + rcx*2 + 2], 0xabcd
jne 0x1400ff3e5
test rdx, rdx
je 0x1400fedac
mov rdi, qword [rdx + 8]
jmp 0x1400fedaf
mov rdi, r13
lea rbx, [rdi + 6]
test rax, rax
je 0x1400fedcb
mov rcx, qword [rax - 0xc]
test rcx, rcx
je 0x1400fedcb
mov rdx, qword [rcx + 0x10]
mov rcx, qword [rcx + 0x18]
jmp 0x1400fedd1
mov rdx, r13
mov rcx, r15
cmp rdx, rbx
jb 0x1400feddb
test rdx, rdx
jne 0x1400fee15
mov rax, rbx
sub rax, rdx
cmp rax, rcx
cmovae rcx, rax
cmp rdx, r12
jae 0x1400fedf6
cmp rcx, rdx
cmovb rcx, rdx
jmp 0x1400fedfd
cmp rcx, r12
cmovb rcx, r12
add rdx, rcx
lea rcx, [rbp - 0x29]
call fcn.1400219d0
test al, al
je 0x1400ff3e5
mov rax, qword [rbp - 0x29]
lea rcx, [rax + rdi*2]
movsd xmm0, qword [0x140155438]
movsd qword [rcx], xmm0
mov eax, dword [0x140155440]
mov dword [rcx + 8], eax
mov rax, qword [rbp - 0x29]
mov word [rax + rbx*2], r13w
mov rax, qword [rbp - 0x29]
test rax, rax
je 0x1400fee4f
mov rcx, qword [rax - 0xc]
test rcx, rcx
je 0x1400fee4f
mov rdx, qword [rcx + 0x10]
jmp 0x1400fee52
mov rdx, r13
cmp rbx, rdx
ja 0x1400ff3e5
test rax, rax
je 0x1400fee66
mov rcx, qword [rax - 0xc]
jmp 0x1400fee69
mov rcx, r13
mov qword [rcx + 8], rbx
mov rax, qword [rbp - 0x29]
test rax, rax
je 0x1400feeab
mov rcx, qword [rax - 0xc]
test rcx, rcx
je 0x1400feeab
cmp dword [rax - 0x10], 0xabcd
jne 0x1400ff3e5
cmp dword [rax - 4], 0xabcd
jne 0x1400ff3e5
mov rcx, qword [rcx + 0x10]
cmp dword [rax + rcx*2 + 2], 0xabcd
jne 0x1400ff3e5
mov qword [rbp + 7], r13
mov qword [rbp + 0x17], r13
mov qword [rbp + 0x1f], 7
mov word [rbp + 7], r13w
mov dword [rbp - 1], 1
mov qword [rbp - 0x11], r13
lea rax, [rbp - 0x11]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [0x1401555f8]
mov rcx, 0xffffffff80000003
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rdi, 0xffffffffffffffff
test eax, eax
jne 0x1400fefaa
mov dword [rbp - 0x21], r13d
lea rax, [rbp - 0x21]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140155538]
mov rcx, qword [rbp - 0x11]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400fefa0
mov ecx, dword [rbp - 0x21]
shr rcx, 1
mov eax, 2
mul rcx
cmovo rax, rdi
mov rcx, rax
call qword [sym.imp.mfc140u.dll_operator]
mov rbx, rax
lea rax, [rbp - 0x21]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140155518]
mov rcx, qword [rbp - 0x11]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400fef97
mov r8, rdi
nop word [rax + rax]
inc r8
cmp word [rbx + r8*2], 0
jne 0x1400fef80
mov rdx, rbx
lea rcx, [rbp + 7]
call fcn.140002ed0
mov rcx, rbx
call qword [sym.imp.mfc140u.dll_operator_1]
mov rcx, qword [rbp - 0x11]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rbp + 7]
mov r8, qword [rbp + 7]
mov rdx, qword [rbp + 0x1f]
cmp rdx, 8
cmovae rcx, r8
mov rax, qword [rbp + 0x17]
lea r9, [rcx + rax*2]
lea rax, [rbp + 7]
cmovae rax, r8
cmp rax, r9
je 0x1400feff2
mov ecx, 0x2d
cmp word [rax], 0x5f
jne 0x1400fefe1
mov word [rax], cx
add rax, 2
cmp rax, r9
jne 0x1400fefd8
mov rdx, qword [rbp + 0x1f]
mov r8, qword [rbp + 7]
lea rsi, [rbp + 7]
cmp rdx, 8
jb 0x1400ff008
mov rsi, r8
test r8, r8
je 0x1400ff146
mov rbx, rdi
nop dword [rax + rax]
inc rbx
cmp word [rsi + rbx*2], 0
jne 0x1400ff010
test rbx, rbx
je 0x1400ff146
mov rax, qword [rbp - 0x29]
test rax, rax
je 0x1400ff03b
mov rcx, qword [rax - 0xc]
test rcx, rcx
je 0x1400ff03b
mov r12, qword [rcx + 8]
jmp 0x1400ff03e
mov r12, r13
lea r14, [r12 + rbx]
test rax, rax
je 0x1400ff05a
mov rcx, qword [rax - 0xc]
test rcx, rcx
je 0x1400ff05a
mov rdx, qword [rcx + 0x10]
mov rcx, qword [rcx + 0x18]
jmp 0x1400ff060
mov rdx, r13
mov rcx, r15
cmp rdx, r14
jb 0x1400ff06a
test rdx, rdx
jne 0x1400ff0a9
mov rax, r14
sub rax, rdx
cmp rax, rcx
cmovae rcx, rax
mov eax, 0x400
cmp rdx, rax
jae 0x1400ff08a
cmp rcx, rdx
cmovb rcx, rdx
jmp 0x1400ff091
cmp rcx, rax
cmovb rcx, rax
add rdx, rcx
lea rcx, [rbp - 0x29]
call fcn.1400219d0
test al, al
je 0x1400ff3f9
mov rax, qword [rbp - 0x29]
lea r8, [rbx + rbx]
lea rcx, [rax + r12*2]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rbp - 0x29]
mov word [rax + r14*2], r13w
mov rax, qword [rbp - 0x29]
test rax, rax
je 0x1400ff0da
mov rcx, qword [rax - 0xc]
test rcx, rcx
je 0x1400ff0da
mov rdx, qword [rcx + 0x10]
jmp 0x1400ff0dd
mov rdx, r13
cmp r14, rdx
ja 0x1400ff3f9
test rax, rax
je 0x1400ff0f1
mov rcx, qword [rax - 0xc]
jmp 0x1400ff0f4
mov rcx, r13
mov qword [rcx + 8], r14
mov rax, qword [rbp - 0x29]
test rax, rax
je 0x1400ff136
mov rcx, qword [rax - 0xc]
test rcx, rcx
je 0x1400ff136
cmp dword [rax - 0x10], 0xabcd
jne 0x1400ff3f9
cmp dword [rax - 4], 0xabcd
jne 0x1400ff3f9
mov rcx, qword [rcx + 0x10]
cmp dword [rax + rcx*2 + 2], 0xabcd
jne 0x1400ff3f9
mov rdx, qword [rbp + 0x1f]
mov r8, qword [rbp + 7]
mov r12d, 0x400
jmp 0x1400ff14a
mov rax, qword [rbp - 0x29]
cmp rdx, 8
jb 0x1400ff18c
lea rdx, [rdx*2 + 2]
mov rax, r8
cmp rdx, 0x1000
jb 0x1400ff180
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400ff180
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r8
call fcn.140071e50
mov rax, qword [rbp - 0x29]
mov rcx, qword [0x1401991f0]
mov qword [rbp - 9], r13
test rcx, rcx
je 0x1400ff34e
mov rax, qword [rcx]
lea rdx, [rbp - 9]
mov rax, qword [rax + 0x48]
call qword [case.0x14006aed5.0]
test eax, eax
jne 0x1400ff34a
mov rcx, qword [rbp - 9]
mov rax, qword [rcx]
mov rax, qword [rax + 0x30]
call qword [case.0x14006aed5.0]
mov rbx, rax
test rax, rax
je 0x1400ff339
mov rcx, rdi
nop dword [rax]
inc rcx
cmp word [rax + rcx*2], 0
jne 0x1400ff1e0
test rcx, rcx
je 0x1400ff339
mov rax, qword [rbp - 0x29]
test rax, rax
je 0x1400ff20b
mov rcx, qword [rax - 0xc]
test rcx, rcx
je 0x1400ff20b
mov r14, qword [rcx + 8]
jmp 0x1400ff20e
mov r14, r13
lea rsi, [r14 + 0x13]
test rax, rax
je 0x1400ff22a
mov rdx, qword [rax - 0xc]
test rdx, rdx
je 0x1400ff22a
mov rcx, qword [rdx + 0x10]
mov r15, qword [rdx + 0x18]
jmp 0x1400ff22d
mov rcx, r13
cmp rcx, rsi
jb 0x1400ff237
test rcx, rcx
jne 0x1400ff272
mov rax, rsi
sub rax, rcx
cmp rax, r15
cmovae r15, rax
cmp rcx, r12
jae 0x1400ff252
cmp r15, rcx
cmovb r15, rcx
jmp 0x1400ff259
cmp r15, r12
cmovb r15, r12
lea rdx, [r15 + rcx]
lea rcx, [rbp - 0x29]
call fcn.1400219d0
test al, al
je 0x1400ff3e5
mov rax, qword [rbp - 0x29]
lea rcx, [rax + r14*2]
movups xmm0, xmmword [str.credentials_token]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [0x1401552c8]
movups xmmword [rcx + 0x10], xmm1
mov eax, dword [0x1401552d8]
mov dword [rcx + 0x20], eax
movzx eax, word [0x1401552dc]
mov word [rcx + 0x24], ax
mov rax, qword [rbp - 0x29]
mov word [rax + rsi*2], r13w
mov rax, qword [rbp - 0x29]
test rax, rax
je 0x1400ff2c0
mov rcx, qword [rax - 0xc]
test rcx, rcx
je 0x1400ff2c0
mov rdx, qword [rcx + 0x10]
jmp 0x1400ff2c3
mov rdx, r13
cmp rsi, rdx
ja 0x1400ff3e5
test rax, rax
je 0x1400ff2d7
mov rcx, qword [rax - 0xc]
jmp 0x1400ff2da
mov rcx, r13
mov qword [rcx + 8], rsi
mov rax, qword [rbp - 0x29]
test rax, rax
je 0x1400ff320
mov rcx, qword [rax - 0xc]
test rcx, rcx
je 0x1400ff320
cmp dword [rax - 0x10], 0xabcd
jne 0x1400ff3e5
cmp dword [rax - 4], 0xabcd
jne 0x1400ff3e5
mov rcx, qword [rcx + 0x10]
cmp dword [rax + rcx*2 + 2], 0xabcd
jne 0x1400ff3e5
nop dword [rax]
inc rdi
cmp word [rbx + rdi*2], 0
jne 0x1400ff320
mov r8, rdi
mov rdx, rbx
lea rcx, [rbp - 0x29]
call fcn.140036850
mov rcx, qword [rbp - 9]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14006aed5.0]
mov rax, qword [rbp - 0x29]
lea r8, [0x140162244]
test rax, rax
cmovne r8, rax
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea rdx, [0x1401554c0]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
mov rax, qword [rbp - 0x29]
test rax, rax
je 0x1400ff3ae
mov rcx, qword [rax - 0xc]
test rcx, rcx
je 0x1400ff3ae
cmp dword [rax - 0x10], 0xabcd
jne 0x1400ff403
cmp dword [rax - 4], 0xabcd
jne 0x1400ff403
mov rcx, qword [rcx + 0x10]
cmp dword [rax + rcx*2 + 2], 0xabcd
jne 0x1400ff403
lea rcx, [rbp - 0x29]
call fcn.14001ead0
nop
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140071e30
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
xor edx, edx
xor ecx, ecx
call sub.VCRUNTIME140.dll__CxxThrowException
nop
xor edx, edx
xor ecx, ecx
call sub.VCRUNTIME140.dll__CxxThrowException
nop
xor edx, edx
xor ecx, ecx
call sub.VCRUNTIME140.dll__CxxThrowException
nop
xor edx, edx
xor ecx, ecx
call sub.VCRUNTIME140.dll__CxxThrowException
int3