Function at 0x1400017d0
Capabilities:
Create process on windows
Persist via run registry key
Set registry value

Disassembly:
push rbp
push rsi
lea rbp, [rsp - 0x268]
sub rsp, 0x368
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x240], rax
lea rdx, str.MyLiveWallpaperApp
lea rcx, [rbp + 0x10]
call fcn.140001e50
mov r8d, 0x104
lea rdx, [rbp + 0x30]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x140001915
lea rdx, [rbp + 0x30]
lea rcx, [rbp - 0x28]
call fcn.140001e50
lea rcx, [rbp + 0x10]
call fcn.140001620
test al, al
jne 0x140001848
lea rdx, [rbp - 0x28]
lea rcx, [rbp + 0x10]
call fcn.1400012a0
test al, al
je 0x1400018c6
lea rax, [rbp - 0x70]
mov r9d, 2
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400018c6
cmp qword [rbp - 0x10], 7
lea rcx, [rbp - 0x28]
mov eax, dword [rbp - 0x18]
lea rdx, [rbp + 0x10]
cmova rcx, qword [rbp - 0x28]
mov r9d, 1
cmp qword [rbp + 0x28], 7
cmova rdx, qword [rbp + 0x10]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp - 0x70]
test eax, eax
je 0x14000195f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbp - 0x10]
cmp rdx, 7
jbe 0x140001902
mov rcx, qword [rbp - 0x28]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400018fd
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001958
call fcn.14000277c
movdqa xmm0, xmmword [0x140004580]
xor esi, esi
movdqu xmmword [rbp - 0x18], xmm0
mov word [rbp - 0x28], si
mov rdx, qword [rbp + 0x28]
cmp rdx, 7
jbe 0x140001dc1
mov rcx, qword [rbp + 0x10]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001dbc
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001dbc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov qword [rsp + 0x380], rbx
mov qword [rsp + 0x388], rdi
mov qword [rsp + 0x390], r12
mov qword [rsp + 0x360], r13
mov qword [rsp + 0x358], r14
mov qword [rsp + 0x350], r15
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
mov qword [rsp + 0x38], rsi
lea ecx, [rsi + 0x20]
call fcn.140002670
movups xmm1, xmmword [str.https:__example.com_photo1.jpg]
mov qword [rsp + 0x30], rax
movdqa xmm0, xmmword [0x140004590]
movdqa xmmword [rsp + 0x40], xmm0
movups xmmword [rax], xmm1
movsd xmm0, qword [0x140004528]
movsd qword [rax + 0x10], xmm0
xorps xmm0, xmm0
mov ecx, dword [0x140004530]
mov dword [rax + 0x18], ecx
movzx ecx, word [0x140004534]
mov word [rax + 0x1c], cx
lea ecx, [rsi + 0x20]
mov byte [rax + 0x1e], sil
movups xmmword [rsp + 0x50], xmm0
call fcn.140002670
movups xmm1, xmmword [str.https:__example.com_photo2.jpg]
mov qword [rsp + 0x50], rax
movdqa xmm0, xmmword [0x140004590]
movdqa xmmword [rsp + 0x60], xmm0
movups xmmword [rax], xmm1
movsd xmm0, qword [0x140004548]
movsd qword [rax + 0x10], xmm0
xorps xmm0, xmm0
mov ecx, dword [0x140004550]
mov dword [rax + 0x18], ecx
movzx ecx, word [0x140004554]
mov word [rax + 0x1c], cx
lea ecx, [rsi + 0x20]
mov byte [rax + 0x1e], sil
movups xmmword [rsp + 0x70], xmm0
call fcn.140002670
movups xmm1, xmmword [str.https:__example.com_photo3.jpg]
mov qword [rsp + 0x70], rax
movdqa xmm0, xmmword [0x140004590]
movdqa xmmword [rbp - 0x80], xmm0
movups xmmword [rax], xmm1
movsd xmm0, qword [0x140004568]
movsd qword [rax + 0x10], xmm0
mov ecx, dword [0x140004570]
mov dword [rax + 0x18], ecx
movzx ecx, word [0x140004574]
mov word [rax + 0x1c], cx
lea ecx, [rsi + 0x60]
mov byte [rax + 0x1e], sil
call fcn.140002670
mov rdi, rax
mov qword [rbp - 8], rax
lea rbx, [rsp + 0x30]
lea rcx, [rax + 0x60]
mov qword [rbp + 8], rcx
mov rdx, rbx
mov rcx, rdi
call fcn.140002000
lea rax, [rbp - 0x70]
add rdi, 0x20
add rbx, 0x20
cmp rbx, rax
jne 0x140001aa5
mov rdx, rdi
mov rcx, rdi
call fcn.1400023d0
mov edx, 0x20
mov qword [rbp], rdi
lea r9, [0x140001fa0]
lea rcx, [rsp + 0x30]
lea r8d, [rdx - 0x1d]
call fcn.1400026ac
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
movabs r13, 0x7fffffffffffffff
movabs r14, 0xb2f4fc0794908cf3
movabs r15, 0x4e94914f0000
movabs r12, 0x431bde82d7b634db
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x34f3fa1b
imul r8d
sar edx, 0xb
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x26ad
sub r8d, ecx
lea rcx, [rbp - 0x70]
add r8d, 0x384
movsxd rbx, r8d
call fcn.140001000
mov rdi, qword [rbp - 0x70]
test rbx, rbx
jle 0x140001b84
imul rax, rbx, 0x3b9aca00
imul rdx, rbx, 0x3b9aca00
mov rcx, r13
sub rcx, rax
cmp rdi, rcx
jge 0x140001b81
add rdi, rdx
jmp 0x140001b84
mov rdi, r13
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
mov rcx, rax
cmp rbx, 0x989680
jne 0x140001ba5
imul rax, rcx, 0x64
jmp 0x140001c16
cmp rbx, 0x16e3600
jne 0x140001bf8
mov rax, r14
imul rcx
lea r9, [rcx + rdx]
sar r9, 0x18
mov rax, r9
shr rax, 0x3f
add r9, rax
imul rax, r9, 0x16e3600
sub rcx, rax
mov rax, r14
imul r8, rcx, 0x3b9aca00
imul r8
lea rax, [r8 + rdx]
sar rax, 0x18
mov rcx, rax
shr rcx, 0x3f
add rax, rcx
imul rcx, r9, 0x3b9aca00
jmp 0x140001c13
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
imul rcx, rcx, 0x3b9aca00
add rax, rcx
cmp rax, rdi
jge 0x140001c64
mov rcx, rdi
sub rcx, rax
cmp rcx, r15
jl 0x140001c35
mov ecx, 0x5265c00
call sub.KERNEL32.dll_Sleep
jmp 0x140001b84
mov rax, r12
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x140001c58
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
jmp 0x140001b84
mov rbx, qword [rbp]
sub rbx, qword [rbp - 8]
sar rbx, 5
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
xor edx, edx
cdqe
lea rcx, [rbp - 0x48]
div rbx
shl rdx, 5
add rdx, qword [rbp - 8]
call fcn.140002000
cmp qword [rbp - 0x30], 0xf
lea r8, [rbp - 0x48]
mov r9d, dword [rbp - 0x38]
mov ecx, 0xfde9
cmova r8, qword [rbp - 0x48]
xor edx, edx
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xorps xmm0, xmm0
mov qword [rbp - 0x58], rsi
movsxd rbx, eax
lea rcx, [rbp - 0x68]
mov r8, rbx
mov qword [rbp - 0x50], rsi
movups xmmword [rbp - 0x68], xmm0
call fcn.1400022a0
cmp qword [rbp - 0x50], 7
lea rcx, [rbp - 0x68]
mov r9d, dword [rbp - 0x38]
lea r8, [rbp - 0x48]
cmova rcx, qword [rbp - 0x68]
cmp qword [rbp - 0x30], 0xf
mov dword [rsp + 0x28], ebx
cmova r8, qword [rbp - 0x48]
xor edx, edx
mov qword [rsp + 0x20], rcx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp qword [rbp - 0x50], 7
lea r8, [rbp - 0x68]
mov dword [rsp + 0x28], 1
cmova r8, qword [rbp - 0x68]
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rdx, qword [rbp - 0x50]
cmp rdx, 7
jbe 0x140001d6e
mov rcx, qword [rbp - 0x68]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001d69
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001dae
call fcn.14000277c
mov rdx, qword [rbp - 0x30]
cmp rdx, 0xf
jbe 0x140001b23
mov rcx, qword [rbp - 0x48]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001da4
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001db5
call fcn.14000277c
jmp 0x140001b23
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000277c
mov eax, 1
mov rcx, qword [rbp + 0x240]
xor rcx, rsp
call fcn.140002650
add rsp, 0x368
pop rsi
pop rbp
ret