Function at 0x180008780
Capabilities:
Get file size
Read file on windows
Set registry value
Terminate process

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x238
mov rax, qword [0x180076dc0]
xor rax, rsp
mov qword [rsp + 0x220], rax
mov r8d, 0x104
lea rdx, [rsp + 0x110]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0xffffffffffffffff
jne 0x1800087ff
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
xor edx, edx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x50], eax
mov byte [rsp + 0x8c], 0x25
mov byte [rsp + 0x8d], 0x26
mov byte [rsp + 0x8e], 0x24
mov byte [rsp + 0x8f], 0x36
mov byte [rsp + 0x90], 0x40
mov byte [rsp + 0x91], 0x3d
mov byte [rsp + 0x92], 0x2a
movsxd rax, dword [rsp + 0x50]
mov qword [rsp + 0x78], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, qword [rsp + 0x78]
mov r8, rcx
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x70], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x88]
mov r8d, dword [rsp + 0x50]
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_ReadFile]
movsxd rax, dword [rsp + 0x50]
mov r9d, 3
lea r8, [rsp + 0x8c]
mov rdx, rax
mov rcx, qword [rsp + 0x60]
call fcn.18000c6a0
mov qword [rsp + 0x68], rax
cmp qword [rsp + 0x68], 0
jne 0x1800088ed
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rsp + 0x60]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
xor r9d, r9d
mov r8d, 0x20
lea rdx, [rsp + 0x98]
mov rcx, qword [rsp + 0x240]
call fcn.18000beb0
mov dword [rsp + 0x54], 0x44
mov r8d, 0x20
lea rdx, [rsp + 0x98]
lea rcx, [rsp + 0xc0]
call fcn.18000a9f0
lea rax, [rsp + 0xe0]
mov r8d, 0x24
mov rdx, qword [rsp + 0x68]
mov rcx, rax
call fcn.18000a9f0
nop
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, [0x18005f680]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1800089c9
mov qword [rsp + 0x40], 0
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SOFTWAREJDBCC
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x1800089c9
xor eax, eax
jmp 0x180008a25
mov eax, dword [rsp + 0x54]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x20], rax
mov r9d, 3
xor r8d, r8d
lea rdx, str.data
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x180008a12
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x180008a25
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.18003c9d0
add rsp, 0x238
ret