Function at 0x1401e9aeb
Capabilities:
Persist via winlogon helper dll registry key

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xa0
movaps xmmword [rsp + 0x90], xmm6
mov rax, qword [0x14030d038]
xor rax, rsp
mov qword [rsp + 0x88], rax
call fcn.1400ec2f0
lea ecx, [rax - 7]
mov esi, 1
cmp ecx, 4
jae 0x1401e9b46
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140115e50
mov eax, esi
movaps xmm6, xmmword [rsp + 0x90]
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
ret
cmp eax, 0x13
jge 0x1401e9d2b
mov ecx, 0x1d
call qword [sym.imp.SHLWAPI.dll_IsOS]
test eax, eax
jne 0x1401e9b21
lea rcx, [rsp + 0x84]
mov dword [rcx], 0
call qword [sym.imp.USERENV.dll_GetProfileType]
test eax, eax
je 0x1401e9b85
mov esi, 2
test byte [rsp + 0x84], 1
jne 0x1401e9b21
call fcn.14018c360
test al, al
jne 0x1401e9bc2
call fcn.1400c2420
mov esi, 1
cmp dword [rax + 0x14], 3
je 0x1401e9b21
mov esi, 3
call fcn.140169dd0
test al, al
jne 0x1401e9b21
mov esi, 4
call fcn.1401d0fd0
test al, al
jne 0x1401e9b21
call fcn.1401e99a6
mov esi, 5
cmp eax, 1
je 0x1401e9b21
mov ecx, 0x43
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov esi, 6
test eax, eax
jne 0x1401e9b21
lea rcx, str.SYSTEMSetupStatus
lea rdx, str.AuditBoot
call fcn.1401e9e32
mov esi, 7
test al, al
jne 0x1401e9b21
lea rcx, str.SOFTWAREMicrosoftWindowsCurrentVersionRetailDemoOobeWrite
lea rdx, str.Enabled
call fcn.1401e9e32
mov esi, 8
test al, al
jne 0x1401e9b21
lea rcx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
lea rdx, str.AutoAdminLogon
call fcn.1401e9e32
mov esi, 9
test al, al
jne 0x1401e9b21
lea rcx, str.AutoAdminLogon
call fcn.1401e9ed0
test al, al
jne 0x1401e9b21
lea rcx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
lea rdx, str.ForceAutoLogon
call fcn.1401e9e32
test al, al
jne 0x1401e9b21
lea rcx, str.ForceAutoLogon
call fcn.1401e9ed0
test al, al
jne 0x1401e9b21
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x60]
mov qword [rsi + 0x10], rax
movaps xmm0, xmmword [0x1402ae190]
movaps xmmword [rsi], xmm0
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
mov rcx, rsi
mov rdx, 0xffffffff80000002
mov r9d, 1
call fcn.140185540
cmp qword [rsi], 0
je 0x1401e9d65
xorps xmm0, xmm0
lea rsi, [rsp + 0x40]
movaps xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
lea rdx, str.shell
lea rcx, [rsp + 0x60]
mov r8, rsi
call fcn.14015c930
test eax, eax
je 0x1401e9d3d
mov esi, 4
mov dil, 1
cmp byte [rsp + 0x57], 0
jns 0x1401e9d17
mov rcx, qword [rsp + 0x40]
call fcn.140112038
test dil, dil
jne 0x1401e9d65
lea rcx, [rsp + 0x60]
call fcn.1400e6d80
jmp 0x1401e9b21
call fcn.1401e99a6
test eax, eax
jne 0x1401e9b4f
jmp 0x1401e9b21
cmp byte [rsp + 0x57], 0
jns 0x1401e9d49
mov rsi, qword [rsp + 0x40]
lea rdx, str.explorer.exe
mov rcx, rsi
call fcn.140113054
test eax, eax
je 0x1401e9cfe
mov esi, 0xa
xor edi, edi
jmp 0x1401e9d06
lea rcx, str.SOFTWAREMicrosoftWindowsCurrentVersionSetupOOBE
lea rdx, str.UnattendSetAutologon
call fcn.1401e9e32
mov esi, 0xb
test al, al
jne 0x1401e9d1c
xorps xmm6, xmm6
lea rdi, [rsp + 0x40]
movaps xmmword [rdi], xmm6
mov qword [rdi + 0x10], 0
mov rcx, rdi
call fcn.14014e820
test al, al
jne 0x1401e9dbc
xor esi, esi
cmp byte [rsp + 0x57], 0
jns 0x1401e9d1c
mov rcx, qword [rsp + 0x40]
call fcn.140112038
jmp 0x1401e9d1c
lea rsi, [rsp + 0x20]
movaps xmmword [rsi], xmm6
mov qword [rsi + 0x10], 0
lea rdx, str.SOFTWAREMicrosoftWindowsAssignedAccessConfigurationConfigs_
mov rcx, rsi
call fcn.1400ebece
cmp byte [rsp + 0x57], 0
jns 0x1401e9de7
mov rdi, qword [rsp + 0x40]
mov rcx, rax
mov rdx, rdi
call fcn.1400ebece
cmp byte [rsp + 0x37], 0
jns 0x1401e9dfe
mov rsi, qword [rsp + 0x20]
lea rdx, str.ConfigSource
mov rcx, rsi
call fcn.1401e9e32
mov ebx, eax
cmp byte [rsp + 0x37], 0
jns 0x1401e9e20
mov rcx, qword [rsp + 0x20]
call fcn.140112038
mov esi, 0xc
test bl, bl
je 0x1401e9da0
jmp 0x1401e9da2