Function at 0x1400122f0
Capabilities:
Execute command
Query or enumerate registry value
Set registry value
Terminate process

Disassembly:
push rdi
sub rsp, 0x6b0
mov rax, qword [0x14003b040]
xor rax, rsp
mov qword [rsp + 0x6a8], rax
lea rdx, str.xxx____x____xxxx
lea rcx, [0x1400329c0]
call fcn.14001afe0
mov qword [rsp + 0x98], rax
lea rax, [rsp + 0x50]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x51]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x52]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rsp + 0x50]
movzx r8d, byte [rsp + 0x51]
movzx edx, byte [rsp + 0x52]
lea rcx, [rsp + 0x170]
call fcn.14001b790
mov rcx, rax
call fcn.140015300
mov qword [rsp + 0xb0], rax
lea rax, [rsp + 0x53]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x54]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x55]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rsp + 0x53]
movzx r8d, byte [rsp + 0x54]
movzx edx, byte [rsp + 0x55]
lea rcx, [rsp + 0x200]
call fcn.14001b6e0
mov rcx, rax
call fcn.140017880
mov qword [rsp + 0xf0], rax
mov r9d, 0x23
mov r8, qword [rsp + 0xb0]
mov rdx, qword [rsp + 0xf0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov dword [rsp + 0xa8], eax
cmp dword [rsp + 0xa8], 6
jne 0x140012eee
lea rax, [rsp + 0x56]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x57]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x58]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rsp + 0x56]
movzx r8d, byte [rsp + 0x57]
movzx edx, byte [rsp + 0x58]
lea rcx, [rsp + 0x160]
call fcn.14001b790
mov rcx, rax
call fcn.140015300
mov qword [rsp + 0xf8], rax
lea rax, [rsp + 0x59]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x5a]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x5b]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rsp + 0x59]
movzx r8d, byte [rsp + 0x5a]
movzx edx, byte [rsp + 0x5b]
lea rcx, [rsp + 0x5b0]
call fcn.14001b7e0
mov rcx, rax
call fcn.140017ba0
mov qword [rsp + 0x100], rax
mov r9d, 0x21
mov r8, qword [rsp + 0xf8]
mov rdx, qword [rsp + 0x100]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov dword [rsp + 0xac], eax
cmp dword [rsp + 0xac], 1
jne 0x140012ee6
mov dword [rsp + 0x680], 0x2000
lea rax, [rsp + 0x5c]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x5d]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x5e]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rsp + 0x5c]
movzx r8d, byte [rsp + 0x5d]
movzx edx, byte [rsp + 0x5e]
lea rcx, [rsp + 0x230]
call fcn.14001ba30
mov rcx, rax
call fcn.140017880
lea r8, [rsp + 0x668]
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [rsp + 0x670], 5
mov dword [rsp + 0x67c], 0x2000
lea rax, [rsp + 0x5f]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x60]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x61]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rsp + 0x5f]
movzx r8d, byte [rsp + 0x60]
movzx edx, byte [rsp + 0x61]
lea rcx, [rsp + 0x300]
call fcn.14001bae0
mov rcx, rax
call fcn.140017250
lea r8, [rsp + 0x660]
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
cmp qword [rsp + 0x668], 0
je 0x140012de0
cmp qword [rsp + 0x660], 0
je 0x140012de0
lea rax, [rsp + 0x62]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x63]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x64]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rsp + 0x62]
movzx r8d, byte [rsp + 0x63]
movzx edx, byte [rsp + 0x64]
lea rcx, [rsp + 0x1c0]
call fcn.14001bc20
mov rcx, rax
call fcn.140015410
mov qword [rsp + 0x108], rax
lea rax, [rsp + 0x65]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x66]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x67]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rsp + 0x65]
movzx r8d, byte [rsp + 0x66]
movzx edx, byte [rsp + 0x67]
lea rcx, [rsp + 0x260]
call fcn.14001ba30
mov rcx, rax
call fcn.140017880
mov qword [rsp + 0x110], rax
lea rax, [rsp + 0x680]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x674]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
mov r9d, 0xffff
mov r8, qword [rsp + 0x108]
mov rdx, qword [rsp + 0x110]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegGetValueA]
test eax, eax
jne 0x140012dbd
cmp qword [rsp + 0x660], 0
je 0x14001285a
lea rax, [rsp + 0x68]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x69]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x6a]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rsp + 0x68]
movzx r8d, byte [rsp + 0x69]
movzx edx, byte [rsp + 0x6a]
lea rcx, [rsp + 0x150]
call fcn.14001bca0
mov rcx, rax
call fcn.140015300
mov qword [rsp + 0x118], rax
lea rax, [rsp + 0x6b]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x6c]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x6d]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rsp + 0x6b]
movzx r8d, byte [rsp + 0x6c]
movzx edx, byte [rsp + 0x6d]
lea rcx, [rsp + 0x360]
call fcn.14001bae0
mov rcx, rax
call fcn.140017250
mov qword [rsp + 0x120], rax
lea rax, [rsp + 0x67c]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x670]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
mov r9d, 0xffff
mov r8, qword [rsp + 0x118]
mov rdx, qword [rsp + 0x120]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegGetValueA]
jmp 0x140012865
mov dword [rsp + 0x670], 0
cmp dword [rsp + 0x674], 0
jne 0x1400128b8
cmp dword [rsp + 0x670], 0
jne 0x1400128b8
cmp qword [rsp + 0x98], 0
jne 0x1400128b3
lea rdx, str.xxx____xxxxx____xxx____x____x
lea rcx, [0x140032a10]
call fcn.14001bcf0
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0x98]
add rax, 0x10
mov qword [rsp + 0x98], rax
jmp 0x140012dbb
lea rdx, str.none
lea rcx, [rsp + 0x688]
call fcn.1400190e0
nop
cmp dword [rsp + 0x674], 0
je 0x140012940
lea rax, [rsp + 0x6e]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x6f]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rsp + 0x6e]
movzx r8d, byte [rsp + 0x6f]
movzx edx, byte [rsp + 0x70]
lea rcx, [rsp + 0x420]
call fcn.14001c3a0
mov rcx, rax
call fcn.140016b20
mov rdx, rax
lea rcx, [rsp + 0x688]
call fcn.140019080
cmp dword [rsp + 0x670], 0
je 0x1400129b3
lea rax, [rsp + 0x71]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x72]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x73]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rsp + 0x71]
movzx r8d, byte [rsp + 0x72]
movzx edx, byte [rsp + 0x73]
lea rcx, [rsp + 0x490]
call fcn.14001c510
mov rcx, rax
call fcn.1400162e0
mov rdx, rax
lea rcx, [rsp + 0x688]
call fcn.140019080
cmp dword [rsp + 0x674], 0
je 0x140012a30
cmp dword [rsp + 0x670], 0
je 0x140012a30
lea rax, [rsp + 0x74]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x75]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x76]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rsp + 0x74]
movzx r8d, byte [rsp + 0x75]
movzx edx, byte [rsp + 0x76]
lea rcx, [rsp + 0x510]
call fcn.14001c6b0
mov rcx, rax
call fcn.140015890
mov rdx, rax
lea rcx, [rsp + 0x688]
call fcn.140019080
lea rax, [rsp + 0x77]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x78]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x79]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rsp + 0x77]
movzx r8d, byte [rsp + 0x78]
movzx edx, byte [rsp + 0x79]
lea rcx, [rsp + 0x140]
call fcn.14001b790
mov rcx, rax
call fcn.140015300
mov qword [rsp + 0x128], rax
lea rcx, [rsp + 0x688]
call fcn.140018ef0
mov qword [rsp + 0x130], rax
mov r9d, 0x23
mov r8, qword [rsp + 0x128]
mov rdx, qword [rsp + 0x130]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov dword [rsp + 0xa4], eax
cmp dword [rsp + 0xa4], 6
jne 0x140012da4
mov dword [rsp + 0x678], 0
lea rax, [rsp + 0x7a]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x7b]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x7c]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rsp + 0x7a]
movzx r8d, byte [rsp + 0x7b]
movzx edx, byte [rsp + 0x7c]
lea rcx, [rsp + 0x290]
call fcn.14001ba30
mov rcx, rax
call fcn.140017880
mov qword [rsp + 0x40], 0
lea rcx, [rsp + 0x668]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
lea rax, [rsp + 0x7d]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x7e]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x7f]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rsp + 0x7d]
movzx r8d, byte [rsp + 0x7e]
movzx edx, byte [rsp + 0x7f]
lea rcx, [rsp + 0x1e0]
call fcn.14001bc20
mov rcx, rax
call fcn.140015410
mov qword [rsp + 0xb8], rax
mov rax, qword [rsp + 0x668]
mov qword [rsp + 0xc0], rax
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x678]
mov qword [rsp + 0x20], rax
mov r9d, 4
mov r8, qword [rsp + 0xb8]
xor edx, edx
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueA]
lea rax, [rsp + 0x80]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x81]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x82]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rsp + 0x80]
movzx r8d, byte [rsp + 0x81]
movzx edx, byte [rsp + 0x82]
lea rcx, [rsp + 0x3c0]
call fcn.14001bae0
mov rcx, rax
call fcn.140017250
mov qword [rsp + 0x40], 0
lea rcx, [rsp + 0x660]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
lea rax, [rsp + 0x83]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x84]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x85]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rsp + 0x83]
movzx r8d, byte [rsp + 0x84]
movzx edx, byte [rsp + 0x85]
lea rcx, [rsp + 0x180]
call fcn.14001bca0
mov rcx, rax
call fcn.140015300
mov qword [rsp + 0xc8], rax
mov rax, qword [rsp + 0x660]
mov qword [rsp + 0xd8], rax
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x678]
mov qword [rsp + 0x20], rax
mov r9d, 4
mov r8, qword [rsp + 0xc8]
xor edx, edx
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueA]
lea rcx, str.shutdown__r__t_0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
jmp 0x140012dad
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
lea rcx, [rsp + 0x688]
call fcn.1400190b0
nop
jmp 0x140012dbf
jmp 0x140012de0
mov rcx, qword [rsp + 0x668]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x660]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140012ee4
lea rax, [rsp + 0x86]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x87]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x88]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rsp + 0x86]
movzx r8d, byte [rsp + 0x87]
movzx edx, byte [rsp + 0x88]
lea rcx, [rsp + 0x190]
call fcn.14001b790
mov rcx, rax
call fcn.140015300
mov qword [rsp + 0xd0], rax
lea rax, [rsp + 0x89]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x8a]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x8b]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rsp + 0x89]
movzx r8d, byte [rsp + 0x8a]
movzx edx, byte [rsp + 0x8b]
lea rcx, [rsp + 0x2c0]
call fcn.14001c8c0
mov rcx, rax
call fcn.140018800
mov qword [rsp + 0xe8], rax
mov r9d, 0x30
mov r8, qword [rsp + 0xd0]
mov rdx, qword [rsp + 0xe8]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x140012eee
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov eax, 4
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x14003bc24], eax
jle 0x140012fb0
lea rcx, [0x14003bc24]
call fcn.14002fe98
cmp dword [0x14003bc24], 0xffffffff
jne 0x140012fb0
lea rax, [rsp + 0x8c]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x8d]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x8e]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rsp + 0x8c]
movzx r8d, byte [rsp + 0x8d]
movzx edx, byte [rsp + 0x8e]
lea rcx, [rsp + 0x1a0]
call fcn.14001c9a0
mov rcx, rax
call fcn.140015300
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [0x14003bc48], rax
lea rcx, [0x14003bc24]
call fcn.14002fe2c
cmp qword [rsp + 0x98], 0
je 0x140012fc5
cmp qword [0x14003bc48], 0
jne 0x140012fcc
xor eax, eax
jmp 0x1400130e6
mov rax, qword [rsp + 0x98]
mov eax, dword [rax + 3]
mov dword [rsp + 0xa0], eax
movsxd rax, dword [rsp + 0xa0]
mov rcx, qword [rsp + 0x98]
lea rax, [rcx + rax + 7]
sub rax, qword [0x14003bc48]
mov qword [rsp + 0xe0], rax
mov eax, 4
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x14003bc78], eax
jle 0x1400130c3
lea rcx, [0x14003bc78]
call fcn.14002fe98
cmp dword [0x14003bc78], 0xffffffff
jne 0x1400130c3
lea rax, [rsp + 0x8f]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x90]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x91]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rsp + 0x8f]
movzx r8d, byte [rsp + 0x90]
movzx edx, byte [rsp + 0x91]
lea rcx, [rsp + 0x1b0]
call fcn.14001c9a0
mov rcx, rax
call fcn.140015300
mov rcx, rax
call fcn.140011ad0
mov qword [0x14003bc58], rax
lea rcx, [0x14003bc78]
call fcn.14002fe2c
cmp qword [0x14003bc58], 0
jne 0x1400130d1
xor eax, eax
jmp 0x1400130e6
mov rax, qword [rsp + 0xe0]
mov rcx, qword [0x14003bc58]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x6a8]
xor rcx, rsp
call fcn.14002fd60
add rsp, 0x6b0
pop rdi
ret