Function at 0x140004bf0
Capabilities:
Persist via winlogon helper dll registry key
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov bl, 1
call fcn.140005e00
test al, al
jne 0x140002dd7
mov rcx, rdi
call fcn.140005580
movzx ebx, al
test al, al
je 0x140002e13
mov rcx, rdi
call fcn.140001730
test al, al
jne 0x140002df2
mov rcx, rdi
call fcn.140001c60
movzx ebx, al
test al, al
je 0x140002e13
mov rcx, rdi
call fcn.140004050
test al, al
jne 0x140002e10
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x140004bf0
movzx eax, bl
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0xf0
mov rax, qword [0x14000e248]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov r14, rcx
xor r15d, r15d
mov edi, r15d
mov dword [rbp - 0x59], r15d
mov r8, rcx
lea rdx, [rbp - 0x21]
lea rcx, [rbp - 0x29]
call fcn.140004ad0
movzx ebx, al
test al, al
je 0x140005121
mov dword [rbp - 0x59], r15d
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.IsWow64Process
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x140004c8d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rbp - 0x59]
call rbx
test eax, eax
je 0x140004c8d
mov eax, r15d
cmp dword [rbp - 0x59], eax
setne al
jmp 0x140004c90
mov eax, r15d
shl eax, 8
add eax, 0xf003f
mov qword [rbp - 0x41], r15
mov qword [rsp + 0x40], r15
lea rcx, [rbp - 0x41]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionWinLogon
mov rcx, qword [rbp + 0xf]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov rsi, qword [rbp - 0x41]
test rsi, rsi
je 0x140004da7
lea rcx, [rbp - 0x39]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QCoreApplication::applicationDirPath_void_]
nop
mov rdx, rax
lea rcx, [rbp - 0x51]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QDir::constructor_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp - 0x39]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
mov r8d, 0xffffffff
lea rdx, str.bspsh.exe
lea rcx, [rbp - 0x31]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromWCharArray_wchar_t_const____ptr64__int_]
nop
mov r8, rax
lea rdx, [rbp - 0x49]
lea rcx, [rbp - 0x51]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QDir::absoluteFilePath_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp - 0x31]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea rcx, [rbp - 0x49]
call qword [sym.imp.Qt5Core.dll_public:_unsigned_short_int_const____ptr64___cdecl_QString::utf16_void_const___ptr64]
test rax, rax
je 0x140004d84
mov rax, qword [rbp - 0x49]
mov ecx, dword [rax + 4]
lea ebx, [rcx*2 + 2]
lea rcx, [rbp - 0x49]
call qword [sym.imp.Qt5Core.dll_public:_unsigned_short_int_const____ptr64___cdecl_QString::utf16_void_const___ptr64]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.Shell
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140004d84
mov bl, 1
jmp 0x140004d86
xor bl, bl
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rbp - 0x49]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x51]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QDir::destructor_void____ptr64]
jmp 0x140004da9
xor bl, bl
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 6]
call fcn.140003f60
test al, al
je 0x140004edd
lea rdx, [rbp - 0x21]
lea rcx, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
call fcn.140004680
mov rsi, rax
test rax, rax
je 0x140004e35
test bl, bl
je 0x140004e15
mov edx, 0x2c
lea rcx, str._WINDIR_ResourcesThemesAero_aero.msstyles
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp - 0x51], rax
mov edi, 1
mov dword [rbp - 0x59], edi
lea r8, [rbp - 0x51]
lea rdx, str.SetVisualStyle
mov rcx, rsi
call fcn.140005160
test al, al
je 0x140004e15
movzx ebx, dil
jmp 0x140004e17
xor bl, bl
test dil, 1
je 0x140004e2a
and edi, 0xfffffffe
lea rcx, [rbp - 0x51]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140004e37
xor bl, bl
lea rdx, [rbp - 0x21]
lea rcx, str.SoftwareMicrosoftWindowsDWM
call fcn.140004680
mov rsi, rax
test rax, rax
je 0x140004edb
test bl, bl
je 0x140004ece
mov dword [rbp - 0x59], 1
mov dword [rsp + 0x28], 4
lea rax, [rbp - 0x59]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Composition
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140004ece
mov dword [rbp - 0x59], 2
mov dword [rsp + 0x28], 4
lea rax, [rbp - 0x59]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.CompositionPolicy
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140004ece
mov bl, 1
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140004edd
xor bl, bl
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140004edd
xor bl, bl
xor r8d, r8d
lea edx, [r8 + 1]
lea ecx, [rdx + 5]
call fcn.140003f60
test al, al
je 0x140005068
lea rdx, [rbp - 0x21]
lea rcx, str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers
call fcn.140004680
mov rsi, rax
test rax, rax
je 0x140005066
lea rcx, [rbp - 0x31]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QCoreApplication::applicationDirPath_void_]
nop
mov rdx, rax
lea rcx, [rbp - 0x49]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QDir::constructor_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp - 0x31]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
mov r8d, 0xffffffff
lea rdx, str.bsp.exe
lea rcx, [rbp - 0x59]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromWCharArray_wchar_t_const____ptr64__int_]
nop
mov r8, rax
lea rdx, [rbp - 0x39]
lea rcx, [rbp - 0x49]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QDir::absoluteFilePath_class_QString_const____ptr64____ptr64]
nop
mov rdx, rax
lea rcx, [rbp - 0x41]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QDir::toNativeSeparators_class_QString_const____ptr64_]
nop
lea rcx, [rbp - 0x39]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x59]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
test bl, bl
je 0x140004fd6
mov edx, 0xe
lea rcx, str._HIGHDPIAWARE
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp - 0x51], rax
or edi, 2
mov dword [rbp - 0x59], edi
lea rdx, [rbp + 0x17]
lea rcx, [rbp - 0x41]
call qword [sym.imp.Qt5Core.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____cdecl_QString::toStdWString_void____ptr64]
nop
or edi, 4
mov dword [rbp - 0x59], edi
cmp qword [rax + 0x18], 8
jb 0x140004fbf
mov rax, qword [rax]
lea r8, [rbp - 0x51]
mov rdx, rax
mov rcx, rsi
call fcn.140005160
test al, al
je 0x140004fd6
mov bl, 1
jmp 0x140004fd8
xor bl, bl
test dil, 4
je 0x140005035
and edi, 0xfffffffb
mov rdx, qword [rbp + 0x2f]
cmp rdx, 8
jb 0x140005024
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x17]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000501f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000501f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400064fc
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], 7
mov word [rbp + 0x17], r15w
test dil, 2
je 0x140005045
lea rcx, [rbp - 0x51]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rbp - 0x41]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x49]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QDir::destructor_void____ptr64]
jmp 0x140005068
xor bl, bl
cmp qword [str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem], 0
je 0x1400050f5
lea rdi, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
nop dword [rax]
test bl, bl
je 0x1400050f9
mov rdx, qword [rdi - 8]
mov rcx, qword [rdi]
cmp rdx, 0xffffffff80000001
jne 0x14000509f
lea rdx, [rbp - 0x21]
call fcn.140004680
jmp 0x1400050a4
call fcn.1400045c0
mov rsi, rax
test rax, rax
je 0x14000514d
mov eax, dword [rdi + 0x10]
mov dword [rbp - 0x59], eax
mov dword [rsp + 0x28], 4
lea rax, [rbp - 0x59]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rdx, qword [rdi + 8]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete bl
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rdi, 0x20
cmp qword [rdi], 0
jne 0x140005080
test bl, bl
jne 0x140005109
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov rdx, r14
call fcn.140001260
mov rdx, qword [rbp + 0xf]
mov rcx, qword [rbp - 0x29]
call qword [sym.imp.USERENV.dll_UnloadUserProfile]
mov rcx, qword [rbp - 0x29]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, bl
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.140006610
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
xor bl, bl
jmp 0x1400050f9