Function at 0x7ff7901b58ec
Capabilities:
Persist via winlogon helper dll registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x3b0]
sub rsp, 0x4b0
mov rax, qword [0x7ff7904d6b68]
xor rax, rsp
mov qword [rbp + 0x3a0], rax
mov r15, rcx
lea rax, [rsp + 0x78]
mov rdi, 0xffffffff80000002
mov qword [rsp + 0x20], rax
xor ebx, ebx
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionWinlogonAlternateShellsAvailableShells
mov rcx, rdi
mov dword [rsp + 0x70], ebx
mov r9d, 0x20019
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
lea r12d, [rbx + 1]
lea rax, [rsp + 0x60]
je 0x7ff79022e162
mov qword [rsp + 0x30], rax
lea r9d, [rbx + 2]
lea rax, [rbp - 0x80]
mov dword [rsp + 0x60], 0x208
mov qword [rsp + 0x28], rax
lea r8, str.Shell
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionWinlogon
mov qword [rsp + 0x20], rbx
mov rcx, rdi
call qword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHRegGetValueW]
nop dword [rax + rax]
test eax, eax
jne 0x7ff7901b5a31
lea rcx, [rbp - 0x80]
call qword [sym.imp.api_ms_win_shlwapi_winrt_storage_l1_1_1.dll_PathRemoveArgsW]
nop dword [rax + rax]
lea rcx, [rbp - 0x80]
call qword [sym.imp.api_ms_win_core_shlwapi_legacy_l1_1_0.dll_PathRemoveBlanksW]
nop dword [rax + rax]
lea rcx, [rbp - 0x80]
call qword [sym.imp.api_ms_win_core_shlwapi_legacy_l1_1_0.dll_PathFindFileNameW]
nop dword [rax + rax]
lea rsi, [0x7ff790483698]
mov dil, bl
mov r14, rbx
cmp word [rax], bx
cmovne rsi, rax
test dil, dil
jne 0x7ff7901b5a31
mov rdx, qword [r15 + r14*8]
or r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], bx
jne 0x7ff7901b59fd
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_shlwapi_obsolete_l1_1_0.dll_StrCmpNIW]
nop dword [rax + rax]
test eax, eax
movzx edi, dil
cmove edi, r12d
add r14, r12
cmp r14, r12
jl 0x7ff7901b59f0
test dil, dil
je 0x7ff79022e1fc
mov bl, r12b
mov al, bl
mov rcx, qword [rbp + 0x3a0]
xor rcx, rsp
call fcn.7ff7901bf100
lea r11, [rsp + 0x4b0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x64]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x190]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x70], r12d
mov dword [rsp + 0x60], ebx
mov dword [rsp + 0x64], 0x208
call fcn.7ff7903021b8
mov edi, eax
test eax, eax
jne 0x7ff79022e1d4
cmp dword [rsp + 0x60], ebx
je 0x7ff79022e1d4
lea r9, [rsp + 0x64]
mov dword [rsp + 0x64], 0x208
lea r8, [rbp - 0x80]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x70]
call fcn.7ff79030232c
mov edi, eax
cmp dword [rsp + 0x70], ebx
je 0x7ff79022e1ef
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov dword [rsp + 0x70], ebx
test edi, edi
je 0x7ff7901b59ac
jmp 0x7ff7901b5a31
lea rdx, str.install.exe
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_shlwapi_obsolete_l1_1_0.dll_StrCmpICW]
nop dword [rax + rax]
test eax, eax
jne 0x7ff7901b5a34
jmp 0x7ff7901b5a31