Function at 0x536a40
Capabilities:
Persist via run registry key

Disassembly:
lea r12, [rsp - 0x58]
cmp r12, qword [r14 + 0x10]
jbe 0x536de1
push rbp
mov rbp, rsp
sub rsp, 0xd0
movq qword [rsp + 0xc8], xmm15
mov byte [rsp + 0x37], 0
movups xmmword [rsp + 0x60], xmm15
call sym.os.Executable
test rcx, rcx
je 0x536acc
movups xmmword [rsp + 0xb8], xmm15
je 0x536a88
mov rcx, qword [rcx + 8]
mov qword [rsp + 0xb8], rcx
mov qword [rsp + 0xc0], rdi
lea rax, [0x0057e161]
mov ebx, 0x21
lea rcx, [rsp + 0xb8]
mov edi, 1
mov rsi, rdi
call sym.fmt.Errorf
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
add rsp, 0xd0
pop rbp
ret
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x40], rbx
call sym.os_user.Current
nop dword [rax + rax]
test rbx, rbx
je 0x536b38
movups xmmword [rsp + 0xb8], xmm15
je 0x536af4
mov rbx, qword [rbx + 8]
mov qword [rsp + 0xb8], rbx
mov qword [rsp + 0xc0], rcx
lea rax, [0x0057d072]
mov ebx, 0x1e
lea rcx, [rsp + 0xb8]
mov edi, 1
mov rsi, rdi
call sym.fmt.Errorf
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
add rsp, 0xd0
pop rbp
ret
movups xmmword [rsp + 0x78], xmm15
movups xmmword [rsp + 0x88], xmm15
movups xmmword [rsp + 0x98], xmm15
movups xmmword [rsp + 0xa8], xmm15
mov rdx, qword [rax + 0x40]
mov rsi, qword [rax + 0x48]
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x78], rdx
mov qword [rsp + 0x90], 7
lea rdx, [0x00574ca3]
mov qword [rsp + 0x88], rdx
mov qword [rsp + 0xa0], 7
lea rdx, [0x00574caa]
mov qword [rsp + 0x98], rdx
mov qword [rsp + 0xb0], 9
lea rdx, [0x00575319]
mov qword [rsp + 0xa8], rdx
lea rax, [rsp + 0x78]
mov ebx, 4
mov rcx, rbx
call sym.path_filepath.join
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0x40]
cmp rbx, rcx
jne 0x536c05
mov rbx, rax
mov rax, qword [rsp + 0x70]
call sym.runtime.memequal
test al, al
jne 0x536c71
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
nop
mov rdi, rbx
mov rbx, rcx
mov rcx, rax
mov rax, qword [rsp + 0x70]
call sym.os.rename
test rax, rax
je 0x536c71
movups xmmword [rsp + 0xb8], xmm15
je 0x536c2d
mov rax, qword [rax + 8]
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0xc0], rbx
lea rax, [0x0057c9e0]
mov ebx, 0x1d
lea rcx, [rsp + 0xb8]
mov edi, 1
mov rsi, rdi
call sym.fmt.Errorf
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
add rsp, 0xd0
pop rbp
ret
mov eax, 0x80000002
lea rbx, [0x00580d59]
mov ecx, 0x2d
mov edi, 2
call sym.golang.org_x_sys_windows_registry.CreateKey
test rcx, rcx
je 0x536ce4
movups xmmword [rsp + 0xb8], xmm15
je 0x536ca0
mov rcx, qword [rcx + 8]
mov qword [rsp + 0xb8], rcx
mov qword [rsp + 0xc0], rdi
lea rax, [0x0057e182]
mov ebx, 0x21
lea rcx, [rsp + 0xb8]
mov edi, 1
mov rsi, rdi
call sym.fmt.Errorf
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
add rsp, 0xd0
pop rbp
ret
lea rdx, [sym.main.addToStartup.deferwrap1]
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x48]
mov qword [rsp + 0xc8], rdx
mov byte [rsp + 0x37], 1
nop
lea rbx, [0x00574f51]
mov ecx, 8
mov edi, 1
mov rsi, qword [rsp + 0x58]
mov r8, qword [rsp + 0x38]
call sym.golang.org_x_sys_windows_registry.Key.setStringValue
test rax, rax
je 0x536d9d
movups xmmword [rsp + 0xb8], xmm15
je 0x536d3c
mov rax, qword [rax + 8]
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0xc0], rbx
lea rax, [0x0057db80]
mov ebx, 0x20
lea rcx, [rsp + 0xb8]
mov edi, 1
mov rsi, rdi
call sym.fmt.Errorf
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov byte [rsp + 0x37], 0
mov rdx, qword [rsp + 0xc8]
mov r8, qword [rdx]
call r8
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
add rsp, 0xd0
pop rbp
ret
movups xmmword [rsp + 0x60], xmm15
mov byte [rsp + 0x37], 0
mov rdx, qword [rsp + 0xc8]
mov rax, qword [rdx]
call rax
mov rbx, qword [rsp + 0x68]
mov rax, qword [rsp + 0x60]
add rsp, 0xd0
pop rbp
ret
call sym.runtime.morestack_noctxt.abi0
jmp sym.main.addToStartup