Function at 0x1400d8e2c
Capabilities:
Persist via command processor registry key
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x2f8]
sub rsp, 0x3e0
mov rax, qword [0x1401e7e78]
xor rax, rsp
mov qword [rbp + 0x2d0], rax
mov dil, r8b
mov sil, dl
mov rbx, rcx
xor r15d, r15d
mov dword [rsp + 0x50], r15d
mov edx, 0x96b
mov rcx, qword [rcx + 8]
call fcn.140047348
test al, al
setne r14b
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x40], r15
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftCommand_Processor
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400d928a
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x60]
call fcn.140120be0
nop
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp - 0x80]
call fcn.140120be0
nop
xor edx, edx
mov r8d, 0x308
lea rcx, [rbp - 0x40]
call fcn.14013b230
test sil, sil
je 0x1400d9115
mov r9b, 1
mov r8, qword [rsp + 0x58]
lea rdx, [rsp + 0x70]
mov rcx, rbx
call fcn.1400d8af4
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.140120e10
lea rcx, [rsp + 0x70]
call fcn.140120ddc
lea rcx, [rsp + 0x60]
call fcn.140058574
mov rdi, rax
mov r8, qword [0x14021c5d8]
add r8, 0xf04
lea rdx, str.__sCmd_Autorun.cmd
lea rcx, [rbp - 0x40]
call fcn.1400d8a5c
xor edx, edx
lea rcx, [rbp - 0x3e]
call fcn.140122088
lea rcx, [rbp - 0x40]
test al, al
je 0x1400d9065
lea rax, str.____GHWNDNEW_
lea r8, [0x14016b508]
test r14b, r14b
cmovne r8, rax
mov edx, 0x184
call fcn.140001f38
xor edx, edx
lea rcx, [rsp + 0x60]
call fcn.140120ebc
test al, al
je 0x1400d8fed
lea rdi, [rbp - 0x40]
jmp 0x1400d9231
lea rcx, [rsp + 0x60]
call fcn.140058574
mov r9, rax
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
lea r8, [0x1401a7860]
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x70]
call fcn.140120be0
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.140120e10
lea rcx, [rsp + 0x70]
call fcn.140120ddc
lea rcx, [rbp - 0x80]
call fcn.140120ef0
test al, al
je 0x1400d9231
lea rcx, [rbp - 0x80]
call fcn.140058574
mov rdi, rax
jmp 0x1400d9231
mov byte [rsp + 0x20], 1
mov r9, qword [0x14021d130]
lea r8, str.File_not_found
mov edx, 0x10
call fcn.14002b0f8
lea rcx, [rsp + 0x60]
call fcn.140120ef0
test al, al
je 0x1400d90a6
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x70]
call fcn.140120bb8
nop
mov ebx, 1
jmp 0x1400d90e1
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x14015a140]
lea rcx, [rsp + 0x70]
call fcn.140120be0
nop
mov ebx, 2
mov dword [rsp + 0x50], ebx
mov rcx, rax
call fcn.140058574
mov rdi, rax
test bl, 2
je 0x1400d9103
and ebx, 0xfffffffd
lea rcx, [rsp + 0x70]
call fcn.140120ddc
nop
test bl, 1
je 0x1400d9231
lea rcx, [rbp - 0x70]
jmp 0x1400d922c
test dil, dil
je 0x1400d9152
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x70]
call fcn.140120be0
nop
mov ebx, 4
jmp 0x1400d916b
mov r9b, 1
mov r8, qword [rsp + 0x58]
lea rdx, [rbp - 0x70]
mov rcx, rbx
call fcn.1400d8af4
mov ebx, 8
mov dword [rsp + 0x50], ebx
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.140120e10
test bl, 8
je 0x1400d9192
and ebx, 0xfffffff7
mov dword [rsp + 0x50], ebx
lea rcx, [rbp - 0x70]
call fcn.140120ddc
nop
test bl, 4
je 0x1400d91a8
and ebx, 0xfffffffb
mov dword [rsp + 0x50], ebx
lea rcx, [rsp + 0x70]
call fcn.140120ddc
lea rcx, [rsp + 0x60]
call fcn.140120ef0
test al, al
je 0x1400d91ca
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x50]
call fcn.140120bb8
nop
or ebx, 0x10
jmp 0x1400d9202
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x14015a140]
lea rcx, [rbp - 0x60]
call fcn.140120be0
nop
or ebx, 0x20
mov dword [rsp + 0x50], ebx
mov rcx, rax
call fcn.140058574
mov rdi, rax
test bl, 0x20
je 0x1400d9223
and ebx, 0xffffffdf
lea rcx, [rbp - 0x60]
call fcn.140120ddc
nop
test bl, 0x10
je 0x1400d9231
lea rcx, [rbp - 0x50]
call fcn.140120ddc
or rax, 0xffffffffffffffff
inc rax
cmp word [rdi + rax*2], r15w
jne 0x1400d9235
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
mov r9d, 1
xor r8d, r8d
lea rdx, [0x140171908]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rbp - 0x80]
call fcn.140120ddc
nop
lea rcx, [rsp + 0x60]
call fcn.140120ddc
mov rcx, qword [rbp + 0x2d0]
xor rcx, rsp
call fcn.140139b10
lea r11, [rsp + 0x3e0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret