Function at 0x1400123b0
Capabilities:
Create process on windows
Set registry value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
mov eax, 0x2ca0
call fcn.1400243a0
sub rsp, rax
mov qword [rsp + 0x160], 0xfffffffffffffffe
mov rax, qword [0x140047170]
xor rax, rsp
mov qword [rsp + CFrameWndEx::OnSetMenu], rax
mov rax, qword [rsp + 0x2cb0]
mov rcx, qword [rsp + 0x2cb8]
mov qword [rax + 0x10], rcx
mov dword [rsp + 0x50], 0
mov dword [rsp + 0x4c], 1
lea rcx, [rsp + 0x110]
call fcn.140015440
nop
mov rax, qword [rsp + 0x2cb0]
cmp qword [rax + 8], 0
je 0x140012445
lea rdx, [rsp + 0x110]
mov rax, qword [rsp + 0x2cb0]
mov rcx, qword [rax + 8]
call sub.mfc140u.dll_CMFCPrintPreviewToolBar::OnToolHitTest
movzx eax, byte [rsp + 0x159]
test eax, eax
je 0x1400125f6
call qword [sym.imp.sysn.dll_bool___cdecl_SYS_IsProcessElevated_void_]
movzx eax, al
test eax, eax
jne 0x140012574
xor eax, eax
mov word [rsp + reloc.mfc140u.dll_CPaneDivider::FindPaneContainer], ax
lea rax, [rsp + 0x1292]
mov rdi, rax
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
mov r8d, operator
lea rdx, [rsp + reloc.mfc140u.dll_CPaneDivider::FindPaneContainer]
mov rcx, qword [rsp + 0x2cb8]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov r8d, 0x70
xor edx, edx
lea rcx, [rsp + 0x1f0]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x1f0], 0x70
lea rax, str.runas
mov qword [rsp + 0x200], rax
lea rax, [rsp + reloc.mfc140u.dll_CPaneDivider::FindPaneContainer]
mov qword [rsp + 0x208], rax
lea rax, str._install
mov qword [rsp + 0x210], rax
mov dword [rsp + 0x220], 1
lea rcx, [rsp + 0x1f0]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x140012572
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 0
je 0x140012572
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x20], rax
mov r9d, 0x400
mov r8d, dword [rsp + 0x60]
xor edx, edx
mov ecx, 0x1300
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0xb8]
call sub.mfc140u.dll_AfxInitNetworkAddressControl
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1400125d2
xor edx, edx
lea rcx, [rsp + 0xb70]
call fcn.140002a10
mov qword [rsp + 0xe8], rax
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0xf0], rax
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0xc0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc0]
call qword [rax + 0x2f8]
nop
lea rcx, [rsp + 0xb70]
call fcn.140002ab0
mov dword [rsp + 0x90], 0
lea rcx, [rsp + 0x110]
call fcn.140015e20
mov eax, dword [rsp + 0x90]
jmp 0x140013054
cmp dword [rsp + 0x128], 7
je 0x140012610
movzx eax, byte [rsp + 0x15a]
test eax, eax
je 0x140012785
mov rax, qword [rsp + 0x2cb0]
cmp qword [rax + 8], 0
je 0x140012632
mov rax, qword [rsp + 0x2cb0]
mov rax, qword [rax + 8]
mov byte [rax + 0x191], 1
mov rcx, qword [rsp + 0x2cb0]
call fcn.140013290
mov rcx, qword [rsp + 0x2cb0]
call fcn.140013230
call qword [sym.imp.sysn.dll_bool___cdecl_SYS_IsVistaOrHigher_void_]
movzx eax, al
test eax, eax
je 0x140012670
xor r9d, r9d
xor r8d, r8d
mov edx, 0xaf
lea rcx, [0x140048c40]
call fcn.1400220c0
xor ecx, ecx
call fcn.14000d370
xor edx, edx
lea rcx, [0x140048c40]
call fcn.140021690
mov dword [rsp + 0x50], eax
movzx eax, byte [rsp + 0x158]
test eax, eax
jne 0x1400126a5
movzx eax, byte [rsp + 0x15a]
test eax, eax
je 0x14001277d
lea rcx, [rsp + 0x40]
call fcn.140015290
nop
xor ecx, ecx
call fcn.1400137d0
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
mov dx, 1
lea rcx, [0x1400311d8]
call qword [sym.imp.OLEAUT32.dll_VarDecFix]
mov dword [rsp + 0x94], eax
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov dx, 1
lea rcx, [0x1400311d8]
call qword [sym.imp.OLEAUT32.dll_VarDecFix]
mov dword [rsp + 0x94], eax
movzx eax, word [0x14003307c]
mov word [rsp + 0x14a0], ax
lea rax, [rsp + 0x14a2]
mov rdi, rax
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
lea r9, [rsp + 0x14a0]
lea r8, str.CATPRO.EXE
mov dx, 1
xor ecx, ecx
call qword [sym.imp.sysn.dll_REP_Repert]
mov dword [rsp + 0x28], 0xa
mov qword [rsp + 0x20], 0
lea r9, str._UnregServer
lea r8, [rsp + 0x14a0]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
jmp 0x140012773
lea rcx, [rsp + 0x40]
call fcn.140015cf0
mov dword [rsp + 0x4c], 0
cmp dword [rsp + 0x128], 6
je 0x14001279f
movzx eax, byte [rsp + 0x15a]
test eax, eax
je 0x140012a7a
mov rax, qword [rsp + 0x2cb0]
cmp qword [rax + 8], 0
je 0x1400127c1
mov rax, qword [rsp + 0x2cb0]
mov rax, qword [rax + 8]
mov byte [rax + 0x191], 1
mov rcx, qword [rsp + 0x2cb0]
call fcn.140013290
mov rcx, qword [rsp + 0x2cb0]
call fcn.140013230
mov ecx, 1
call fcn.14000d370
xor r8d, r8d
xor edx, edx
lea rcx, [0x140048c40]
call fcn.14001f790
mov dword [rsp + 0x50], eax
lea rcx, [rsp + 0x41]
call fcn.140015290
nop
call qword [sym.imp.sysn.dll_bool___cdecl_SYS_IsVistaOrHigher_void_]
movzx eax, al
test eax, eax
je 0x14001282c
xor r9d, r9d
mov r8d, 1
mov edx, 0xaf
lea rcx, [0x140048c40]
call fcn.1400220c0
movzx eax, byte [rsp + 0x158]
test eax, eax
jne 0x140012848
movzx eax, byte [rsp + 0x15a]
test eax, eax
je 0x140012a68
mov cl, 1
call fcn.1400137d0
movzx eax, word [0x14003309c]
mov word [rsp + 0xe70], ax
lea rax, [rsp + 0xe72]
mov rdi, rax
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
movzx eax, word [0x140032e00]
mov word [rsp + 0x1080], ax
lea rax, [rsp + 0x1082]
mov rdi, rax
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
lea r9, [rsp + 0x1080]
lea r8, [0x140032e08]
mov dx, 1
xor ecx, ecx
call qword [sym.imp.sysn.dll_REP_Repert]
lea r9, [rsp + 0xe70]
lea r8, [0x140032e20]
mov dx, 0xa
xor ecx, ecx
call qword [sym.imp.sysn.dll_REP_Repert]
mov qword [rsp + 0x80], 0
lea rdx, [rsp + 0x1080]
lea rcx, [rsp + 0xa8]
call fcn.140014ff0
nop
lea rdx, [rsp + 0xe70]
lea rcx, [rsp + 0xd0]
call fcn.140014ff0
nop
lea rcx, [rsp + 0xa8]
call fcn.140015fe0
lea rdx, [rsp + 0x80]
mov rcx, rax
call qword [sym.imp.OLEAUT32.dll_LoadRegTypeLib]
mov dword [rsp + 0x98], eax
cmp dword [rsp + 0x98], 0
jl 0x140012987
lea rcx, [rsp + 0xd0]
call fcn.140015fe0
mov qword [rsp + 0xf8], rax
lea rcx, [rsp + 0xa8]
call fcn.140015fe0
mov rcx, qword [rsp + 0xf8]
mov r8, rcx
mov rdx, rax
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.OLEAUT32.dll_QueryPathOfRegTypeLib]
mov rax, qword [rsp + 0x80]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x80]
call qword [rax + 0x10]
nop
lea r8, [rsp + 0xc8]
lea rdx, str.SOFTWAREMicrosoftWindowsHtml_Help
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov dword [rsp + 0x64], eax
cmp dword [rsp + 0x64], 0
jne 0x1400129fe
lea rcx, [rsp + 0xe70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0xe70]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.Robotom.chm
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x64], eax
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
jmp 0x140012a00
lea r9, [rsp + 0x1080]
lea r8, [0x140032ed8]
mov dx, 1
xor ecx, ecx
call qword [sym.imp.sysn.dll_REP_Repert]
mov dword [rsp + 0x28], 0xa
mov qword [rsp + 0x20], 0
lea r9, str._RegServer
lea r8, [rsp + 0x1080]
lea rdx, [0x140032f08]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
jmp 0x140012a4d
lea rcx, [rsp + 0xd0]
call fcn.1400094b0
nop
lea rcx, [rsp + 0xa8]
call fcn.1400094b0
mov dword [rsp + 0x4c], 0
lea rcx, [rsp + 0x41]
call fcn.140015cf0
cmp dword [rsp + 0x4c], 0
je 0x14001302e
mov rcx, qword [rsp + 0x2cb0]
call fcn.140013130
mov dword [rsp + 0x48], eax
cmp dword [rsp + 0x48], 0
je 0x140012fb2
mov rcx, qword [rsp + 0x2cb0]
call fcn.140013230
lea rdx, [0x14002d378]
mov rax, qword [rsp + 0x2cb0]
mov rcx, qword [rax + 0x10]
call fcn.140014390
movzx eax, al
test eax, eax
je 0x140012e51
call qword [sym.imp.sysn.dll_bool___cdecl_SYS_IsProcessElevated_void_]
movzx eax, al
test eax, eax
jne 0x140012cd8
lea rdx, [0x140032f60]
lea rcx, [rsp + 0x920]
call fcn.140015380
nop
lea rcx, [rsp + 0x920]
call fcn.140016000
mov r9d, 0x7d1
lea r8, [rsp + 0x1ce0]
mov edx, 0xa868
mov rcx, rax
call qword [sym.imp.USER32.dll_LoadStringW]
xor r8d, r8d
mov edx, 0x30
lea rcx, [rsp + 0x1ce0]
call sub.mfc140u.dll_AfxInitNetworkAddressControl
lea rcx, [rsp + 0x42]
call fcn.140015290
nop
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r8d, operator
lea rdx, [rsp + 0x1ad0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x140012cbb
mov r8d, 0x70
xor edx, edx
lea rcx, [rsp + 0x180]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x180], 0x70
mov dword [rsp + 0x184], 0x40
mov rax, qword [rsp + 0x2cb0]
cmp qword [rax + 8], 0
je 0x140012bd1
mov rax, qword [rsp + 0x2cb0]
mov rax, qword [rax + 8]
cmp qword [rax + 0x40], 0
je 0x140012bd1
mov rax, qword [rsp + 0x2cb0]
mov rax, qword [rax + 8]
mov rcx, qword [rax + 0x40]
call fcn.1400048e0
mov qword [rsp + 0x188], rax
lea rax, [0x140032f70]
mov qword [rsp + 0x190], rax
lea rax, [rsp + 0x1ad0]
mov qword [rsp + 0x198], rax
lea rax, [0x140032f80]
mov qword [rsp + 0x1a0], rax
mov qword [rsp + 0x1a8], 0
mov dword [rsp + 0x1b0], 0
lea rcx, [rsp + 0x180]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x140012c99
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x68], eax
cmp dword [rsp + 0x68], 0
je 0x140012c8f
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x20], rax
mov r9d, 0x400
mov r8d, dword [rsp + 0x68]
xor edx, edx
mov ecx, 0x1300
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0xd8]
call sub.mfc140u.dll_AfxInitNetworkAddressControl
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [rsp + 0x48], 0
jmp 0x140012cbb
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x1e8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x1e8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0x42]
call fcn.140015cf0
nop
lea rcx, [rsp + 0x920]
call fcn.140015d80
jmp 0x140012e51
mov ecx, 1
call fcn.14000d370
xor r8d, r8d
xor edx, edx
lea rcx, [0x140048c40]
call fcn.14001f790
mov dword [rsp + 0x50], eax
mov cl, 1
call fcn.1400137d0
movzx eax, word [0x140032e8c]
mov word [rsp + 0x18c0], ax
lea rax, [rsp + 0x18c2]
mov rdi, rax
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
movzx eax, word [0x140032ed4]
mov word [rsp + 0x16b0], ax
lea rax, [rsp + 0x16b2]
mov rdi, rax
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
lea r9, [rsp + 0x16b0]
lea r8, str.robotom.tlb
mov dx, 1
xor ecx, ecx
call qword [sym.imp.sysn.dll_REP_Repert]
lea r9, [rsp + 0x18c0]
lea r8, [0x140032f14]
mov dx, 0xa
xor ecx, ecx
call qword [sym.imp.sysn.dll_REP_Repert]
mov qword [rsp + 0x88], 0
lea rdx, [rsp + 0x16b0]
lea rcx, [rsp + 0xb0]
call fcn.140014ff0
nop
lea rdx, [rsp + 0x18c0]
lea rcx, [rsp + 0xe0]
call fcn.140014ff0
nop
lea rcx, [rsp + 0xb0]
call fcn.140015fe0
lea rdx, [rsp + 0x88]
mov rcx, rax
call qword [sym.imp.OLEAUT32.dll_LoadRegTypeLib]
mov dword [rsp + 0x9c], eax
cmp dword [rsp + 0x9c], 0
jl 0x140012e36
lea rcx, [rsp + 0xe0]
call fcn.140015fe0
mov qword [rsp + 0x100], rax
lea rcx, [rsp + 0xb0]
call fcn.140015fe0
mov rcx, qword [rsp + 0x100]
mov r8, rcx
mov rdx, rax
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.OLEAUT32.dll_QueryPathOfRegTypeLib]
mov rax, qword [rsp + 0x88]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x88]
call qword [rax + 0x10]
nop
lea rcx, [rsp + 0xe0]
call fcn.1400094b0
nop
lea rcx, [rsp + 0xb0]
call fcn.1400094b0
cmp dword [rsp + 0x48], 0
je 0x140012fb2
mov r8d, 1
mov edx, 0x14
lea rcx, [0x140048c40]
call fcn.14001f240
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jl 0x140012fb2
mov byte [0x140048c01], 1
mov qword [rsp + 0x58], 0
lea rdx, [rsp + 0x58]
xor ecx, ecx
call qword [sym.imp.ole32.dll_GetRunningObjectTable]
mov dword [rsp + 0x44], eax
cmp qword [rsp + 0x58], 0
je 0x140012f62
mov qword [rsp + 0x78], 0
lea rdx, [rsp + 0x78]
lea rcx, [0x14002d378]
call qword [sym.imp.ole32.dll_CreateClassMoniker]
mov dword [rsp + 0x44], eax
cmp qword [rsp + 0x78], 0
je 0x140012f52
mov qword [rsp + 0x70], 0
lea r9, [rsp + 0x70]
lea r8, [0x1400392f8]
lea rdx, [0x14002d378]
lea rcx, [0x140048c40]
call fcn.14001b4e0
cmp qword [rsp + 0x70], 0
je 0x140012f42
mov rax, qword [rsp + 0x58]
mov rax, qword [rax]
lea rcx, [0x140048c04]
mov qword [rsp + 0x20], rcx
mov r9, qword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
xor edx, edx
mov rcx, qword [rsp + 0x58]
call qword [rax + 0x18]
mov dword [rsp + 0x44], eax
mov rax, qword [rsp + 0x70]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x70]
call qword [rax + 0x10]
mov rax, qword [rsp + 0x78]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x78]
call qword [rax + 0x10]
mov rax, qword [rsp + 0x58]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x58]
call qword [rax + 0x10]
lea rcx, [rsp + 0x168]
call fcn.140009160
nop
mov dl, 1
lea rcx, [rsp + 0x168]
call fcn.1400209c0
call fcn.140009c40
cmp qword [rax + 0x40], 0
je 0x140012fa5
call fcn.140009c40
xor r9d, r9d
xor r8d, r8d
mov edx, AfxRegDeleteKey
mov rcx, qword [rax + 0x40]
call fcn.14001d9f0
nop
lea rcx, [rsp + 0x168]
call fcn.140009580
call fcn.140009c40
cmp qword [rax + 0x40], 0
je 0x140012fd7
call fcn.140009c40
xor r9d, r9d
xor r8d, r8d
mov edx, 0x9cd
mov rcx, qword [rax + 0x40]
call fcn.14001d9f0
mov rax, qword [rsp + 0x2cb0]
cmp qword [rax + 8], 0
je 0x14001300d
mov rax, qword [rsp + 0x2cb0]
mov rax, qword [rax + 8]
movzx eax, byte [rax + 0x178]
test eax, eax
je 0x14001300d
xor ecx, ecx
call qword [sym.imp.sysn.dll_bool___cdecl_COM_SetVisible_bool_]
xor ecx, ecx
call qword [sym.imp.sysn.dll_bool___cdecl_COM_EnableGui_bool_]
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0xa0], eax
lea rcx, [rsp + 0x110]
call fcn.140015e20
mov eax, dword [rsp + 0xa0]
jmp 0x140013054
mov byte [0x140048c00], 1
mov dword [rsp + 0xa4], 0
lea rcx, [rsp + 0x110]
call fcn.140015e20
mov eax, dword [rsp + 0xa4]
mov rcx, qword [rsp + 0x2c90]
xor rcx, rsp
call fcn.140023e10
add rsp, 0x2ca0
pop rdi
ret