Function at 0x180005a70
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Persist via contextmenuhandlers registry key
Set registry value

Disassembly:
mov r11, rsp
push rbp
push rdi
lea rbp, [r11 - 0xe78]
sub rsp, 0xf68
mov rax, qword [0x180033008]
xor rax, rsp
mov qword [rbp + 0xe40], rax
mov rcx, qword [0x1800351e0]
lea rdx, [rbp + 0x410]
mov qword [r11 - 0x18], r13
mov r8d, 0x104
mov qword [r11 - 0x28], r15
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor edx, edx
lea rcx, [rbp + 0x410]
lea r8d, [rdx + 0x5c]
call qword [sym.imp.SHLWAPI.dll_StrRChrW]
xor edi, edi
lea rdx, str.eys_master.exe
lea rcx, [rbp + 0x410]
mov word [rax + 2], di
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x410]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
je 0x180005b03
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [0x1800351e0]
lea rdx, [rbp + 0x620]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor edx, edx
lea rcx, [rbp + 0x830]
mov r8d, 0x400
call fcn.18000bdf0
xor edx, edx
mov dword [rsp + 0x50], 0x20323b27
mov r8d, 0x400
mov dword [rsp + 0x54], 0x31263523
lea rcx, [rbp + 0x10]
mov dword [rsp + 0x58], 0x373d3908
mov dword [rsp + 0x5c], 0x3b273b26
mov dword [rsp + 0x60], 0x23082032
mov dword [rsp + 0x64], 0x3b303a3d
mov dword [rsp + 0x68], 0x37082723
mov dword [rsp + 0x6c], 0x31262621
mov dword [rsp + 0x70], 0x3122203a
mov dword [rsp + 0x74], 0x3b3d2726
mov dword [rsp + 0x78], 0x2c31083a
mov dword [rsp + 0x7c], 0x263b3824
mov dword [rbp - 0x80], 0x27082631
mov dword [rbp - 0x7c], 0x3838313c
mov dword [rbp - 0x78], 0x3a3b373d
mov dword [rbp - 0x74], 0x2631223b
mov dword [rbp - 0x70], 0x3d2d3538
mov dword [rbp - 0x6c], 0x203a3130
mov dword [rbp - 0x68], 0x313d323d
mov dword [rbp - 0x64], 0x38082726
mov dword [rbp - 0x60], 0x21333a35
mov dword [rbp - 0x5c], 0x3c333a35
mov dword [rbp - 0x58], 0x3a352d21
mov word [rbp - 0x54], 0x2c31
call fcn.18000bdf0
mov eax, dword [rbp - 0x58]
mov ecx, 0x5f
movaps xmm0, xmmword [rsp + 0x50]
movaps xmm1, xmmword [rsp + 0x60]
movups xmmword [rbp + 0x10], xmm0
mov dword [rbp + 0x68], eax
movaps xmm0, xmmword [rsp + 0x70]
movzx eax, word [rbp - 0x54]
movups xmmword [rbp + 0x20], xmm1
mov word [rbp + 0x6c], ax
lea rax, [rbp + 0x10]
movaps xmm1, xmmword [rbp - 0x80]
movups xmmword [rbp + 0x30], xmm0
mov byte [rbp + 0x6e], 0x20
movaps xmm0, xmmword [rbp - 0x70]
movups xmmword [rbp + 0x40], xmm1
movsd xmm1, qword [rbp - 0x60]
movups xmmword [rbp + 0x50], xmm0
movsd qword [rbp + 0x60], xmm1
nop word [rax + rax]
xor byte [rax], 0x54
lea rax, [rax + 1]
sub rcx, 1
jne 0x180005c50
mov rcx, rdi
movzx eax, byte [rbp + rcx + 0x10]
mov byte [rbp + rcx + 0x830], al
lea rcx, [rcx + 1]
test al, al
jne 0x180005c60
mov qword [rbp - 0x38], 0xf
mov qword [rbp - 0x40], rdi
mov byte [rbp - 0x50], dil
cmp byte [rbp + 0x830], dil
jne 0x180005c92
mov r8, rdi
jmp 0x180005ca9
lea rax, [rbp + 0x830]
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], dil
jne 0x180005ca0
lea rdx, [rbp + 0x830]
lea rcx, [rbp - 0x50]
call fcn.180003f20
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x18]
call fcn.180007f80
mov rax, qword gs:[0x58]
lea r13, str.2235625B_050A_45CC_B626_CC5E6884B1EB
mov ecx, dword [0x1800344d0]
mov r8d, 4
mov rdx, qword [rax + rcx*8]
mov eax, dword [r8 + rdx]
cmp dword [0x1800351f8], eax
jle 0x180005f7c
lea rcx, [0x1800351f8]
call fcn.180008900
cmp dword [0x1800351f8], 0xffffffff
jne 0x180005f7c
cmp qword [rbp], 8
lea rcx, str.CLSID_sSettings
lea rax, [rbp + 0x620]
mov qword [0x180033a40], rcx
mov qword [0x180033a08], rax
xorps xmm0, xmm0
lea rax, str.CLSID_sInprocServer32
mov qword [0x180033a68], rcx
mov qword [0x180033a18], rax
lea rax, str.ThreadingModel
mov qword [0x180033a20], rax
lea rax, str.Apartment
mov qword [0x180033a30], rax
lea rax, str.Title
mov qword [0x180033a48], rax
lea rax, [0x18002dc58]
mov qword [0x180033a58], rax
lea rax, str.Path
mov qword [0x180033a70], rax
lea rax, [rbp + 0x410]
mov qword [0x180033a80], rax
lea rax, str.Custom
mov qword [0x180033a98], rax
lea rax, [0x18002d964]
mov qword [0x180033aa8], rax
lea rax, str.ShowIcon
mov qword [0x180033ac0], rax
lea rax, [0x180033bcc]
mov qword [0x180033ad0], rax
lea rax, str.Dynamic
mov qword [0x180033ae8], rax
lea rax, [0x180033bd0]
mov qword [0x180033af8], rax
lea rax, str.Maxtext
mov qword [0x180033b10], rax
lea rax, [0x180033bd4]
mov qword [0x180033b20], rax
lea rax, str._shellexContextMenuHandlerslanguanghuyanext64
mov qword [0x180033b30], rax
lea rax, str.Directory_shellexContextMenuHandlerslanguanghuyanext64
mov qword [0x180033b58], rax
lea rax, [rbp - 0x18]
cmovae rax, qword [rbp - 0x18]
mov qword [0x180033a90], rcx
mov qword [0x180033ab8], rcx
mov qword [0x180033ae0], rcx
mov qword [0x180033b08], rcx
lea rcx, [0x1800351f8]
mov qword [0x180033b80], rax
mov qword [0x180033a10], 0xffffffff80000000
mov dword [0x180033a28], 1
mov qword [0x180033a38], 0xffffffff80000000
mov dword [0x180033a50], 1
mov qword [0x180033a60], 0xffffffff80000000
mov dword [0x180033a78], 1
mov qword [0x180033a88], 0xffffffff80000000
mov dword [0x180033aa0], 1
mov qword [0x180033ab0], 0xffffffff80000000
mov dword [0x180033ac8], 4
mov qword [0x180033ad8], 0xffffffff80000000
mov dword [0x180033af0], 4
mov qword [0x180033b00], 0xffffffff80000000
mov dword [0x180033b18], 4
mov qword [0x180033b28], 0xffffffff80000000
mov qword [0x180033b38], rdi
mov dword [0x180033b40], 1
mov qword [0x180033b48], r13
mov qword [0x180033b50], 0xffffffff80000000
mov qword [0x180033b60], rdi
mov dword [0x180033b68], 1
mov qword [0x180033b70], r13
mov qword [0x180033b78], 0xffffffff80000002
mov qword [0x180033b88], rdi
mov dword [0x180033b90], 1
mov qword [0x180033b98], r13
movdqa xmmword [0x180033ba0], xmm0
mov qword [0x180033bb0], rdi
mov dword [0x180033bb8], 1
mov qword [0x180033bc0], rdi
call fcn.1800088a0
mov qword [rsp + 0xf80], rbx
mov qword [rsp + 0xf88], rsi
mov qword [rsp + 0xf90], r12
mov qword [rsp + 0xf58], r14
call fcn.1800061a0
cmp qword [0x1800339c0], rdi
mov r15d, edi
je 0x1800060a9
lea r12, [0x1800339c0]
mov rsi, rdi
mov r14, r12
mov rbx, rdi
mov rdx, qword [rbx + r12 + 8]
lea rcx, [rbp + 0xc30]
mov r8, r13
call qword [sym.imp.USER32.dll_wsprintfW]
mov rcx, qword [r14]
lea rax, [rbp - 0x20]
mov qword [rsp + 0x40], rax
lea rdx, [rbp + 0xc30]
lea rax, [rbp - 0x28]
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
movsxd r14, eax
test eax, eax
jne 0x180006100
mov r9d, dword [rbx + r12 + 0x18]
cmp r9d, 1
jne 0x18000605b
mov rdx, qword [rbx + r12 + 0x20]
lea r8, [rbp + 0x620]
lea rcx, [rbp + 0x10]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r9d, dword [rbx + r12 + 0x18]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x10]
jmp 0x180006068
mov rax, qword [rbx + r12 + 0x20]
mov dword [rsp + 0x28], 4
mov rdx, qword [rbx + r12 + 0x10]
xor r8d, r8d
mov rcx, qword [rbp - 0x28]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc rsi
inc r15d
lea rax, [rsi + rsi*4]
lea rbx, [rax*8]
cmp qword [rbx + r12], rdi
lea r14, [rbx + r12]
jne 0x180005fc1
mov edi, 1
mov rax, qword [rbp]
mov r15, qword [rsp + 0xf50]
mov r14, qword [rsp + 0xf58]
mov r13, qword [rsp + 0xf60]
mov r12, qword [rsp + 0xf90]
mov rsi, qword [rsp + 0xf88]
mov rbx, qword [rsp + 0xf80]
cmp rax, 8
jb 0x180006159
mov rcx, qword [rbp - 0x18]
inc rax
movabs rdx, 0x7fffffffffffffff
cmp rax, rdx
jbe 0x180006129
jmp 0x180006174
xor edx, edx
lea rcx, [rbp + 0x10]
mov r8d, 0x400
call fcn.18000bdf0
mov r9, r14
lea rdx, str.RegCreateKeyEx_error:_d__d
mov r8d, r15d
lea rcx, [rbp + 0x10]
call fcn.180005270
jmp 0x1800060ae
add rax, rax
cmp rax, 0x1000
jb 0x180006154
test cl, 0x1f
jne 0x18000617a
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x180006180
sub rcx, rax
cmp rcx, 8
jb 0x180006186
cmp rcx, 0x27
ja 0x18000618c
mov rcx, rax
call fcn.180008748
mov eax, edi
mov rcx, qword [rbp + 0xe40]
xor rcx, rsp
call fcn.1800086e0
add rsp, 0xf68
pop rdi
pop rbp
ret
call fcn.180010dc4
int3
call fcn.180010dc4
int3
call fcn.180010dc4
int3
call fcn.180010dc4
int3
call fcn.180010dc4
int3