Function at 0x1400a9f74
Capabilities:
Delete registry key
Packed with generic packer
Query or enumerate registry key

Disassembly:
setns byte [rsp + 0x10]
add qword [rsp], 0xfffffffffffebef3
call fcn.1400a344d
push 0x52bffe82
cmp qword [rsp + rcx*2 + 8], 0x6080920b
xchg qword [rsp + rcx*4 - 8], rax
mov rcx, qword [rsp + 0x20]
call fcn.14004e849
movabs r11, 0x1385c6b1451f5110
js 0x1400116b3
mov qword [rsp + 0x38], rdx
test edi, ebx
push rbx
mov ebx, dword [rsp + 3]
jle 0x14006c61b
movzx r15w, dil
call fcn.140071560
mov rsi, qword [rsp + 0x38]
mov rsi, qword [rsi]
sub r14b, r11b
call fcn.1400cd847
pop rbp
call fcn.140058b3e
call fcn.140057589
sbb eax, 0xcccccc55
int3
lea rax, [rax + 0x1c0f3206]
mov qword [rsp + 8], rdi
jne 0x14002fb22
shl byte [rsp + 8], 0x2d
xchg qword [rsp + 0x20], rax
mov rdi, qword [rsp]
mov dword [rsp + 8], 0xcc1421b3
not word [rsp + 8]
add qword [rsp + 0x10], 0xffffffffbff7d4d5
call fcn.14006345c
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + rcx*2 - 0x30]
mov qword [rsp + 0x40], rcx
lea r13, [r13*4 - 0x74dfa7e9]
test r15, r13
not r15
mov r15b, 7
push r15
lea rax, [rax - 0x3a598a4c]
jl 0x14001c490
fcomp qword [rdi - 0x2f62c8bc]
fxch st(2)
mov cl, 0xc2
mov eax, 0xa4575425
xlatb
std
loopne 0x14006c6b1
push rdx
and dword [rdx], edx
fdiv dword [rbp + 0x2f6c4f4c]
lodsd eax, dword [rsi]
movabs al, byte [0x7774cda0c281da09]
adc al, 0xa7
mov ebp, 0xeca8e355
adc eax, 0x950fc4e9
mov edi, 0x529925f6
insb byte [rdi], dx
loop 0x14006c6ad
sbb al, 0x42
invalid
invalid
ror byte [rsi], cl
invalid
xor r9, r14
sub r9, 0xffffffff84b4fba9
sub r9, 0x62b466a7
and r9, r14
push rsi
sub r9w, 0xc10a
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
call fcn.1400ae75f
lea rsi, [rsi + 1]
mov r11, r14
sub r11, 0x663f95bb
not r14w
js 0x140048e54
jle 0x14001c96d
setl r14b
neg r14d
push r12
setne r14b
mov qword [rsp + 0x40], rsi
mov r12, r15
not r15
or r12d, r11d
push rdx
add qword [rsp + 0x38], 0x3d15b
movzx r15w, r11b
movabs rsi, 0xeb997e0ad3bc771b
cmp r11d, r12d
jo 0x140090c40
js 0x14002f7e0

Function at 0x1400ae95f
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
pushfq
mov rax, qword [rsp + 0x18]
push r13
movabs r13, 0x5a2394bc26bd190f
push r13
add r13d, r13d
cmp dword [rsp + r13 - 0x4d7a321e], 0x1f2a0436
not qword [rsp + r13 - 0x4d7a321e]
push r15

Function at 0x1400b2d7c
Capabilities:
Terminate process

Disassembly:
cmp word [rsp + 0x10], r14w
mov rdx, qword [rsp + 0x28]
mov rdx, qword [rdx]
not dword [rsp + 0x18]
mov qword [rsp + 0x28], r14
setge byte [rsp + 0x28]
add qword [rsp], 0xfffffffffffd765a
and r10d, r14d
mov qword [rsp + 0x18], r14
sub r10w, word [rsp + 0x14]
test word [rsp + 0x15], r10w

Function at 0x1400b2e18
Capabilities:
Terminate process

Disassembly:
test r8b, 0xf
call fcn.14009f700

Function at 0x1400b4799
Capabilities:
Delete registry key
Packed with generic packer
Query or enumerate registry key

Disassembly:
lea rbp, [rbp + 0x5e05673d]
cmp r15d, r13d
jne 0x140087fcf
invalid

Function at 0x1400ba43c
Capabilities:
Connect pipe
Read file on windows
Write file on windows
Write pipe

Disassembly:
neg rbp
mov rbp, qword [rsp + 0x20]
mov qword [rsp + 0x20], rcx
neg qword [rsp + 0x10]
jg fcn.14009c349