Function at 0x140101020
Capabilities:
Create process on windows
Get windows directory from kuser_shared_data
Set registry value

Disassembly:
push rbp
push rdi
push r15
lea rbp, [rsp - 0x50]
sub rsp, 0x150
mov r8, qword [0x140210588]
mov rdi, rdx
mov word [rsp + 0x58], r8w
mov r15, rcx
lea eax, [r8 + 2]
mov word [rsp + 0x5a], ax
mov rax, qword [str.SoftwareMicrosoftWindowsCurrentVersionAppletsRegedit]
mov qword [rsp + 0x60], rax
cmp r8, 0xfffe
ja 0x140101319
xor r8d, r8d
lea rax, [rsp + 0x50]
lea r9, [rbp + 8]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x58]
lea rcx, [r8 - 9]
call fcn.140120390
test eax, eax
js 0x140101319
mov qword [rsp + 0x170], rbx
lea r8, [rbp + 8]
mov qword [rsp + 0x148], r12
lea rcx, [rbp + 0x88]
xor r12d, r12d
xor r9d, r9d
mov qword [rsp + 0x30], r12
mov edx, 0x20006
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.ntdll.dll_NtCreateKey]
mov rcx, qword [rsp + 0x50]
mov ebx, eax
test rcx, rcx
je 0x1401010e6
nop dword [rax + rax]
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
js 0x140101309
mov qword [rsp + 0x178], rsi
mov rcx, rdi
mov qword [rsp + 0x140], r14
call fcn.140100d40
mov rdx, qword [0x140210640]
mov rbx, rax
mov word [rsp + 0x68], dx
mov r8d, dword [rax]
mov rax, qword [rax + 8]
lea ecx, [rdx + 2]
mov word [rsp + 0x6a], cx
add r8d, 2
mov rcx, qword [str.LastKey]
mov qword [rsp + 0x70], rcx
cmp rdx, 0xfffe
ja 0x140101166
mov rcx, qword ds:[rbp + 0x88]
lea rdx, [rsp + 0x68]
mov dword [rsp + 0x28], r8d
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtSetValueKey]
mov rcx, qword [rbp + 0x88]
call qword [sym.imp.ntdll.dll_NtClose]
mov esi, 0xffffffff
lea rcx, [rbx - 0x10]
mov eax, esi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14010118d
call fcn.140106290
cmp qword [0x1402169b8], r12
je 0x1401011a4
movups xmm0, xmmword [0x1402169b0]
movaps xmmword [rsp + 0x40], xmm0
jmp 0x1401011f4
mov ecx, 0x7ffe0030
mov qword [rsp + 0x48], 0x7ffe0030
call sym.ProcessHacker.exe_PhCountStringZ
add rax, rax
mov qword [rsp + 0x40], rax
cmp word [rax + 0x7ffe002e], 0x5c
jne 0x1401011d2
add rax, 0xfffffffffffffffe
mov qword [rsp + 0x40], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
mov qword [0x1402169b0], rax
lock or dword [rsp], r12d
mov qword [0x1402169b8], 0x7ffe0030
mov rbx, qword [0x140210620]
mov rdi, qword [rsp + 0x40]
mov rdx, qword [0x140213b58]
add rbx, rdi
lea rcx, [rbx + 0x12]
call sym.ProcessHacker.exe_PhCreateObject
mov rdx, qword [rsp + 0x48]
mov r8, rdi
mov r14, rax
lea rcx, [rax + 0x10]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov word [rcx + rbx], r12w
mov rcx, qword [rax + 8]
call fcn.140165120
mov rcx, qword [r14 + 8]
mov r8, qword [0x140210620]
add rcx, rdi
mov rdx, qword [str._regedit.exe]
call fcn.140165120
lea rcx, [rbp - 0x10]
call sym.ProcessHacker.exe_PhGetOwnTokenAttributes
mov ecx, dword [rax + 8]
mov rax, qword [r14 + 8]
and ecx, 1
je 0x140101276
xor r8d, r8d
mov rdx, rax
mov rcx, r15
call sym.ProcessHacker.exe_PhShellExecute
jmp 0x1401012e6
xorps xmm0, xmm0
mov dword [rbp - 0x80], 0x70
movups xmmword [rbp - 0x6c], xmm0
xor ecx, ecx
mov qword [rbp - 0x68], rax
movups xmmword [rbp - 0x7c], xmm0
lea rax, str.runas
mov qword [rbp - 0x1c], rcx
movups xmmword [rbp - 0x5c], xmm0
mov dword [rbp - 0x14], ecx
lea rcx, [rbp - 0x80]
mov qword [rbp - 0x70], rax
movups xmmword [rbp - 0x4c], xmm0
mov qword [rbp - 0x60], r12
movups xmmword [rbp - 0x3c], xmm0
mov dword [rbp - 0x7c], 0x440
movups xmmword [rbp - 0x2c], xmm0
mov dword [rbp - 0x50], 1
mov qword [rbp - 0x78], r15
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x1401012e6
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x1401012e6
nop dword [rax]
call qword [sym.imp.ntdll.dll_NtClose]
lea rcx, [r14 - 0x10]
lock xadd dword [rcx + 8], esi
mov r14, qword [rsp + 0x140]
cmp esi, 1
mov rsi, qword [rsp + 0x178]
jne 0x140101309
call fcn.140106290
mov rbx, qword [rsp + 0x170]
mov r12, qword [rsp + 0x148]
add rsp, 0x150
pop r15
pop rdi
pop rbp
ret