Function at 0x140012690
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x14007f080]
xor rax, rsp
mov qword [rsp + 0x70], rax
movzx r12d, r9b
mov rdi, rdx
mov rbx, rcx
call fcn.140001a70
mov rcx, rax
test rax, rax
je 0x14001298d
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x58], rax
mov r14, 0xffffffffffffffff
xor r13d, r13d
test rbx, rbx
je 0x14001271c
cmp rbx, 0x10000
jae 0x140012707
movzx edx, bx
lea rcx, [rsp + 0x58]
call fcn.140002950
jmp 0x14001272d
mov r8, r14
nop word [rax + rax]
inc r8
cmp word [rbx + r8*2], r13w
jne 0x140012710
jmp 0x14001271f
mov r8d, r13d
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.140002da0
nop
call fcn.140001a70
mov rcx, rax
test rax, rax
je 0x140012998
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x60], rax
mov r8, rdi
lea rdx, [0x14006f080]
lea rcx, [rsp + 0x60]
call fcn.140002f70
mov rbx, qword [rsp + 0x58]
cmp dword [rbx - 0x10], 0
jl 0x1400127c0
lea rdx, [0x14006f07c]
mov rcx, rbx
call fcn.1400407c8
test rax, rax
je 0x1400127c0
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
je 0x1400127c0
nop dword [rax + rax]
mov esi, eax
add eax, 1
js 0x1400127c4
cmp eax, dword [rbx - 0x10]
jg 0x1400127c4
cdqe
lea rcx, [rbx + rax*2]
lea rdx, [0x14006f07c]
call fcn.1400407c8
test rax, rax
je 0x1400127c4
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
jne 0x140012790
jmp 0x1400127c4
mov esi, dword [rsp + 0x68]
cmp esi, 0xffffffff
je 0x140012874
mov edi, dword [rbx - 0x10]
mov eax, edi
mov r15d, r13d
test esi, esi
cmovns r15d, esi
mov ebp, r13d
sub eax, esi
cmovns ebp, eax
mov eax, 0x7fffffff
sub eax, ebp
cmp eax, r15d
jl 0x1400129a3
lea eax, [r15 + rbp]
mov ecx, edi
sub ecx, r15d
cmp eax, edi
cmovg ebp, ecx
test ebp, ebp
jle 0x140012874
mov esi, edi
sub esi, ebp
sub edi, r15d
sub edi, ebp
inc edi
cmp dword [rbx - 8], 1
jle 0x140012828
mov edx, dword [rbx - 0x10]
lea rcx, [rsp + 0x58]
call fcn.140002cd0
mov rbx, qword [rsp + 0x58]
movsxd r8, edi
movsxd rcx, r15d
movsxd rax, ebp
add rax, rcx
lea rdx, [rbx + rax*2]
lea rcx, [rbx + rcx*2]
add r8, r8
je 0x140012858
test rcx, rcx
je 0x140012971
test rdx, rdx
je 0x140012971
call fcn.14005f680
test esi, esi
js 0x140012982
cmp esi, dword [rbx - 0xc]
jg 0x140012982
mov dword [rbx - 0x10], esi
movsxd rax, esi
mov word [rbx + rax*2], r13w
lea rcx, [r12 - 0x7fffffff]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov rdi, qword [rsp + 0x60]
test eax, eax
je 0x1400128c2
xor bl, bl
jmp 0x14001290c
mov esi, dword [rdi - 0x10]
cmp dword [rdi - 8], 1
jle 0x1400128dc
mov edx, esi
lea rcx, [rsp + 0x60]
call fcn.140002cd0
mov rdi, qword [rsp + 0x60]
lea eax, [rsi + rsi]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
mov r9d, 1
xor r8d, r8d
mov rdx, rbx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov bl, 1
lea rdx, [rdi - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140012927
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r14d
sub r14d, 1
jg 0x140012946
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
movzx eax, bl
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14003f1d0
mov rbx, qword [rsp + 0xd0]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.14004b500
nop
mov dword [rax], 0x16
call fcn.14004b3dc
mov ecx, 0x80070057
call fcn.1400018b0
nop
mov ecx, 0x80004005
call fcn.1400018b0
nop
mov ecx, 0x80004005
call fcn.1400018b0
nop
mov ecx, 0x80070216
call fcn.1400018b0
int3