Function at 0x14000c430
Capabilities:
Persist via com hijack
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xc0
mov rax, qword [0x140148020]
xor rax, rsp
mov qword [rbp + 0x4f], rax
mov rbx, rcx
lea rax, str.registerAddtionalAumiKeys
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xb9
lea r9, str.SetupToast::registerAddtionalAumiKeys
lea r8, str.D:_a1_sinstaller_cppPCManagerInstallerSetupSetupToast.cpp
mov edx, 4
mov rcx, qword [0x1401515f8]
call fcn.140080e40
xorps xmm0, xmm0
movups xmmword [rbp - 0x39], xmm0
xor edi, edi
mov qword [rbp - 0x29], rdi
mov qword [rbp - 0x21], rdi
lea r8d, [rdi + 0x26]
lea rdx, str.2355FF0C_CD74_421A_8631_57546E824C2D
lea rcx, [rbp - 0x39]
call fcn.140004fe0
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 9], xmm1
lea r8d, [rdi + 0xf]
lea rdx, str.CustomActivator
lea rcx, [rbp - 0x19]
call fcn.140004fe0
add rbx, 0x48
mov qword [rbp + 0x27], rdi
mov rdx, rbx
mov rcx, 0xffffffff80000001
call fcn.140085260
cmp qword [rbx + 0x18], 8
jb 0x14000c4f5
mov rbx, qword [rbx]
lea rax, [rbp + 0x27]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, rbx
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, 0xffffffff
test eax, eax
jne 0x14000c576
mov rax, qword [rbp - 0x29]
lea rax, [rax*2 + 2]
mov ecx, edi
cmp rax, rbx
cmovbe ecx, eax
lea rax, [rbp - 0x39]
cmp qword [rbp - 0x21], 8
cmovae rax, qword [rbp - 0x39]
lea rdx, [rbp - 0x19]
cmp qword [rbp - 1], 8
cmovae rdx, qword [rbp - 0x19]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov rcx, qword [rbp + 0x27]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x27]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rbp - 0x19]
call fcn.1400053f0
nop
lea rcx, [rbp - 0x39]
call fcn.1400053f0
mov r8, qword [0x140148f30]
add r8, 0x28
cmp qword [r8 + 0x18], 8
jb 0x14000c59e
mov r8, qword [r8]
lea rax, str.ToastActivated
mov qword [rsp + 0x28], rax
lea rax, str.edgeupdate_toast_notif
mov qword [rsp + 0x20], rax
lea r9, str.options
lea rdx, str.__s_____s_s___s
lea rcx, [rbp + 0x2f]
call fcn.1400838d0
nop
lea rdx, [rbp + 0x2f]
cmp qword [rbp + 0x47], 8
cmovae rdx, qword [rbp + 0x2f]
xorps xmm0, xmm0
movups xmmword [rbp - 0x39], xmm0
mov qword [rbp - 0x29], rdi
mov qword [rbp - 0x21], rdi
mov r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], 0
jne 0x14000c5f2
lea rcx, [rbp - 0x39]
call fcn.140004fe0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 7], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x17], xmm1
xor r8d, r8d
lea rdx, [0x14011205c]
lea rcx, [rbp + 7]
call fcn.140004fe0
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 9], xmm1
mov r8d, 0x4b
lea rdx, str.SoftwareClassesCLSID2355FF0C_CD74_421A_8631_57546E824C2DLocalServer32
lea rcx, [rbp - 0x19]
call fcn.140004fe0
mov qword [rbp + 0x27], rdi
lea rdx, [rbp - 0x19]
mov rcx, 0xffffffff80000001
call fcn.140085260
lea rdx, [rbp - 0x19]
cmp qword [rbp - 1], 8
cmovae rdx, qword [rbp - 0x19]
lea rax, [rbp + 0x27]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000c6e8
mov rax, qword [rbp - 0x29]
lea rax, [rax*2 + 2]
cmp rax, rbx
cmovbe edi, eax
lea rax, [rbp - 0x39]
cmp qword [rbp - 0x21], 8
cmovae rax, qword [rbp - 0x39]
lea rdx, [rbp + 7]
cmp qword [rbp + 0x1f], 8
cmovae rdx, qword [rbp + 7]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov rcx, qword [rbp + 0x27]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x27]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rbp - 0x19]
call fcn.1400053f0
nop
lea rcx, [rbp + 7]
call fcn.1400053f0
nop
lea rcx, [rbp - 0x39]
call fcn.1400053f0
nop
lea rcx, [rbp + 0x2f]
call fcn.1400053f0
mov al, 1
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.1400a24f0
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret