Function at 0x14003afbc
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x398]
sub rsp, 0x470
mov qword [rbp - 0x70], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1401a2e90]
xor rax, rsp
mov qword [rbp + 0x360], rax
mov r13b, dl
mov r12, rcx
mov qword [rbp - 0x68], rcx
xor esi, esi
mov dword [rsp + 0x58], esi
mov eax, dword [0x1401ad008]
lea rdi, [0x1401a29a8]
lea r14d, [rsi + 1]
test r14b, al
jne 0x14003b055
or eax, r14d
mov dword [0x1401ad008], eax
mov rcx, rdi
mov rax, qword [0x1401a29a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x1401ad010], rax
lea rcx, [0x14010b828]
call fcn.1400be030
nop
mov eax, dword [0x1401ad008]
test al, 2
jne 0x14003b08d
or eax, 2
mov dword [0x1401ad008], eax
mov rcx, rdi
mov rax, qword [0x1401a29a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x1401ad000], rax
lea rcx, [0x14010b7f8]
call fcn.1400be030
nop
mov eax, dword [0x1401ad008]
test al, 4
jne 0x14003b0c5
or eax, 4
mov dword [0x1401ad008], eax
mov rcx, rdi
mov rax, qword [0x1401a29a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x1401acff8], rax
lea rcx, [0x14010b7c8]
call fcn.1400be030
nop
mov eax, dword [0x1401ad008]
test al, 8
jne 0x14003b0f7
or eax, 8
mov dword [0x1401ad008], eax
mov rcx, rdi
mov rax, qword [0x1401a29a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x1401ad018], rax
lea rcx, [0x14010b798]
call fcn.1400be030
nop
mov rax, qword [0x1401ad000]
cmp dword [rax - 0x10], esi
je 0x14003b14e
mov ecx, esi
mov rax, qword [0x1401ac248]
test rax, rax
setne cl
test ecx, ecx
jne 0x14003b121
mov ecx, 0x80004005
call fcn.140001874
int3
mov rcx, qword [0x1401ad018]
sub rax, rcx
movzx edx, word [rcx]
cmp dx, word [rcx + rax]
jne 0x14003b141
add rcx, 2
test dx, dx
jne 0x14003b12b
mov eax, esi
jmp 0x14003b146
sbb eax, eax
or eax, r14d
test eax, eax
je 0x14003ba0e
lea rdx, [0x1401ac248]
lea rcx, [0x1401ad018]
call fcn.140002038
lea rcx, [0x1401ad010]
call fcn.140001ec8
lea rcx, [0x1401ad000]
call fcn.140001ec8
lea rcx, [0x1401acff8]
call fcn.140001ec8
mov r15d, esi
mov rcx, rdi
mov rax, qword [0x1401a29a8]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x48], rbx
mov rcx, rdi
mov rax, qword [0x1401a29a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.Volatile_Environment
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, 0x82
test eax, eax
jne 0x14003b412
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14003b401
mov dword [rsp + 0x30], 0x104
mov ecx, r14d
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x14003b24a
mov edx, edi
lea rcx, [rsp + 0x48]
call fcn.140002210
mov rbx, qword [rsp + 0x48]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, str.AppData
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14003b2a2
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.1400be514
test eax, eax
js 0x14003b297
cmp eax, dword [rbx - 0xc]
jg 0x14003b297
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], si
jmp 0x14003b2b1
mov ecx, 0x80070057
call fcn.140001874
int3
lea rcx, [rsp + 0x48]
call fcn.140001ec8
mov rbx, qword [rsp + 0x48]
mov dword [rsp + 0x30], 0x104
mov rax, qword [0x1401ad010]
mov edx, r14d
sub edx, dword [rax - 8]
mov ecx, dword [rax - 0xc]
sub ecx, edi
or ecx, edx
jge 0x14003b2e4
mov edx, edi
lea rcx, [0x1401ad010]
call fcn.140002210
mov rax, qword [0x1401ad010]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, str.Local_AppData
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14003b352
mov rcx, qword [0x1401ad010]
movsxd rdx, dword [rcx - 0xc]
call fcn.1400be514
mov rcx, rax
test eax, eax
js 0x14003b347
mov rax, qword [0x1401ad010]
cmp ecx, dword [rax - 0xc]
jg 0x14003b347
mov dword [rax - 0x10], ecx
movsxd rcx, ecx
mov rax, qword [0x1401ad010]
mov word [rax + rcx*2], si
jmp 0x14003b35e
mov ecx, 0x80070057
call fcn.140001874
int3
lea rcx, [0x1401ad010]
call fcn.140001ec8
mov dword [rsp + 0x30], 0x104
mov rax, qword [rsp + 0x50]
mov ecx, r14d
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, edi
or eax, ecx
jge 0x14003b386
mov edx, edi
lea rcx, [rsp + 0x50]
call fcn.140002210
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov rdi, qword [rsp + 0x50]
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, str.A520A1A4_1780_4FF6_BD18_167343C5AF16
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14003b3e3
movsxd rdx, dword [rdi - 0xc]
mov rcx, rdi
call fcn.1400be514
test eax, eax
js 0x14003b3d8
cmp eax, dword [rdi - 0xc]
jg 0x14003b3d8
mov dword [rdi - 0x10], eax
cdqe
mov word [rdi + rax*2], si
jmp 0x14003b3f4
mov ecx, 0x80070057
call fcn.140001874
int3
lea rdx, [0x1401ad010]
lea rcx, [rsp + 0x50]
call fcn.140002038
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14003b412
lea rdx, [0x1401ad010]
lea rcx, [rsp + 0x50]
call fcn.140002038
call fcn.14003adb8
test al, al
je 0x14003b763
mov r9d, dword [0x1401aad80]
lea ecx, [r9 + 2]
lea eax, [r9 + 1]
imul ecx, eax
imul ecx, r9d
and ecx, 0x80000003
jge 0x14003b446
sub ecx, r14d
or ecx, 0xfffffffc
add ecx, r14d
cmp ecx, r14d
jne 0x14003b4b4
lea r14, [rbp - 0x60]
xor r10d, r10d
lea edi, [r10 + 1]
lea ecx, [rsi + 1]
mov eax, r9d
cdq
idiv ecx
mov r8d, edx
mov ecx, r9d
sub ecx, esi
imul r8d, ecx
mov eax, r9d
cdq
idiv edi
add r8d, eax
sub r8d, r10d
mov dword [r14], r8d
mov edx, r8d
lea rcx, [0x140138060]
call fcn.1400be234
mov r10d, edi
add r14, 4
cmp edi, 8
jge 0x14003b49e
mov r9d, dword [0x1401aad80]
jmp 0x14003b452
inc esi
cmp esi, 0x1e
jge 0x14003b4ae
mov r9d, dword [0x1401aad80]
jmp 0x14003b44f
xor esi, esi
lea r14d, [rsi + 1]
mov dil, r14b
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftInternet_ExplorerMain
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14003b687
mov dword [rsp + 0x30], 0x104
mov ecx, r14d
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
mov edx, 0x82
sub eax, edx
or eax, ecx
jge 0x14003b511
lea rcx, [rsp + 0x48]
call fcn.140002210
mov rbx, qword [rsp + 0x48]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, str.Isolation
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14003b637
mov r8d, dword [0x1401aad80]
mov ecx, r8d
imul ecx, r8d
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xe
sub ecx, edx
cmp ecx, 0xd
jne 0x14003b5e3
jmp 0x14003b5de
mov eax, r8d
and eax, 0x80000001
jge 0x14003b582
sub eax, r14d
or eax, 0xfffffffe
add eax, r14d
test eax, eax
jne 0x14003b599
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
mov r8d, eax
mov dword [0x1401aad80], eax
jmp 0x14003b5a8
lea r8d, [r8*2 + 1]
mov dword [0x1401aad80], r8d
mov eax, 0x55555556
imul r8d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
mov ecx, r8d
sub ecx, eax
je 0x14003b5cc
sub ecx, 2
je 0x14003b5d0
dec ecx
je 0x14003b5d3
jmp 0x14003b5de
add r8d, 2
add r8d, r14d
add r8d, 2
mov dword [0x1401aad80], r8d
test r8d, r8d
jne 0x14003b56f
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.1400be514
test eax, eax
js 0x14003b62c
cmp eax, dword [rbx - 0xc]
jg 0x14003b62c
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], si
mov dil, sil
cmp dword [rbx - 0x10], esi
jl 0x14003b637
lea rdx, str.PMIL
mov rcx, rbx
call fcn.1400be6e4
test rax, rax
je 0x14003b637
sub rax, rbx
sar rax, 1
test eax, eax
jne 0x14003b637
mov r15d, r14d
jmp 0x14003b637
mov ecx, 0x80070057
call fcn.140001874
int3
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x1401aad80]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, 0x66666667
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub ecx, eax
mov eax, dword [0x1401ac1e4]
mov edx, 0x42b78a69
cmp ecx, 0x12
cmove eax, edx
mov dword [0x1401ac1e4], eax
test dil, dil
je 0x14003b766
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftInternet_ExplorerAdvancedOptionsCRYPTOPROTECTEDMODESECURITY
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14003b763
mov dword [rsp + 0x30], 0x104
mov ecx, r14d
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
mov edx, 0x82
sub eax, edx
or eax, ecx
jge 0x14003b6e1
lea rcx, [rsp + 0x48]
call fcn.140002210
mov rbx, qword [rsp + 0x48]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, str.DefaultValue
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.1400be514
test eax, eax
js 0x14003b758
cmp eax, dword [rbx - 0xc]
jg 0x14003b758
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], si
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rbx - 0x10], esi
jl 0x14003b766
lea rdx, str.PMIL
mov rcx, rbx
call fcn.1400be6e4
test rax, rax
je 0x14003b766
sub rax, rbx
sar rax, 1
test eax, eax
jne 0x14003b766
jmp 0x14003b763
mov ecx, 0x80070057
call fcn.140001874
int3
mov r15d, r14d
or ebx, 0xffffffff
cmp qword [0x1401a5d58], 0xffffffff80000002
je 0x14003b7ce
test r15d, r15d
je 0x14003b7f4
call fcn.14003ade4
test al, al
je 0x14003b7ce
cmp byte [0x1401aaea4], sil
jne 0x14003b7ce
lea rdx, str.Software_
lea rcx, [rbp - 0x80]
call fcn.140001f6c
nop
mov rdx, rax
lea rcx, [0x1401ad000]
call fcn.140002038
nop
mov rdx, qword [rbp - 0x80]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x14003b7e1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14003b7e1
lea rdx, [0x1401ac248]
lea rcx, [0x1401ad000]
call fcn.140002038
lea rdx, [rsp + 0x50]
lea rcx, [0x1401ad010]
call fcn.140002038
jmp 0x14003b857
call fcn.14003ae8c
test al, al
jne 0x14003b816
mov r8d, 0x1e
lea rdx, str.Packageswindows_ie_ac_001AC
lea rcx, [0x1401ad010]
call fcn.14000e884
lea rdx, str.SoftwareClassesLocal_SettingsSoftwareMicrosoftWindowsCurrentVersionAppContainerStoragewindows_ie_ac_001Software_
lea rcx, [rsp + 0x60]
call fcn.140001f6c
nop
mov rdx, rax
lea rcx, [0x1401ad000]
call fcn.140002038
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x14003b857
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [0x1401ad000]
cmp dword [rcx - 0x10], esi
jl 0x14003b897
lea rdx, str.windows_ie_ac_001
call fcn.1400be6e4
test rax, rax
je 0x14003b897
sub rax, qword [0x1401ad000]
sar rax, 1
test eax, eax
jle 0x14003b897
lea rdx, [0x1401ac248]
lea rcx, [0x1401acff8]
call fcn.140002038
jmp 0x14003b911
call fcn.14003ade4
test al, al
je 0x14003b8d2
cmp byte [0x1401aaea4], sil
jne 0x14003b8d2
lea rdx, str.Software_
lea rcx, [rsp + 0x78]
call fcn.140001f6c
nop
mov rdx, rax
lea rcx, [0x1401acff8]
call fcn.140002038
nop
mov rdx, qword [rsp + 0x78]
jmp 0x14003b8f7
lea rdx, str.SoftwareClassesLocal_SettingsSoftwareMicrosoftWindowsCurrentVersionAppContainerStoragewindows_ie_ac_001Software_
lea rcx, [rbp - 0x78]
call fcn.140001f6c
nop
mov rdx, rax
lea rcx, [0x1401acff8]
call fcn.140002038
nop
mov rdx, qword [rbp - 0x78]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x14003b911
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
cmp qword [0x1401a5d58], 0xffffffff80000002
je 0x14003b9a7
cmp byte [0x1401a5c22], sil
je 0x14003b9a7
lea rcx, [rsp + 0x68]
call fcn.14003ac64
nop
mov rdx, qword [rax]
mov r8d, dword [rdx - 0x10]
lea rcx, [0x1401ad000]
call fcn.14000e884
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x14003b969
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [rsp + 0x70]
call fcn.14003ac64
nop
mov rdx, qword [rax]
mov r8d, dword [rdx - 0x10]
lea rcx, [0x1401acff8]
call fcn.14000e884
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x14003b9a7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [0x1401a5d58]
lea rcx, [0x1401ad000]
call fcn.14003ba6c
mov rdx, qword [0x1401a5d58]
lea rcx, [0x1401acff8]
call fcn.14003ba6c
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x14003b9ee
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x14003ba0e
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov rcx, r12
test r13b, r13b
je 0x14003ba24
lea rdx, [0x1401acff8]
call fcn.140002d5c
jmp 0x14003ba30
lea rdx, [0x1401ad000]
call fcn.140002d5c
mov dword [rsp + 0x58], r14d
mov rax, r12
mov rcx, qword [rbp + 0x360]
xor rcx, rsp
call fcn.1400bd920
lea r11, [rsp + 0x470]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret