Function at 0x14005c210
Capabilities:
Check if file exists
Create process on windows
Enumerate process modules
Enumerate threads
Query or enumerate registry value
Suspend thread
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x990
mov rax, qword [0x14018d030]
xor rax, rsp
mov qword [rsp + 0x980], rax
mov rbx, rdx
mov qword [rsp + 0x68], rdx
mov r15, rcx
mov qword [rsp + 0x78], rcx
lea rcx, [0x140194bd8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x1401949b8], 0
jne 0x14005c9cf
mov r12d, 1
mov dword [0x1401949b8], r12d
mov rax, qword [0x1401948a0]
test rax, rax
je 0x14005c29f
mov rcx, r15
call rax
test eax, eax
je 0x14005c29f
lea rcx, [0x140194bd8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea eax, [r12 - 2]
jmp 0x14005c9d1
mov rax, qword [0x140194898]
test rax, rax
je 0x14005c2ad
call rax
mov byte [rsp + 0x50], 0
xor esi, esi
mov dword [rsp + 0x58], esi
mov rax, qword [0x140194998]
test rax, rax
je 0x14005c3c4
mov dword [rsp + 0x54], esi
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x54]
lea ecx, [rsi + 2]
call rax
test eax, eax
js 0x14005c3c4
cmp dword [rsp + 0x54], r12d
jne 0x14005c3c4
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, eax
test eax, eax
jne 0x14005c302
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r13d, eax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x124], xmm0
mov qword [rsp + 0x134], rsi
mov dword [rsp + 0x120], 0x1c
xor edx, edx
lea ecx, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r14, rax
test rax, rax
je 0x14005c3b0
lea rdx, [rsp + 0x120]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x14005c3a7
cmp edi, dword [rsp + 0x12c]
jne 0x14005c38d
mov r8d, dword [rsp + 0x128]
cmp r13d, r8d
je 0x14005c38d
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rbx, rax
test rax, rax
je 0x14005c38d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x120]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x14005c352
mov rbx, qword [rsp + 0x68]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [0x1401949a0]
test rax, rax
je 0x14005c3c4
mov edx, dword [rsp + 0x58]
xor ecx, ecx
call rax
call fcn.140001000
mov rdx, qword [0x140194bd0]
mov qword [rdx + 0x28], rax
mov qword [rdx + 0x5b0], r15
mov rax, qword [r15]
movups xmm0, xmmword [rax]
movups xmmword [rdx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rdx + 0x60], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rdx + 0x70], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rdx + 0x80], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rdx + 0x90], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rdx + 0xa0], xmm0
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rdx + 0xb0], xmm1
movups xmm0, xmmword [rax + 0x80]
movups xmmword [rdx + 0xc0], xmm0
movsd xmm1, qword [rax + 0x90]
movsd qword [rdx + 0xd0], xmm1
mov rax, qword [r15 + 8]
lea rcx, [rdx + 0xe0]
mov r8d, 9
nop dword [rax + rax]
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub r8, r12
jne 0x14005c460
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
mov qword [rdx + 0x874], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov rcx, qword [0x140194bd0]
mov dword [rcx + 0x20], eax
test byte [rcx + 4], 4
je 0x14005c4f8
mov eax, esi
jmp 0x14005c505
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [0x140194bd0]
mov dword [rcx + 0x880], eax
mov ebx, esi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x90], 0x18
mov qword [rsp + 0x98], rsi
mov dword [rsp + 0xa0], r12d
xor r9d, r9d
xor r8d, r8d
mov edx, r12d
lea rcx, [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov r14, rax
mov qword [rsp + 0x68], rax
test rax, rax
je 0x14005c580
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], esi
lea r9, [rsp + 0x70]
mov rcx, qword [rsp + 0x70]
mov r8, rcx
mov rdx, rcx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov ebx, eax
lea rdi, [0x1401949c0]
test ebx, ebx
je 0x14005c6ab
cmp word [0x1401949c0], si
je 0x14005c5a5
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x14005c5c7
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rdi
mov r9d, 0x105
xor r8d, r8d
lea rdx, str.BugReport.exe
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SearchPathW]
cmp word [0x1401949c0], si
je 0x14005c5e1
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x14005c6ab
xor edx, edx
mov r8d, 0x20a
lea rcx, [rsp + 0x580]
call fcn.140130762
mov qword [rsp + 0x60], rsi
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWARETencentMobileGamePCAppMarket
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14005c681
mov dword [rsp + 0x54], 0x104
lea rax, [rsp + 0x54]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x580]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.InstallPath
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14005c676
mov edx, dword [rsp + 0x54]
lea r8, [rsp + 0x580]
mov rcx, rdi
call qword [0x1401381b0]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r8, [0x140161698]
mov edx, 0x104
mov rcx, rdi
call qword [0x1401381b8]
lea r8, str.BugReport.exe
mov edx, 0x104
mov rcx, rdi
call qword [0x1401381b8]
test r14, r14
je 0x14005c99a
test ebx, ebx
je 0x14005c98c
cmp word [0x1401949c0], si
je 0x14005c98c
mov qword [rsp + 0x88], rsi
call fcn.14005c030
mov qword [rsp + 0x88], rax
jmp 0x14005c6f7
mov rax, qword [0x140194bd0]
test byte [rax + 4], 0x10
je 0x14005c7e0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x140], 0x438
lea rdx, [rsp + 0x140]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x14005c7be
nop dword [rax]
nop word [rax + rax]
lea rcx, [rsp + 0x170]
call qword [0x1401381c0]
lea rcx, [rsp + 0x170]
call fcn.14005b2e0
test eax, eax
jne 0x14005c78b
mov edx, dword [rsp + 0x160]
lea r8, [rsp + 0x370]
mov rcx, qword [rsp + 0x168]
call fcn.14005bb00
jmp 0x14005c7a9
lea rdx, [rsp + 0x140]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x14005c750
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14005c7e0
test r15, r15
je 0x14005c80d
mov edx, 0x10
mov rcx, r15
call fcn.14005b1e0
mov edx, 0x98
mov rcx, qword [r15]
call fcn.14005b1e0
mov edx, 0x4d0
mov rcx, qword [r15 + 8]
call fcn.14005b1e0
xor edx, edx
mov r8d, 0x400
lea rcx, [rsp + 0x580]
call fcn.140130762
mov rbx, qword [0x1401948a8]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x38], eax
mov rax, qword [0x140194bd0]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
mov r9, rdi
lea r8, str.__s___buginfo:_p:_p:_p:_lu__extinfo:_p
mov edx, 0x200
lea rcx, [rsp + 0x580]
call fcn.14005aca0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x120], xmm0
mov qword [rsp + 0x130], rax
mov dword [rsp + 0xb0], 0x68
movups xmmword [rsp + 0xb8], xmm0
movups xmmword [rsp + 0xc8], xmm0
movups xmmword [rsp + 0xd8], xmm0
movups xmmword [rsp + 0xe8], xmm0
movups xmmword [rsp + 0xf8], xmm0
movups xmmword [rsp + 0x108], xmm0
mov dword [rsp + 0xec], r12d
mov word [rsp + 0xf0], r12w
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
lea rax, [rsp + 0x120]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x580]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x14005c979
mov rax, qword [rsp + 0x120]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], r14
mov r9d, 0xffffffff
xor r8d, r8d
lea rdx, [rsp + 0x78]
lea ecx, [r8 + 2]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
movzx ecx, byte [rsp + 0x50]
cmp eax, 1
cmove ecx, r12d
mov byte [rsp + 0x50], cl
mov rcx, qword [rsp + 0x120]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x128]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x14005c98c
call qword [0x140138020]
test r14, r14
je 0x14005c99a
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [0x140194890]
test rax, rax
je 0x14005c9a8
call rax
cmp byte [rsp + 0x50], 0
jne 0x14005c9b9
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
jmp 0x14005c9cf
mov rax, qword [r15]
mov ebx, dword [rax]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, ebx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
xor eax, eax
mov rcx, qword [rsp + 0x980]
xor rcx, rsp
call fcn.14012f1f0
lea r11, [rsp + 0x990]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret