Function at 0x14009aaa0
Capabilities:
Persist via winlogon helper dll registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x3b0]
sub rsp, 0x4b0
mov rax, qword [0x140387a48]
xor rax, rsp
mov qword [rbp + 0x3a0], rax
mov r15, rcx
lea rax, [rsp + 0x78]
mov rdi, 0xffffffff80000002
mov qword [rsp + 0x20], rax
xor r12d, r12d
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionWinlogonAlternateShellsAvailableShells
mov rcx, rdi
mov dword [rsp + 0x70], r12d
mov r9d, 0x20019
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
lea ebx, [r12 + 1]
lea rax, [rsp + 0x60]
je 0x140192748
mov qword [rsp + 0x30], rax
lea r9d, [r12 + 2]
lea rax, [rbp - 0x80]
mov dword [rsp + 0x60], 0x208
mov qword [rsp + 0x28], rax
lea r8, str.Shell
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionWinlogon
mov qword [rsp + 0x20], r12
mov rcx, rdi
call qword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHRegGetValueW]
nop dword [rax + rax]
test eax, eax
jne 0x1401927da
lea rcx, [rbp - 0x80]
call qword [sym.imp.api_ms_win_shlwapi_winrt_storage_l1_1_1.dll_PathRemoveArgsW]
nop dword [rax + rax]
lea rcx, [rbp - 0x80]
call qword [sym.imp.api_ms_win_core_shlwapi_legacy_l1_1_0.dll_PathRemoveBlanksW]
nop dword [rax + rax]
lea rcx, [rbp - 0x80]
call qword [sym.imp.api_ms_win_core_shlwapi_legacy_l1_1_0.dll_PathFindFileNameW]
nop dword [rax + rax]
lea rsi, [0x14030cb68]
mov dil, r12b
mov r14, r12
cmp word [rax], r12w
cmovne rsi, rax
test dil, dil
jne 0x14009abe9
mov rdx, qword [r15 + r14*8]
or r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], r12w
jne 0x14009abb6
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_shlwapi_obsolete_l1_1_0.dll_StrCmpNIW]
nop dword [rax + rax]
test eax, eax
movzx edi, dil
cmove edi, ebx
add r14, rbx
cmp r14, rbx
jl 0x14009aba9
test dil, dil
je 0x1401927ec
mov al, bl
mov rcx, qword [rbp + 0x3a0]
xor rcx, rsp
call fcn.1400a15a0
lea r11, [rsp + 0x4b0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x64]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x190]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x70], ebx
mov dword [rsp + 0x60], r12d
mov dword [rsp + 0x64], 0x208
call fcn.140200630
mov edi, eax
test eax, eax
jne 0x1401927bb
cmp dword [rsp + 0x60], r12d
je 0x1401927bb
lea r9, [rsp + 0x64]
mov dword [rsp + 0x64], 0x208
lea r8, [rbp - 0x80]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x70]
call fcn.1402007a4
mov edi, eax
cmp dword [rsp + 0x70], r12d
je 0x1401927df
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov dword [rsp + 0x70], r12d
jmp 0x1401927df
mov edi, 0x103
test edi, edi
jne 0x14009abe9
jmp 0x14009ab64
lea rdx, str.install.exe
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_shlwapi_obsolete_l1_1_0.dll_StrCmpICW]
nop dword [rax + rax]
test eax, eax
je 0x14009abe9
mov bl, r12b
jmp 0x14009abe9