Function at 0x1400075e0
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x800]
sub rsp, 0x900
mov rax, qword [0x140144038]
xor rax, rsp
mov qword [rbp + 0x7f0], rax
xor r14d, r14d
lea r8, [rcx + 0x28]
cmp qword [r8 + 0x18], 8
jb 0x140007625
mov r8, qword [r8]
lea rdx, str.__s____optionsedgeupdate_runonce
lea rcx, [rbp - 0x60]
call fcn.140084a80
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x80], xmm1
mov r8d, 0x12
lea rdx, str.WindowsMasterSetup
lea rcx, [rsp + 0x70]
call fcn.1400049c0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
mov r8d, gethostbyname
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
lea rcx, [rsp + 0x30]
call fcn.1400049c0
mov qword [rbp - 0x70], r14
lea rdx, [rsp + 0x30]
call fcn.140086300
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rdx, qword [rsp + 0x30]
lea rax, [rbp - 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
mov r15d, 0xffffffff
test eax, eax
jne 0x140007729
mov rcx, qword [rbp - 0x50]
lea rcx, [rcx*2 + 2]
mov r8d, r14d
cmp rcx, r15
cmovbe r8d, ecx
lea rcx, [rbp - 0x60]
cmp qword [rbp - 0x48], 8
cmovae rcx, qword [rbp - 0x60]
lea rdx, [rsp + 0x70]
cmp qword [rbp - 0x78], 8
cmovae rdx, qword [rsp + 0x70]
mov dword [rsp + 0x28], r8d
mov qword [rsp + 0x20], rcx
lea r9d, [rax + 1]
xor r8d, r8d
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
sete sil
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x140007771
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000776c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140007ca2
call fcn.1400a2410
movdqa xmm0, xmmword [0x140128f10]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x30], r14w
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x1400077c6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400077c1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140007ca8
call fcn.1400a2410
lea rcx, [rbp - 0x68]
call fcn.1400b58b0
mov rdx, qword [rbp - 0x68]
lea rcx, [rsp + 0x70]
call fcn.140008f80
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
mov r8d, 0x15
lea rdx, str.WriteRunOnceTimestamp
lea rcx, [rsp + 0x50]
call fcn.1400049c0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
mov r8d, 0x20
lea rdx, str.SoftwareWOW6432NodeMSPCManager
lea rcx, [rsp + 0x30]
call fcn.1400049c0
mov qword [rbp - 0x70], r14
lea rdx, [rsp + 0x30]
call fcn.140086300
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rdx, qword [rsp + 0x30]
lea rax, [rbp - 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test eax, eax
jne 0x1400078cd
mov rcx, qword [rbx + 0x10]
lea rcx, [rcx*2 + 2]
mov r8d, r14d
cmp rcx, r15
cmovbe r8d, ecx
cmp qword [rbx + 0x18], 8
jb 0x140007895
mov rbx, qword [rbx]
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rdx, qword [rsp + 0x50]
mov dword [rsp + 0x28], r8d
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
sete dil
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x140007915
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007910
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140007cae
call fcn.1400a2410
movdqa xmm0, xmmword [0x140128f10]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x30], r14w
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x14000796b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007966
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140007cb4
call fcn.1400a2410
movdqa xmm0, xmmword [0x140128f10]
movdqu xmmword [rsp + 0x60], xmm0
mov word [rsp + 0x50], r14w
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x1400079c0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400079bb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140007cba
call fcn.1400a2410
lea rcx, [rbp - 0x68]
call fcn.1400b58b0
lea rdx, [rbp - 0x68]
lea rcx, [rbp - 0x40]
call fcn.1400b5c08
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp - 0x10]
call fcn.1400a5140
lea r9, [rbp - 0x40]
lea r8, str._Y__m__d__I:_M:_S
mov edx, 0x400
lea rcx, [rbp - 0x10]
call fcn.1400b7f0c
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x80], xmm1
lea rax, [rbp - 0x10]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140007a20
lea rdx, [rbp - 0x10]
lea rcx, [rsp + 0x70]
call fcn.1400049c0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
mov r8d, 0x16
lea rdx, str.WriteRunOnceTimeString
lea rcx, [rsp + 0x50]
call fcn.1400049c0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
mov r8d, 0x20
lea rdx, str.SoftwareWOW6432NodeMSPCManager
lea rcx, [rsp + 0x30]
call fcn.1400049c0
mov qword [rbp - 0x70], r14
lea rdx, [rsp + 0x30]
call fcn.140086300
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rdx, qword [rsp + 0x30]
lea rax, [rbp - 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
jne 0x140007b2b
mov rcx, qword [rbp - 0x80]
lea rcx, [rcx*2 + 2]
mov r8d, r14d
cmp rcx, r15
cmovbe r8d, ecx
lea rcx, [rsp + 0x70]
cmp qword [rbp - 0x78], 8
cmovae rcx, qword [rsp + 0x70]
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rdx, qword [rsp + 0x50]
mov dword [rsp + 0x28], r8d
mov qword [rsp + 0x20], rcx
lea r9d, [rax + 1]
xor r8d, r8d
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
sete bl
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x140007b72
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007b6d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140007cc0
call fcn.1400a2410
movdqa xmm0, xmmword [0x140128f10]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x30], r14w
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x140007bc8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007bc3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140007cc6
call fcn.1400a2410
movdqa xmm0, xmmword [0x140128f10]
movdqu xmmword [rsp + 0x60], xmm0
mov word [rsp + 0x50], r14w
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x140007c1d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007c18
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140007ccc
call fcn.1400a2410
test sil, sil
je 0x140007c2f
test dil, dil
je 0x140007c2f
test bl, bl
je 0x140007c2f
mov bl, 1
jmp 0x140007c31
xor bl, bl
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x140007c6d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007c68
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140007c9c
call fcn.1400a2410
movzx eax, bl
mov rcx, qword [rbp + 0x7f0]
xor rcx, rsp
call fcn.1400a23f0
lea r11, [rsp + 0x900]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.1400a92b0
nop
call fcn.1400a92b0
nop
call fcn.1400a92b0
nop
call fcn.1400a92b0
nop
call fcn.1400a92b0
nop
call fcn.1400a92b0
nop
call fcn.1400a92b0
nop
call fcn.1400a92b0
nop
call fcn.1400a92b0
int3