Function at 0x14001f97c
Capabilities:
Persist via run registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x170]
sub rsp, 0x270
mov rax, qword [0x1400d7c88]
xor rax, rsp
mov qword [rbp + 0x160], rax
lea rax, str.SoftwareMicrosoftWindowsCurrentVersionExplorerDiscardablePostSetupComponent_Categories
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x28], rax
lea rax, str.SoftwareMicrosoftWindowsCurrentVersionExplorerDiscardablePostSetupComponent_Categories64
mov qword [rsp + 0x38], rax
lea rax, str.SoftwareClassesShellExContextMenuHandlersEPP
mov qword [rsp + 0x48], rax
lea rax, str.SoftwareClassesDriveShellExContextMenuHandlersEPP
mov qword [rsp + 0x58], rax
lea rax, str.SoftwareClassesDirectoryShellExContextMenuHandlersEPP
mov qword [rsp + 0x68], rax
lea rax, str.SoftwareClassesAPPID2781761E_28E2_4109_99FE_B9D127C57AFE
mov qword [rsp + 0x78], rax
lea rax, str.SoftwareClassesAPPIDA79DB36D_6218_48e6_9EC9_DCBA9A39BF0F
mov qword [rbp - 0x78], rax
lea rax, str.SoftwareClassesAPPIDFDA74D11_C4A6_4577_9F73_D7CA8586E10D
mov qword [rbp - 0x68], rax
lea rax, str.SoftwareClassesCLSID2781761E_28E0_4109_99FE_B9D127C57AFE
mov qword [rbp - 0x58], rax
lea rax, str.SoftwareClassesCLSID2781761E_28E1_4109_99FE_B9D127C57AFE
mov qword [rbp - 0x48], rax
lea rax, str.SoftwareClassesCLSID2781761E_28E2_4109_99FE_B9D127C57AFE
mov qword [rbp - 0x38], rax
lea rax, str.SoftwareClassesCLSIDA2D75874_6750_4931_94C1_C99D3BC9D0C7
mov qword [rbp - 0x28], rax
lea rax, str.SoftwareClassesCLSID195B4D07_3DE2_4744_BBF2_D90121AE785B
mov qword [rbp - 0x18], rax
lea rax, str.SoftwareClassesCLSID09A47860_11B0_4DA5_AFA5_26D86198A780
mov qword [rbp - 8], rax
lea rax, str.SoftwareClassesCLSID361290c0_cb1b_49ae_9f3e_ba1cbe5dab35
mov qword [rbp + 8], rax
lea rax, str.SoftwareClassesCLSIDDACA056E_216A_4FD1_84A6_C306A017ECEC
mov qword [rbp + 0x18], rax
lea rax, str.SoftwareClassesCLSID8a696d12_576b_422e_9712_01b9dd84b446
mov qword [rbp + 0x28], rax
lea rax, str.SoftwareClassesCLSIDFDA74D11_C4A6_4577_9F73_D7CA8586E10D
mov qword [rbp + 0x38], rax
lea rax, str.SoftwareClassesCLSID13F6A0B6_57AF_4BA7_ACAA_614BC89CA9D8
mov qword [rbp + 0x48], rax
lea rax, str.SoftwareClassesCLSID94F35585_C5D7_4D95_BA71_A745AE76E2E2
mov qword [rbp + 0x58], rax
lea rax, str.SoftwareClassesCLSIDA7C452EF_8E9F_42EB_9F2B_245613CA0DC9
mov qword [rbp + 0x68], rax
lea rax, str.SoftwareClassesTypeLib8C389764_F036_48F2_9AE2_88C260DCF43B
mov qword [rbp + 0x78], rax
lea rax, str.SoftwareMicrosoftAMSI
mov qword [rbp + 0x88], rax
lea rax, str.SoftwareMicrosoftInternet_ExplorerExtension_Validation
mov qword [rbp + 0x98], rax
lea rax, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov qword [rbp + 0xa8], rax
lea rax, str.SoftwareMicrosoftWindowsCurrentVersionWindowsUpdate
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x30], rcx
mov rcx, 0xffffffff80000002
mov qword [rbp + 0xb8], rax
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x70], rcx
mov qword [rbp - 0x80], rcx
mov qword [rbp - 0x70], rcx
mov qword [rbp - 0x60], rcx
mov qword [rbp - 0x50], rcx
mov qword [rbp - 0x40], rcx
mov qword [rbp - 0x30], rcx
mov qword [rbp - 0x20], rcx
mov qword [rbp - 0x10], rcx
mov qword [rbp], rcx
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x30], rcx
mov qword [rbp + 0x40], rcx
mov qword [rbp + 0x50], rcx
mov qword [rbp + 0x60], rcx
mov qword [rbp + 0x70], rcx
mov qword [rbp + 0x80], rcx
mov qword [rbp + 0x90], rcx
mov qword [rbp + 0xa0], rcx
mov qword [rbp + 0xb0], rcx
mov qword [rbp + 0xc0], rcx
lea rax, str.SoftwarePoliciesMicrosoftWindowsWindowsUpdate
mov qword [rbp + 0xd0], rcx
mov qword [rbp + 0xc8], rax
lea rbx, [rsp + 0x20]
lea rax, str.SystemCurrentControlSetControlWMIAutoLoggerDefenderAuditLogger
mov qword [rbp + 0xe0], rcx
mov qword [rbp + 0xd8], rax
xor edi, edi
lea rax, str.SystemCurrentControlSetControlWMIAutoLoggerDefenderApiLogger
mov qword [rbp + 0xf0], rcx
mov qword [rbp + 0xe8], rax
lea rax, str.SYSTEMCurrentControlSetServicesWdf01000
mov qword [rbp + 0xf8], rax
lea rax, str.SoftwareWow6432NodeClassesAPPID2781761E_28E2_4109_99FE_B9D127C57AFE
mov qword [rbp + 0x108], rax
lea rax, str.SoftwareWow6432NodeClassesCLSID2781761E_28E0_4109_99FE_B9D127C57AFE
mov qword [rbp + 0x118], rax
lea rax, str.SoftwareWow6432NodeClassesCLSID2781761E_28E1_4109_99FE_B9D127C57AFE
mov qword [rbp + 0x128], rax
lea rax, str.SoftwareWow6432NodeClassesCLSID2781761E_28E2_4109_99FE_B9D127C57AFE
mov qword [rbp + 0x138], rax
lea rax, str.SoftwareWow6432NodeMicrosoftAMSI
mov qword [rbp + 0x148], rax
lea rax, str.SoftwareWow6432NodeMicrosoftInternet_ExplorerExtension_Validation
mov qword [rbp + 0x158], rax
mov qword [rbp + 0x100], rcx
mov qword [rbp + 0x110], rcx
mov qword [rbp + 0x120], rcx
mov qword [rbp + 0x130], rcx
mov qword [rbp + 0x140], rcx
mov qword [rbp + 0x150], rcx
mov rdx, qword [rbx + 8]
or r8d, 0xffffffff
mov rcx, qword [rbx]
call fcn.140025c8c
lea rcx, str.___________________n
call fcn.140077ed0
inc edi
lea rbx, [rbx + 0x10]
cmp edi, 0x24
jb 0x14001fc38
mov rcx, qword [rbp + 0x160]
xor rcx, rsp
call fcn.140083d20
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret