Function at 0x1400d01b0
Capabilities:
Persist via run registry key

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2d8
movaps xmmword [rsp + 0x2c0], xmm6
mov rdx, rcx
mov rax, qword [0x14025e040]
xor rax, rsp
mov qword [rsp + 0x2b8], rax
movaps xmm6, xmmword [0x14022f060]
lea rbx, [rsp + 0xf0]
movaps xmmword [rbx + 0x40], xmm6
movaps xmmword [rbx + 0x30], xmm6
movaps xmmword [rbx + 0x20], xmm6
movaps xmmword [rbx + 0x10], xmm6
movaps xmmword [rbx], xmm6
lea r14, [rsp + 0x140]
mov rcx, r14
call fcn.1400ce6e0
mov rcx, rbx
mov rdx, r14
call fcn.1400e7f30
mov rcx, r14
call fcn.14012d570
lea r15, [rsp + 0xc0]
movaps xmmword [r15 + 0x20], xmm6
movaps xmmword [r15 + 0x10], xmm6
movaps xmmword [r15], xmm6
call fcn.1400ce340
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x2a0], xmm0
mov ecx, 0x10
call fcn.140155818
lea rbp, [rsp + 0x270]
mov qword [rbp], rax
lea rcx, [rax + 0x10]
mov qword [rbp + 0x10], rcx
movaps xmm0, xmmword [rsp + 0x2a0]
movups xmmword [rax], xmm0
mov qword [rbp + 8], rcx
call fcn.1400ce2e0
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x290], xmm0
mov ecx, 0x10
call fcn.140155818
lea rsi, [rsp + 0xa8]
mov qword [rsi], rax
lea rcx, [rax + 0x10]
mov qword [rsi + 0x10], rcx
movaps xmm0, xmmword [rsp + 0x290]
movups xmmword [rax], xmm0
mov qword [rsi + 8], rcx
lea rdi, [rsp + 0x90]
mov rcx, rdi
call fcn.1400ce760
mov rcx, r14
xor edx, edx
call fcn.1400e7eb0
lea r12, [rsp + 0x78]
mov rcx, r12
call fcn.1400ce350
lea r13, [rsp + 0x60]
mov rcx, r13
call fcn.1400ce5a0
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rbx
mov rcx, r15
mov rdx, r13
mov r8, r12
mov r9d, 3
call fcn.140197f30
cmp byte [r13 + 0x17], 0
jns 0x1400d0326
mov rcx, qword [rsp + 0x60]
call fcn.140155854
cmp byte [rsp + 0x8f], 0
jns 0x1400d033a
mov rcx, qword [rsp + 0x78]
call fcn.140155854
lea rcx, [rsp + 0x140]
call fcn.1400e8510
cmp byte [rsp + 0xa7], 0
jns 0x1400d035e
mov rcx, qword [rsp + 0x90]
call fcn.140155854
mov rcx, qword [rsp + 0xa8]
test rcx, rcx
je 0x1400d0390
mov rax, qword [rsp + 0xb0]
cmp rax, rcx
je 0x1400d0383
add rax, 0xfffffffffffffff0
jne 0x1400d0373
jmp 0x1400d069c
mov qword [rsp + 0xb0], rcx
call fcn.140155854
mov rcx, qword [rsp + 0x270]
test rcx, rcx
je 0x1400d03c2
mov rax, qword [rsp + 0x278]
cmp rax, rcx
je 0x1400d03b5
add rax, 0xfffffffffffffff0
jne 0x1400d03a5
jmp 0x1400d069c
mov qword [rsp + 0x278], rcx
call fcn.140155854
lea r14, [rsp + 0xc0]
mov rcx, r14
mov dl, 1
call fcn.14019eb40
xor ebx, ebx
mov rcx, r14
xor edx, edx
call fcn.14019eb50
mov rcx, r14
call fcn.14019eae0
test al, al
je 0x1400d0420
lea rbx, [rsp + 0x140]
mov rcx, rbx
call fcn.1400ce5a0
mov rcx, rbx
call fcn.1400cfef0
mov ebp, eax
cmp byte [rbx + 0x17], 0
jns 0x1400d0419
mov rcx, qword [rsp + 0x140]
call fcn.140155854
test bpl, bpl
jne 0x1400d0479
xor ebx, ebx
lea rcx, [rsp + 0xc0]
call fcn.140197fd0
lea rcx, [rsp + 0xf0]
call fcn.1400e8510
mov rcx, qword [rsp + 0x2b8]
xor rcx, rsp
call fcn.140156d40
mov eax, ebx
movaps xmm6, xmmword [rsp + 0x2c0]
add rsp, 0x2d8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [rsp + 0xa8]
mov byte [rcx + 0x17], r14b
jmp 0x1400d0533
lea rax, str.interactive
lea rdx, [rsp + 0x50]
mov qword [rdx], rax
mov qword [rdx + 8], 0xb
lea rcx, [rsp + 0xf0]
call fcn.1400e90f0
mov rcx, rdi
call fcn.1400ce5a0
cmp byte [rsp + 0xa7], 0
jns 0x1400d04b7
mov rdi, qword [rsp + 0x90]
test rdi, rdi
je 0x1400d06c1
movabs r15, 0x7ffffffffffffff7
mov rcx, rdi
call fcn.140175a44
cmp rax, r15
ja 0x1400d06b4
mov r14, rax
cmp rax, 0xa
jbe 0x1400d0468
lea rax, [r15 + 5]
and rax, r14
add rax, 4
mov r12, r14
or r12, 3
cmp r12, 0xb
cmove r12, rax
inc r12
js 0x1400d06af
lea rcx, [r12 + r12]
call fcn.140155818
mov rcx, rax
mov qword [rsp + 0xa8], rax
lea rax, [r15 + r12]
add rax, 9
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0xb0], r14
lea r15, [rcx + r14*2]
cmp rcx, rdi
ja 0x1400d0545
cmp r15, rdi
ja 0x1400d06d4
test r14, r14
je 0x1400d0558
add r14, r14
mov rdx, rdi
mov r8, r14
call fcn.14018f480
mov word [r15], 0
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x270]
mov qword [rdi + 0x10], rax
movaps xmmword [rdi], xmm6
lea r8, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov rcx, rdi
mov rdx, 0xffffffff80000002
mov r9d, 0x20006
call fcn.1400d8f40
cmp qword [rdi], 0
je 0x1400d063d
lea rcx, [rsp + 0xf0]
mov rdx, rbx
call fcn.1400ea3e0
cmp byte [rsp + 0x157], 0
jns 0x1400d05bf
mov rbx, qword [rsp + 0x140]
cmp byte [rsp + 0xbf], 0
jns 0x1400d05d1
mov rsi, qword [rsp + 0xa8]
lea rcx, [rsp + 0x270]
mov rdx, rsi
mov r8, rbx
call fcn.1400d9760
cmp byte [rsp + 0x157], 0
jns 0x1400d05fb
mov rcx, qword [rsp + 0x140]
call fcn.140155854
lea rcx, [rsp + 0x270]
call fcn.1400d9140
cmp byte [rsp + 0xbf], 0
jns 0x1400d061f
mov rcx, qword [rsp + 0xa8]
call fcn.140155854
cmp byte [rsp + 0xa7], 0
jns 0x1400d0636
mov rcx, qword [rsp + 0x90]
call fcn.140155854
mov bl, 1
jmp 0x1400d0420
lea rcx, str....._brave_browser_brave_vpnwin_brave_vpn_wireguard_serviceinstall_utils.cc
mov edx, 0x4f
call fcn.14012cfd0
test eax, eax
jle 0x1400d05fb
lea rdx, str....._brave_browser_brave_vpnwin_brave_vpn_wireguard_serviceinstall_utils.cc
lea rsi, [rsp + 0x140]
mov rcx, rsi
mov r8d, 0x3a
mov r9d, 0xffffffff
call fcn.1400e3be0
lea rcx, [rsp + 0x150]
lea rdx, str.Failed_to_write_wireguard_service_to_startup
mov r8d, 0x2c
call fcn.140111880
mov rcx, rsi
call fcn.1400e41f0
jmp 0x1400d05fb
lea rcx, [0x140231db2]
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h:66:_assertion___loc___nullptr_failed:_null_pointer_given_to_destroy_at_n
call fcn.140194150
call fcn.140190760
lea rcx, [rsp + 0xa8]
call fcn.140190720
lea rcx, [0x140231db2]
lea rdx, str....._third_partylibc_srcinclude_string:973:_assertion___s___nullptr_failed:_basic_string_const_char__detected_nullptr_n
call fcn.140194150
lea rcx, [0x140231db2]
lea rdx, str....._third_partylibc_srcinclude__stringchar_traits.h:222:_assertion__std::__is_pointer_in_range___s1____s1____n____s2__failed:_char_traits::copy:_source_and_destination_ranges_overlap_n
call fcn.140194150
int3