Function at 0x180005a70
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Persist via contextmenuhandlers registry key
Set registry value

Disassembly:
mov r11, rsp
push rbp
push rdi
lea rbp, [r11 - 0xe78]
sub rsp, 0xf68
mov rax, qword [0x180034008]
xor rax, rsp
mov qword [rbp + 0xe40], rax
mov rcx, qword [0x1800361e0]
lea rdx, [rbp + 0x410]
mov qword [r11 + 8], rbx
mov r8d, 0x104
mov qword [r11 - 0x18], r13
mov qword [r11 - 0x28], r15
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ebx, 0x5c
lea rcx, [rbp + 0x410]
mov r8d, ebx
xor edx, edx
call qword [sym.imp.SHLWAPI.dll_StrRChrW]
xor edi, edi
lea rdx, str.EasyPdfReader.exe
lea rcx, [rbp + 0x410]
mov word [rax + 2], di
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x410]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
je 0x180005b0b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [0x1800361e0]
lea rdx, [rbp + 0x620]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor edx, edx
lea rcx, [rbp + 0x830]
mov r8d, 0x400
call fcn.18000bfa0
xor edx, edx
mov dword [rsp + 0x50], 0x20323b27
mov r8d, 0x400
mov dword [rsp + 0x54], 0x31263523
lea rcx, [rbp + 0x10]
mov dword [rsp + 0x58], 0x373d3908
mov dword [rsp + 0x5c], 0x3b273b26
mov dword [rsp + 0x60], 0x23082032
mov dword [rsp + 0x64], 0x3b303a3d
mov dword [rsp + 0x68], 0x37082723
mov dword [rsp + 0x6c], 0x31262621
mov dword [rsp + 0x70], 0x3122203a
mov dword [rsp + 0x74], 0x3b3d2726
mov dword [rsp + 0x78], 0x2c31083a
mov dword [rsp + 0x7c], 0x263b3824
mov dword [rbp - 0x80], 0x27082631
mov dword [rbp - 0x7c], 0x3838313c
mov dword [rbp - 0x78], 0x3a3b373d
mov dword [rbp - 0x74], 0x2631223b
mov dword [rbp - 0x70], 0x3d2d3538
mov dword [rbp - 0x6c], 0x203a3130
mov dword [rbp - 0x68], 0x313d323d
mov dword [rbp - 0x64], 0x31082726
mov dword [rbp - 0x60], 0x242d2735
mov dword [rbp - 0x5c], 0x31263230
mov dword [rbp - 0x58], 0x26313035
call fcn.18000bfa0
movaps xmm0, xmmword [rsp + 0x50]
movaps xmm1, xmmword [rsp + 0x60]
mov eax, dword [rbp - 0x58]
movups xmmword [rbp + 0x10], xmm0
mov dword [rbp + 0x68], eax
lea rax, [rbp + 0x10]
movaps xmm0, xmmword [rsp + 0x70]
movups xmmword [rbp + 0x20], xmm1
movaps xmm1, xmmword [rbp - 0x80]
movups xmmword [rbp + 0x30], xmm0
movaps xmm0, xmmword [rbp - 0x70]
movups xmmword [rbp + 0x40], xmm1
movsd xmm1, qword [rbp - 0x60]
movups xmmword [rbp + 0x50], xmm0
movsd qword [rbp + 0x60], xmm1
nop word [rax + rax]
xor byte [rax], 0x54
lea rax, [rax + 1]
sub rbx, 1
jne 0x180005c40
mov rcx, rdi
movzx eax, byte [rbp + rcx + 0x10]
mov byte [rbp + rcx + 0x830], al
lea rcx, [rcx + 1]
test al, al
jne 0x180005c50
mov qword [rbp - 0x38], 0xf
mov qword [rbp - 0x40], rdi
mov byte [rbp - 0x50], dil
cmp byte [rbp + 0x830], dil
jne 0x180005c82
mov r8, rdi
jmp 0x180005c99
lea rax, [rbp + 0x830]
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], dil
jne 0x180005c90
lea rdx, [rbp + 0x830]
lea rcx, [rbp - 0x50]
call fcn.180003f20
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x18]
call fcn.180007f30
mov rax, qword gs:[0x58]
lea r13, str.1BFA6B3E_7441_4E72_B865_8363000E40F2
mov ecx, dword [0x1800354d0]
mov r8d, 4
mov rdx, qword [rax + rcx*8]
mov eax, dword [r8 + rdx]
cmp dword [0x1800361f8], eax
jle 0x180005f6c
lea rcx, [0x1800361f8]
call fcn.1800088b0
cmp dword [0x1800361f8], 0xffffffff
jne 0x180005f6c
cmp qword [rbp], 8
lea rcx, str.CLSID_sSettings
lea rax, [rbp + 0x620]
mov qword [0x180034a40], rcx
mov qword [0x180034a08], rax
xorps xmm0, xmm0
lea rax, str.CLSID_sInprocServer32
mov qword [0x180034a68], rcx
mov qword [0x180034a18], rax
lea rax, str.ThreadingModel
mov qword [0x180034a20], rax
lea rax, str.Apartment
mov qword [0x180034a30], rax
lea rax, str.Title
mov qword [0x180034a48], rax
lea rax, str.open_by_EasyPDFReader
mov qword [0x180034a58], rax
lea rax, str.Path
mov qword [0x180034a70], rax
lea rax, [rbp + 0x410]
mov qword [0x180034a80], rax
lea rax, str.Custom
mov qword [0x180034a98], rax
lea rax, [0x18002e964]
mov qword [0x180034aa8], rax
lea rax, str.ShowIcon
mov qword [0x180034ac0], rax
lea rax, [0x180034bcc]
mov qword [0x180034ad0], rax
lea rax, str.Dynamic
mov qword [0x180034ae8], rax
lea rax, [0x180034bd0]
mov qword [0x180034af8], rax
lea rax, str.Maxtext
mov qword [0x180034b10], rax
lea rax, [0x180034bd4]
mov qword [0x180034b20], rax
lea rax, str._shellexContextMenuHandlersEasyPdfReader64
mov qword [0x180034b30], rax
lea rax, str.Directory_shellexContextMenuHandlersEasyPdfReader64
mov qword [0x180034b58], rax
lea rax, [rbp - 0x18]
cmovae rax, qword [rbp - 0x18]
mov qword [0x180034a90], rcx
mov qword [0x180034ab8], rcx
mov qword [0x180034ae0], rcx
mov qword [0x180034b08], rcx
lea rcx, [0x1800361f8]
mov qword [0x180034b80], rax
mov qword [0x180034a10], 0xffffffff80000000
mov dword [0x180034a28], 1
mov qword [0x180034a38], 0xffffffff80000000
mov dword [0x180034a50], 1
mov qword [0x180034a60], 0xffffffff80000000
mov dword [0x180034a78], 1
mov qword [0x180034a88], 0xffffffff80000000
mov dword [0x180034aa0], 1
mov qword [0x180034ab0], 0xffffffff80000000
mov dword [0x180034ac8], 4
mov qword [0x180034ad8], 0xffffffff80000000
mov dword [0x180034af0], 4
mov qword [0x180034b00], 0xffffffff80000000
mov dword [0x180034b18], 4
mov qword [0x180034b28], 0xffffffff80000000
mov qword [0x180034b38], rdi
mov dword [0x180034b40], 1
mov qword [0x180034b48], r13
mov qword [0x180034b50], 0xffffffff80000000
mov qword [0x180034b60], rdi
mov dword [0x180034b68], 1
mov qword [0x180034b70], r13
mov qword [0x180034b78], 0xffffffff80000002
mov qword [0x180034b88], rdi
mov dword [0x180034b90], 1
mov qword [0x180034b98], r13
movdqa xmmword [0x180034ba0], xmm0
mov qword [0x180034bb0], rdi
mov dword [0x180034bb8], 1
mov qword [0x180034bc0], rdi
call fcn.180008850
mov qword [rsp + 0xf88], rsi
mov qword [rsp + 0xf90], r12
mov qword [rsp + 0xf58], r14
call fcn.180006190
cmp qword [0x1800349c0], rdi
mov r15d, edi
je 0x180006098
lea r12, [0x1800349c0]
mov rsi, rdi
mov r14, r12
mov rbx, rdi
nop dword [rax]
mov rdx, qword [rbx + r12 + 8]
lea rcx, [rbp + 0xc30]
mov r8, r13
call qword [sym.imp.USER32.dll_wsprintfW]
mov rcx, qword [r14]
lea rax, [rbp - 0x20]
mov qword [rsp + 0x40], rax
lea rdx, [rbp + 0xc30]
lea rax, [rbp - 0x28]
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
movsxd r14, eax
test eax, eax
jne 0x1800060ef
mov r9d, dword [rbx + r12 + 0x18]
cmp r9d, 1
jne 0x18000604a
mov rdx, qword [rbx + r12 + 0x20]
lea r8, [rbp + 0x620]
lea rcx, [rbp + 0x10]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r9d, dword [rbx + r12 + 0x18]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x10]
jmp 0x180006057
mov rax, qword [rbx + r12 + 0x20]
mov dword [rsp + 0x28], 4
mov rdx, qword [rbx + r12 + 0x10]
xor r8d, r8d
mov rcx, qword [rbp - 0x28]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc rsi
inc r15d
lea rax, [rsi + rsi*4]
lea rbx, [rax*8]
cmp qword [rbx + r12], rdi
lea r14, [rbx + r12]
jne 0x180005fb0
mov edi, 1
mov rax, qword [rbp]
mov r15, qword [rsp + 0xf50]
mov r14, qword [rsp + 0xf58]
mov r13, qword [rsp + 0xf60]
mov r12, qword [rsp + 0xf90]
mov rsi, qword [rsp + 0xf88]
mov rbx, qword [rsp + 0xf80]
cmp rax, 8
jb 0x180006148
mov rcx, qword [rbp - 0x18]
inc rax
movabs rdx, 0x7fffffffffffffff
cmp rax, rdx
jbe 0x180006118
jmp 0x180006163
xor edx, edx
lea rcx, [rbp + 0x10]
mov r8d, 0x400
call fcn.18000bfa0
mov r9, r14
lea rdx, str.RegCreateKeyEx_error:_d__d
mov r8d, r15d
lea rcx, [rbp + 0x10]
call fcn.180005270
jmp 0x18000609d
add rax, rax
cmp rax, 0x1000
jb 0x180006143
test cl, 0x1f
jne 0x180006169
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x18000616f
sub rcx, rax
cmp rcx, 8
jb 0x180006175
cmp rcx, 0x27
ja 0x18000617b
mov rcx, rax
call fcn.1800086f8
mov eax, edi
mov rcx, qword [rbp + 0xe40]
xor rcx, rsp
call fcn.180008690
add rsp, 0xf68
pop rdi
pop rbp
ret
call fcn.180010f74
int3
call fcn.180010f74
int3
call fcn.180010f74
int3
call fcn.180010f74
int3
call fcn.180010f74
int3