Function at 0x180099898
Capabilities:
Persist via run registry key
Persist via winlogon helper dll registry key

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
push rdi
push r12
push r15
sub rsp, 0x110
mov r15, rcx
xor r12d, r12d
mov sil, r12b
mov byte [rsp + 0x138], r12b
lea rcx, [rax - 0x40]
call fcn.18001002c
nop
lea rcx, [rsp + 0x60]
call fcn.18000d560
nop
mov rdx, rax
lea rcx, [rsp + 0xe8]
call fcn.18000d6ac
mov dil, al
mov rdx, qword [rsp + 0x80]
mov ebx, 0x1000
cmp rdx, 0x10
jb 0x180099929
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, rbx
jb 0x180099924
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18009a00b
call fcn.18009d1f4
test dil, dil
je 0x180099fa5
mov r8d, 0x200
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0xe8]
call fcn.18000d88c
nop
mov r9b, 1
lea r8, str.DisplayName
lea rdx, [rsp + 0xb8]
mov rcx, rax
call fcn.18000e1c4
nop
mov rcx, rax
call fcn.18000de58
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x40], r12b
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.180003104
nop
mov rdx, qword [rsp + 0xd8]
cmp rdx, 0x10
jb 0x1800999d3
inc rdx
mov rcx, qword [rsp + 0xc0]
mov rax, rcx
cmp rdx, rbx
jb 0x1800999ce
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18009a011
call fcn.18009d1f4
movdqa xmm0, xmmword [0x1800ebed0]
movdqu xmmword [rsp + 0xd0], xmm0
mov byte [rsp + 0xc0], r12b
lea rcx, [rsp + 0x60]
call fcn.18000e078
lea rcx, [rsp + 0x90]
call fcn.18000d560
nop
call fcn.18000cdc4
mov rcx, qword [rsp + 0x50]
test eax, eax
movabs rax, 0x7fffffffffffffff
je 0x180099b4d
sub rax, rcx
cmp rax, 0x49
jb 0x18009a017
lea rax, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rax, qword [rsp + 0x40]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x49
lea r9, str.SoftwareWow6432NodeMicrosoftWindows_NTCurrentVersionWinlogonNotify_
lea r8, [rsp + 0x40]
mov dl, byte [rsp + 0x138]
lea rcx, [rsp + 0xb8]
call fcn.1800090dc
nop
lea r8, [rsp + 0xb8]
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x60]
call fcn.18000d618
mov rcx, qword [rax]
mov qword [rsp + 0x90], rcx
lea rdx, [rax + 8]
lea rax, [rsp + 0x98]
cmp rax, rdx
je 0x180099ab7
mov r8b, r12b
lea rcx, [rsp + 0x98]
call fcn.180007418
mov rdx, qword [rsp + 0x80]
cmp rdx, 0x10
jb 0x180099af3
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, rbx
jb 0x180099aee
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18009a01d
call fcn.18009d1f4
movdqa xmm0, xmmword [0x1800ebed0]
movdqu xmmword [rsp + 0x78], xmm0
mov byte [rsp + 0x68], r12b
mov rdx, qword [rsp + 0xd0]
cmp rdx, 0x10
jb 0x180099c72
inc rdx
mov rcx, qword [rsp + 0xb8]
mov rax, rcx
cmp rdx, rbx
jb 0x180099c6d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18009a023
jmp 0x180099c6d
sub rax, rcx
cmp rax, 0x3d
jb 0x18009a029
lea rax, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rax, qword [rsp + 0x40]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x3d
lea r9, str.SoftwareMicrosoftWindows_NTCurrentVersionWinlogonNotify_
lea r8, [rsp + 0x40]
mov dl, byte [rsp + 0x138]
lea rcx, [rsp + 0xb8]
call fcn.1800090dc
nop
lea r8, [rsp + 0xb8]
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x60]
call fcn.18000d618
mov rcx, qword [rax]
mov qword [rsp + 0x90], rcx
lea rdx, [rax + 8]
lea rax, [rsp + 0x98]
cmp rax, rdx
je 0x180099be4
mov r8b, r12b
lea rcx, [rsp + 0x98]
call fcn.180007418
mov rdx, qword [rsp + 0x80]
cmp rdx, 0x10
jb 0x180099c20
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, rbx
jb 0x180099c1b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18009a02f
call fcn.18009d1f4
movdqa xmm0, xmmword [0x1800ebed0]
movdqu xmmword [rsp + 0x78], xmm0
mov byte [rsp + 0x68], r12b
mov rdx, qword [rsp + 0xd0]
cmp rdx, 0x10
jb 0x180099c72
inc rdx
mov rcx, qword [rsp + 0xb8]
mov rax, rcx
cmp rdx, rbx
jb 0x180099c6d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18009a035
call fcn.18009d1f4
lea rcx, [rsp + 0x60]
call fcn.18000d560
nop
mov rdx, rax
lea rcx, [rsp + 0x90]
call fcn.18000d6ac
mov dil, al
mov rdx, qword [rsp + 0x80]
cmp rdx, 0x10
jb 0x180099ccc
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, rbx
jb 0x180099cc7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18009a03b
call fcn.18009d1f4
test dil, dil
je 0x180099d77
xor r8d, r8d
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0x90]
call fcn.18000d88c
nop
mov r9b, 1
lea r8, str.Runline
lea rdx, [rsp + 0x60]
mov rcx, rax
call fcn.18000e1c4
nop
lea rcx, [rsp + 0xb8]
call fcn.18000e078
lea rcx, [rsp + 0x60]
call fcn.18000de58
mov r8, rax
lea rdx, [0x1800ea990]
mov rcx, r15
call fcn.18000f45c
mov sil, 1
mov byte [rsp + 0x138], sil
mov rdx, qword [rsp + 0x80]
cmp rdx, 0x10
jb 0x180099d77
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, rbx
jb 0x180099d71
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18009a041
call fcn.18009d1f4
nop
mov rdx, qword [rsp + 0xb0]
cmp rdx, 0x10
jb 0x180099db6
inc rdx
mov rcx, qword [rsp + 0x98]
mov rax, rcx
cmp rdx, rbx
jb 0x180099db1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18009a047
call fcn.18009d1f4
movdqa xmm0, xmmword [0x1800ebed0]
movdqu xmmword [rsp + 0xa8], xmm0
mov byte [rsp + 0x98], r12b
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x180099e08
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, rbx
jb 0x180099e03
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18009a04d
call fcn.18009d1f4
test sil, sil
je 0x180099fa5
lea r8, str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x60]
call fcn.18000d57c
nop
mov r8d, 0x200
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0x60]
call fcn.18000d88c
nop
xor r9d, r9d
lea r8, str.OSSProxy
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0xb8]
call fcn.18000e1c4
nop
mov rcx, rax
call fcn.18000de58
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x50], r12
mov edi, reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x58], rdi
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.180003104
nop
mov rdx, qword [rsp + 0xb0]
cmp rdx, 0x10
jb 0x180099ecc
inc rdx
mov rcx, qword [rsp + 0x98]
mov rax, rcx
cmp rdx, rbx
jb 0x180099ec7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18009a053
call fcn.18009d1f4
cmp qword [rsp + 0x50], r12
jbe 0x180099f03
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rcx, qword [rsp + 0x40]
lea rdx, str.__bootremove
call fcn.18009eb24
movzx esi, sil
test rax, rax
cmovne esi, r12d
mov byte [rsp + 0x138], sil
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x180099f3c
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, rbx
jb 0x180099f37
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18009a059
call fcn.18009d1f4
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], rdi
mov byte [rsp + 0x40], r12b
lea rcx, [rsp + 0xb8]
call fcn.18000e078
nop
mov rdx, qword [rsp + 0x80]
cmp rdx, 0x10
jb 0x180099f96
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, rbx
jb 0x180099f90
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18009a05f
call fcn.18009d1f4
nop
jmp 0x180099fa5
mov rdx, qword [rsp + 0x108]
cmp rdx, 0x10
jb 0x180099fe5
inc rdx
mov rcx, qword [rsp + 0xf0]
mov rax, rcx
cmp rdx, rbx
jb 0x180099fdf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18009a065
call fcn.18009d1f4
nop
jmp 0x180099fef
mov al, sil
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r12
pop rdi
ret
call fcn.1800a45b8
nop
call fcn.1800a45b8
nop
call fcn.180001e88
nop
call fcn.1800a45b8
nop
call fcn.1800a45b8
int3
call fcn.180001e88
nop
call fcn.1800a45b8
nop
call fcn.1800a45b8
int3
call fcn.1800a45b8
int3
call fcn.1800a45b8
nop
call fcn.1800a45b8
nop
call fcn.1800a45b8
nop
call fcn.1800a45b8
int3
call fcn.1800a45b8
nop
call fcn.1800a45b8
nop
call fcn.1800a45b8
int3