Function at 0x14000d340
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0xb0]
sub rsp, 0x1b0
lea rcx, [rbp + 0x58]
call fcn.14000d630
mov rsi, rax
lea rcx, [rbp]
call fcn.14000d630
nop
mov rdx, rax
lea rcx, [rbp - 0x58]
call fcn.14000ce60
mov rdi, rax
lea rcx, vtable.CVolCommonBaseWithMemManager.0
mov qword [rsp + 0x50], rcx
lea r15, vtable.CVolObject.0
mov qword [rsp + 0x50], r15
xor r14d, r14d
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], r14
lea rax, vtable.CWString.0
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x70]
mov qword [rbp + 0xe8], rax
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], r14
mov qword [rbp - 0x80], r14
lea r12, vtable.CVolMem.0
mov qword [rsp + 0x70], r12
mov qword [rbp - 0x78], r14
mov qword [rbp - 0x68], r14
mov qword [rbp - 0x70], r14
mov qword [rbp - 0x60], 0x40
mov qword [rsp + 0x68], r14
mov qword [rbp - 0x60], 0xfe
lea rax, vtable.CWConstString.0
mov qword [rsp + 0x50], rax
lea rax, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov qword [rsp + 0x68], rax
mov rbx, qword [rsi + 0x18]
test rbx, rbx
je 0x14000d43c
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x14000d430
jmp 0x14000d45b
mov rax, qword [rsi + 0x48]
test rax, rax
jne 0x14000d451
lea rbx, [0x14022f9b0]
mov rax, r14
jmp 0x14000d45b
mov rbx, qword [rsi + 0x38]
shr rax, 1
dec rax
lea esi, [rax + rax]
lea rdx, [0x14022f9b0]
mov rax, qword [rsp + 0x68]
test rax, rax
cmovne rdx, rax
mov qword [rsp + 0x40], r14
lea rax, [rbp + 0xe8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x20206
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x14000d4b8
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ebx, r14d
jmp 0x14000d51a
mov rdx, qword [rdi + 0x18]
test rdx, rdx
jne 0x14000d4d2
cmp qword [rdi + 0x48], rdx
lea rdx, [0x14022f9b0]
je 0x14000d4d2
mov rdx, qword [rdi + 0x38]
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rbx
mov ebx, 1
mov r9d, ebx
xor r8d, r8d
mov rcx, qword [rbp + 0xe8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
mov rcx, qword [rbp + 0xe8]
test eax, eax
je 0x14000d513
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ebx, r14d
jmp 0x14000d51a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rax, [rsp + 0x70]
mov qword [rbp + 0xe8], rax
mov qword [rsp + 0x70], r12
mov rdx, qword [rbp - 0x78]
test rdx, rdx
je 0x14000d541
lea rcx, [rsp + 0x70]
mov rax, qword [rsp + 0x70]
call qword [rax + 0x18]
mov qword [rbp - 0x78], r14
mov qword [rbp - 0x68], r14
mov qword [rbp - 0x70], r14
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x50], r15
lea rax, [rbp - 0x38]
mov qword [rbp + 0xe8], rax
mov qword [rbp - 0x38], r12
mov rdx, qword [rbp - 0x20]
test rdx, rdx
je 0x14000d57a
lea rcx, [rbp - 0x38]
mov rax, qword [rbp - 0x38]
call qword [rax + 0x18]
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x10], r14
mov qword [rbp - 0x18], r14
mov qword [rbp - 0x38], r15
mov qword [rbp - 0x58], r15
lea rax, [rbp + 0x20]
mov qword [rbp + 0xe8], rax
mov qword [rbp + 0x20], r12
mov rdx, qword [rbp + 0x38]
test rdx, rdx
je 0x14000d5b1
lea rcx, [rbp + 0x20]
mov rax, qword [rbp + 0x20]
call qword [rax + 0x18]
mov qword [rbp + 0x38], r14
mov qword [rbp + 0x48], r14
mov qword [rbp + 0x40], r14
mov qword [rbp + 0x20], r15
mov qword [rbp], r15
lea rax, [rbp + 0x78]
mov qword [rbp + 0xe8], rax
mov qword [rbp + 0x78], r12
mov rdx, qword [rbp + 0x90]
test rdx, rdx
je 0x14000d5ec
lea rcx, [rbp + 0x78]
mov r8, qword [rbp + 0x78]
call qword [r8 + 0x18]
mov qword [rbp + 0x90], r14
mov qword [rbp + 0xa0], r14
mov qword [rbp + 0x98], r14
mov qword [rbp + 0x78], r15
mov qword [rbp + 0x58], r15
mov eax, ebx
lea r11, [rsp + 0x1b0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret