Function at 0x1800104b4
Capabilities:
Persist via winlogon helper dll registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0x90
xor esi, esi
mov rdi, rcx
mov r12d, 0x20007
lea rdx, [rbp - 1]
mov ecx, r12d
mov bl, sil
mov qword [rbp - 1], rsi
mov qword [rbp - 9], rsi
mov dword [rbp + 0x77], esi
mov dword [rbp + 0x7f], esi
mov qword [rbp + 7], rsi
mov r15d, esi
mov r14d, esi
mov r13d, esi
call qword [sym.imp.ADVAPI32.dll_RegOpenCurrentUser]
test eax, eax
jne 0x180010849
mov rcx, qword [rbp - 1]
lea rax, [rbp - 9]
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionWinlogon
mov r9d, r12d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180010849
mov rcx, qword [rbp - 1]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 9]
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rsi
lea rax, [rbp + 0x77]
xor r9d, r9d
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x180010849
mov r8d, dword [rbp + 0x77]
mov rcx, qword [rdi + 8]
lea edx, [rsi + 8]
add r8, r8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r12, rax
mov qword [rbp + 0xf], rax
test rax, rax
je 0x180010849
mov eax, dword [rbp + 0x77]
mov rcx, qword [rbp - 9]
lea rdx, str.Shell
inc eax
xor r9d, r9d
xor r8d, r8d
mov dword [rbp + 0x7f], eax
lea rax, [rbp + 0x7f]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1800107fa
lea edx, [rsi + 0x2c]
mov rcx, r12
call qword [sym.imp.msvcrt.dll_wcschr]
xor ebx, ebx
jmp 0x180010698
xor eax, eax
lea ecx, [rax + 0x2c]
cmp word [rsi], cx
je 0x180010602
cmp word [rsi], 0x20
jne 0x18001060f
cmp word [rsi], ax
je 0x18001060f
add rsi, 2
inc ebx
jmp 0x1800105f7
mov r8d, dword [rbp + 0x7f]
mov rcx, qword [rdi + 8]
mov edx, 8
add r8, r8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r8d, r8d
mov r13, rax
test rax, rax
je 0x1800107f7
movzx eax, word [rsi]
lea r9d, [r8 + 0x2c]
mov ecx, r8d
cmp ax, r9w
je 0x180010662
mov edx, r8d
test ax, ax
je 0x180010662
inc rcx
mov word [rdx + r13], ax
lea rdx, [rcx + rcx]
movzx eax, word [rdx + rsi]
cmp ax, r9w
jne 0x180010647
mov r8, qword [rdi + 0x10]
mov rdx, r13
mov rcx, rdi
call fcn.180010ac0
test al, al
jne 0x1800106a9
mov rcx, qword [rdi + 8]
mov r8, r13
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ebx, ebx
mov rcx, rsi
test eax, eax
lea edx, [rbx + 0x2c]
cmovne r13, rbx
call qword [sym.imp.msvcrt.dll_wcschr]
mov rsi, rax
test rax, rax
jne 0x1800105f2
jmp 0x1800107d1
movsxd rax, ebx
mov rbx, rsi
sub rbx, r12
mov qword [rbp + 0x17], rax
sar rbx, 1
sub rbx, rax
je 0x1800106f0
mov rcx, qword [rdi + 8]
lea r8, [rbx + rbx + 2]
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor ecx, ecx
mov qword [rbp + 7], rax
test rax, rax
je 0x1800107db
mov r8, rbx
mov rdx, r12
mov rcx, rax
call qword [sym.imp.msvcrt.dll_wcsncpy]
mov rcx, r12
call qword [sym.imp.msvcrt.dll_wcslen]
mov rcx, r13
mov r12, rax
sub r12, qword [rbp + 0x17]
sub r12, rbx
call qword [sym.imp.msvcrt.dll_wcslen]
sub r12, rax
je 0x18001074c
mov rcx, qword [rdi + 8]
lea r8, [r12 + r12 + 2]
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r15, rax
xor eax, eax
test r15, r15
je 0x1800107d7
mov rcx, r13
call qword [sym.imp.msvcrt.dll_wcslen]
mov r8, r12
mov rcx, r15
lea rdx, [rsi + rax*2]
call qword [sym.imp.msvcrt.dll_wcsncpy]
mov rcx, qword [rdi + 8]
lea rsi, [r12 + rbx]
mov edx, 8
lea r8, [rsi + rsi + 2]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r14, rax
xor eax, eax
test r14, r14
je 0x1800107d7
test rbx, rbx
je 0x180010780
mov rdx, qword [rbp + 7]
mov rcx, r14
call qword [sym.imp.msvcrt.dll_wcscpy]
test r12, r12
je 0x180010792
lea rcx, [r14 + rbx*2]
mov rdx, r15
call qword [sym.imp.msvcrt.dll_wcscpy]
mov rcx, qword [rdi + 8]
mov r8, r13
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rbp - 9]
xor ebx, ebx
test eax, eax
lea eax, [rsi + rsi]
lea r9d, [rbx + 1]
cmovne r13, rbx
mov dword [rsp + 0x28], eax
lea rdx, str.Shell
xor r8d, r8d
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1800107d5
mov bl, 1
jmp 0x1800107dd
jmp 0x1800107dd
mov bl, al
jmp 0x1800107dd
mov bl, cl
test r13, r13
je 0x1800107f1
mov rcx, qword [rdi + 8]
mov r8, r13
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r12, qword [rbp + 0xf]
jmp 0x1800107fa
mov bl, r8b
mov rcx, qword [rdi + 8]
mov r8, r12
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rax, qword [rbp + 7]
test rax, rax
je 0x180010821
mov rcx, qword [rdi + 8]
mov r8, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
test r15, r15
je 0x180010835
mov rcx, qword [rdi + 8]
mov r8, r15
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
test r14, r14
je 0x180010849
mov rcx, qword [rdi + 8]
mov r8, r14
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rbp - 9]
test rcx, rcx
je 0x180010858
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [0x18003a4ec]
test bl, bl
lea r8, [0x18003a540]
lea rdx, str.__s__n
mov ecx, 0xf5
cmovne r8, rax
call fcn.180030818
mov al, bl
mov rbx, qword [rsp + 0xd0]
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret