Function at 0x1400564f0
Capabilities:
Persist via contextmenuhandlers registry key
Persist via windows service
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x1400fa080]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor ebp, ebp
lea r15, [0x14010017c]
mov qword [rsp + 0x40], r15
lea r14, [0x140100140]
mov qword [rsp + 0x38], r14
lea rdx, str.AllFilesystemObjects_shellexContextMenuHandlersCopy_To
mov qword [rsp + 0x30], rbp
xor r9d, r9d
mov dword [rsp + 0x28], 2
xor r8d, r8d
mov rcx, 0xffffffff80000000
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov rcx, qword [0x140100140]
lea rax, str.C2FBB630_2971_11D1_A18C_00C04FD75D13
mov dword [rsp + 0x28], Ordinal_79
lea r9d, [rbp + 1]
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [0x140100140]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], r15
lea rdx, str.AllFilesystemObjects_shellexContextMenuHandlersMove_To
mov qword [rsp + 0x38], r14
xor r9d, r9d
mov qword [rsp + 0x30], rbp
xor r8d, r8d
mov dword [rsp + 0x28], 2
mov rcx, 0xffffffff80000000
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov rcx, qword [0x140100140]
lea rax, str.C2FBB631_2971_11D1_A18C_00C04FD75D13
mov dword [rsp + 0x28], Ordinal_79
lea r9d, [rbp + 1]
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [0x140100140]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], r15
lea rdx, str.Control_PanelDesktop
mov qword [rsp + 0x38], r14
xor r9d, r9d
mov qword [rsp + 0x30], rbp
xor r8d, r8d
mov dword [rsp + 0x28], 2
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov rcx, qword [0x140100140]
lea rax, [0x1400e73e0]
mov dword [rsp + 0x28], 4
lea r9d, [rbp + 1]
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.AutoEndTasks
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [0x140100140]
lea rbx, str.1000
lea r9d, [rbp + 1]
mov dword [rsp + 0x28], 0xa
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea rdx, str.HungAppTimeout
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [0x140100140]
lea rdi, [0x1400e7418]
lea r9d, [rbp + 1]
mov dword [rsp + 0x28], 4
xor r8d, r8d
mov qword [rsp + 0x20], rdi
lea rdx, str.MenuShowDelay
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea rsi, str.2000
mov dword [rsp + 0x28], 0xa
mov qword [rsp + 0x20], rsi
lea r9d, [rbp + 1]
mov rcx, qword [0x140100140]
lea rdx, str.WaitToKillAppTimeout
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [0x140100140]
lea r9d, [rbp + 1]
xor r8d, r8d
mov dword [rsp + 0x28], 0xa
lea rdx, str.LowLevelHooksTimeout
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [0x140100140]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], r15
lea rdx, str.Control_PanelMouse
mov qword [rsp + 0x38], r14
xor r9d, r9d
mov qword [rsp + 0x30], rbp
xor r8d, r8d
mov dword [rsp + 0x28], 2
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov rcx, qword [0x140100140]
lea r9d, [rbp + 1]
xor r8d, r8d
mov dword [rsp + 0x28], 4
lea rdx, str.MouseHoverTime
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [0x140100140]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], r15
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
mov qword [rsp + 0x38], r14
xor r9d, r9d
mov qword [rsp + 0x30], rbp
xor r8d, r8d
mov dword [rsp + 0x28], 2
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov rcx, qword [0x140100140]
lea rax, [rsp + 0x58]
mov dword [rsp + 0x28], 4
lea r9d, [rbp + 4]
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.NoLowDiskSpaceChecks
mov dword [rsp + 0x58], 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [0x140100140]
lea rax, [rsp + 0x58]
mov dword [rsp + 0x28], 4
lea r9d, [rbp + 4]
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.LinkResolveIgnoreLinkInfo
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [0x140100140]
lea rax, [rsp + 0x58]
mov dword [rsp + 0x28], 4
lea r9d, [rbp + 4]
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.NoResolveSearch
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [0x140100140]
lea rax, [rsp + 0x58]
mov dword [rsp + 0x28], 4
lea r9d, [rbp + 4]
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.NoResolveTrack
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea rax, [rsp + 0x58]
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
lea r9d, [rbp + 4]
xor r8d, r8d
lea rdx, str.NoInternetOpenWith
mov rcx, qword [0x140100140]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [0x140100140]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], r15
lea rdx, str.SYSTEMCurrentControlSetControl
mov qword [rsp + 0x38], r14
xor r9d, r9d
mov qword [rsp + 0x30], rbp
xor r8d, r8d
mov dword [rsp + 0x28], 2
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov rcx, qword [0x140100140]
lea r9d, [rbp + 1]
xor r8d, r8d
mov dword [rsp + 0x28], 0xa
lea rdx, str.WaitToKillServiceTimeout
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [0x140100140]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], r15
lea rdx, str.SYSTEMCurrentControlSet_servicesUSB
mov qword [rsp + 0x38], r14
xor r9d, r9d
mov qword [rsp + 0x30], rbp
xor r8d, r8d
mov dword [rsp + 0x28], 2
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov rcx, qword [0x140100140]
lea rax, [rsp + 0x58]
mov dword [rsp + 0x28], 4
lea r9d, [rbp + 4]
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.DisableSelectiveSuspend
mov dword [rsp + 0x58], 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [0x140100140]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x1400569b9
imul rax, rax, 0x64
jmp 0x1400569d7
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
imul rcx, rcx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
movabs rcx, 0x7fffffff4d2fa1ff
cmp rax, rcx
jge 0x1400569f5
mov ecx, 0xb2d05e00
add rcx, rax
mov qword [rsp + 0x50], rcx
jmp 0x140056a04
movabs rax, 0x7fffffffffffffff
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x50]
call fcn.1400592f0
mov byte [0x1401000ec], bpl
mov byte [0x1401000eb], bpl
mov dword [0x140100174], 3
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400c0e40
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret