Function at 0x1401a86f0
Capabilities:
Change the wallpaper
Delete registry key
Delete registry value
Persist via appinit_dlls registry key
Persist via default file association registry key
Persist via winlogon helper dll registry key
Set registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xc0
mov qword [rbp + 0x17], 0xfffffffffffffffe
mov qword [rsp + 0x118], rbx
mov r13, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rbp - 0x69], rcx
xor ebx, ebx
mov r14d, ebx
mov dword [rbp - 0x19], ebx
lea r12, [0x140323de0]
mov qword [rbp + 7], r12
mov qword [rbp + 0xf], rbx
xor r8d, r8d
lea rdx, str.Control_PanelDesktopWallpaper
mov rcx, rdi
call fcn.1401e8da0
test al, al
jne 0x1401a877e
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftInternet_ExplorerDesktopGeneralWallpaper
mov rcx, rdi
call fcn.1401e8da0
test al, al
jne 0x1401a877e
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftInternet_ExplorerDesktopComponents
mov rcx, rdi
call fcn.1401e8da0
test al, al
je 0x1401a8782
mov byte [rsi + 9], 1
xor r8d, r8d
lea rdx, str._shellopencommand_
mov rcx, rdi
call fcn.1401e8ee0
xor r8d, r8d
mov rcx, rdi
test al, al
je 0x1401a8a39
mov dl, 1
call fcn.1400ecf50
mov r15, rax
test rax, rax
je 0x1401a9bdc
xor r8d, r8d
lea rdx, str.StartMenuInternet_
mov rcx, rdi
call fcn.1401e9960
mov ebx, eax
test eax, eax
jle 0x1401a89f9
mov qword [rbp - 0x59], r12
xor r13d, r13d
mov qword [rbp - 0x51], r13
lea r8, [rbp - 0x59]
xor edx, edx
mov rcx, r15
call fcn.1400d5720
lea esi, [r13 + 1]
test al, al
je 0x1401a89e8
lea r8d, [rbx + 0x12]
lea rdx, [0x1403232c8]
mov rcx, rdi
call fcn.1401e9840
test eax, eax
jle 0x1401a89e8
lea r9d, [rax + 1]
xor r8d, r8d
lea rdx, [rbp - 0x39]
mov rcx, rdi
call fcn.1401eb1b0
nop
lea rdx, str.DefaultIcon
mov rcx, rax
call fcn.1401e7680
mov rbx, rax
mov qword [rbp - 0x41], r13
mov edx, dword [rax + 0xc]
test edx, edx
jne 0x1401a8848
mov qword [rbp - 0x49], r12
jmp 0x1401a8869
lea rcx, [rbp - 0x49]
call fcn.1401e9030
movsxd r9, dword [rbx + 0xc]
mov eax, dword [rbp - 0x41]
inc eax
movsxd rdx, eax
mov r8, qword [rbx]
mov rcx, qword [rbp - 0x49]
call fcn.14029b4d8
mov edx, dword [rbx + 0xc]
lea rcx, [rbp - 0x49]
call fcn.1401ea290
nop
cmp dword [rbp - 0x31], 0
jle 0x1401a8885
mov rcx, qword [rbp - 0x39]
call fcn.140298600
xor r8d, r8d
xor edx, edx
lea rcx, [rbp - 0x49]
call fcn.1400ecf50
mov rdi, rax
test rax, rax
je 0x1401a89d8
mov qword [rbp - 0x69], r12
mov qword [rbp - 0x61], r13
lea r8, [rbp - 0x69]
xor edx, edx
mov rcx, rax
call fcn.1400d5720
test al, al
je 0x1401a89bd
xor r8d, r8d
lea rdx, str..exe_
lea rcx, [rbp - 0x69]
call fcn.1401e9960
test eax, eax
jle 0x1401a89bd
lea r9d, [rax + 4]
xor r8d, r8d
lea rdx, [rbp - 0x39]
lea rcx, [rbp - 0x69]
call fcn.1401eb1b0
mov rbx, rax
mov edx, dword [rax + 0xc]
lea rcx, [rbp - 0x69]
call fcn.1401e9030
movsxd r9, dword [rbx + 0xc]
mov eax, dword [rbp - 0x61]
inc eax
movsxd rdx, eax
mov r8, qword [rbx]
mov rcx, qword [rbp - 0x69]
call fcn.14029b4d8
mov edx, dword [rbx + 0xc]
lea rcx, [rbp - 0x69]
call fcn.1401ea290
nop
cmp dword [rbp - 0x31], 0
jle 0x1401a892f
mov rcx, qword [rbp - 0x39]
call fcn.140298600
mov r8, qword [rbp - 0x69]
lea rdx, [0x14032b1f8]
lea rcx, [rbp - 0x39]
call fcn.1401e94c0
mov rbx, rax
mov edx, dword [rax + 0xc]
lea rcx, [rbp - 0x59]
call fcn.1401e9030
movsxd r9, dword [rbx + 0xc]
mov eax, dword [rbp - 0x51]
inc eax
movsxd rdx, eax
mov r8, qword [rbx]
mov rcx, qword [rbp - 0x59]
call fcn.14029b4d8
mov edx, dword [rbx + 0xc]
lea rcx, [rbp - 0x59]
call fcn.1401ea290
nop
cmp dword [rbp - 0x31], 0
jle 0x1401a8986
mov rcx, qword [rbp - 0x39]
call fcn.140298600
mov rax, qword [rbp - 0x59]
or rbx, 0xffffffffffffffff
nop
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401a8990
add ebx, ebx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
mov r9d, esi
xor r8d, r8d
xor edx, edx
mov rcx, qword [r15 + 8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
cmove r14d, esi
mov rax, qword [rdi]
mov edx, esi
mov rcx, rdi
call qword [rax]
nop
cmp dword [rbp - 0x61], 0
jle 0x1401a89d8
mov rcx, qword [rbp - 0x69]
call fcn.140298600
nop
cmp dword [rbp - 0x41], 0
jle 0x1401a89e8
mov rcx, qword [rbp - 0x49]
call fcn.140298600
nop
cmp dword [rbp - 0x51], 0
jle 0x1401a8a2a
mov rcx, qword [rbp - 0x59]
call fcn.140298600
jmp 0x1401a8a2a
mov dword [rsp + 0x28], 0xe
lea rax, str.__1___
mov qword [rsp + 0x20], rax
mov esi, 1
mov r9d, esi
xor r8d, r8d
xor edx, edx
mov rcx, qword [r15 + 8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
cmove r14d, esi
mov rax, qword [r15]
mov edx, esi
mov rcx, r15
call qword [rax]
jmp 0x1401a9bdc
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
call fcn.1401e8da0
test al, al
je 0x1401a8ca9
cmp dword [rdi + 0xc], 0
je 0x1401a9bdc
mov edx, 0x5c
mov rcx, qword [rdi]
call fcn.14029aea8
mov rbx, rax
test rax, rax
je 0x1401a9bdc
sub rbx, qword [rdi]
sar rbx, 1
test ebx, ebx
jle 0x1401a9bdc
mov r9d, ebx
xor r8d, r8d
lea rdx, [rbp - 0x49]
mov rcx, rdi
call fcn.1401eb1b0
nop
inc ebx
mov r9d, dword [rdi + 0xc]
sub r9d, ebx
mov r8d, ebx
lea rdx, [rbp - 0x69]
mov rcx, rdi
call fcn.1401eb1b0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rbp - 0x49]
call fcn.1400ecf50
mov rdi, rax
test rax, rax
jne 0x1401a8ae0
mov rbx, qword [rbp - 0x49]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov r8, rbx
lea rcx, str.Error__d_while_opening__s_r_n
call fcn.1401a2060
jmp 0x1401a8c81
mov r8, qword [rbp - 0x69]
mov rdx, qword [rbp - 0x49]
lea rcx, str._s_:___s__r_n
call fcn.1401a2060
xor bl, bl
xor r8d, r8d
lea rdx, str.Shell
lea rcx, [rbp - 0x69]
call fcn.1401e9310
mov esi, 1
xor r8d, r8d
test al, al
je 0x1401a8b41
mov dword [rsp + 0x28], 0x18
lea rax, [0x1403286e0]
mov qword [rsp + 0x20], rax
mov r9d, esi
mov rdx, qword [rbp - 0x69]
mov rcx, qword [rdi + 8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jmp 0x1401a8c67
lea rdx, str.System
lea rcx, [rbp - 0x69]
call fcn.1401e9310
xor r8d, r8d
test al, al
je 0x1401a8b64
mov dword [rsp + 0x28], r8d
mov qword [rsp + 0x20], r12
jmp 0x1401a8b29
lea rdx, str.UserInit
lea rcx, [rbp - 0x69]
call fcn.1401e9310
test al, al
je 0x1401a8c36
xor eax, eax
mov qword [rbp - 0x51], rax
lea edx, [rax + 0xc]
lea rcx, [rbp - 0x59]
call fcn.1401e9030
mov eax, dword [rbp - 0x51]
inc eax
movsxd rdx, eax
mov r9d, 0xc
lea r8, str.userinit.exe
mov rcx, qword [rbp - 0x59]
call fcn.14029b4d8
mov edx, 0xc
lea rcx, [rbp - 0x59]
call fcn.1401ea290
nop
mov edx, 0x25
lea rcx, [rbp - 0x11]
call fcn.1401f44e0
nop
lea r8, [rbp - 0x59]
mov rdx, rax
lea rcx, [rbp - 0x39]
call fcn.1400d1690
mov ecx, dword [rax + 0xc]
mov rdx, qword [rax]
lea eax, [rcx + rcx]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
mov r9d, esi
xor r8d, r8d
mov rdx, qword [rbp - 0x69]
mov rcx, qword [rdi + 8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete bl
cmp dword [rbp - 0x31], 0
jle 0x1401a8c15
mov rcx, qword [rbp - 0x39]
call fcn.140298600
nop
cmp dword [rbp - 9], 0
jle 0x1401a8c25
mov rcx, qword [rbp - 0x11]
call fcn.140298600
nop
cmp dword [rbp - 0x51], 0
jle 0x1401a8c6a
mov rcx, qword [rbp - 0x59]
call fcn.140298600
jmp 0x1401a8c6a
xor r8d, r8d
lea rdx, str.Taskman
lea rcx, [rbp - 0x69]
call fcn.1401e9310
test al, al
je 0x1401a8c6a
mov rdx, qword [rbp - 0x69]
mov rcx, qword [rdi + 8]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ebx, eax
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test ebx, ebx
sete bl
mov r14d, 3
test bl, bl
cmovne r14d, esi
mov rax, qword [rdi]
mov edx, esi
mov rcx, rdi
call qword [rax]
nop
cmp dword [rbp - 0x61], 0
jle 0x1401a8c91
mov rcx, qword [rbp - 0x69]
call fcn.140298600
nop
cmp dword [rbp - 0x41], 0
jle 0x1401a9bdc
mov rcx, qword [rbp - 0x49]
call fcn.140298600
jmp 0x1401a9bdc
xor r8d, r8d
lea rdx, str.ControlSession_ManagerSubSystemsWindows
mov rcx, rdi
call fcn.1401e8ee0
test al, al
je 0x1401a8eab
cmp dword [rdi + 0xc], 0
je 0x1401a9bdc
mov edx, 0x5c
mov rcx, qword [rdi]
call fcn.14029aea8
test rax, rax
je 0x1401a9bdc
sub rax, qword [rdi]
sar rax, 1
test eax, eax
jle 0x1401a9bdc
mov r9d, eax
xor r8d, r8d
lea rdx, [rbp - 0x39]
mov rcx, rdi
call fcn.1401eb1b0
nop
xor r8d, r8d
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.1400ecf50
mov r15, rax
test rax, rax
je 0x1401a8e93
mov qword [rbp - 0x49], r12
mov qword [rbp - 0x41], rbx
lea r8, [rbp - 0x49]
lea rdx, [0x14032c748]
mov rcx, rax
call fcn.1400d5720
test al, al
je 0x1401a8e75
mov rbx, qword [r13 + 0x10]
test rbx, rbx
je 0x1401a8e75
xor eax, eax
mov qword [rbp - 0x61], rax
lea edx, [rax + 4]
lea rcx, [rbp - 0x69]
call fcn.1401e9030
mov eax, dword [rbp - 0x61]
inc eax
movsxd rdx, eax
mov r9d, 4
lea r8, str.File
mov rcx, qword [rbp - 0x69]
call fcn.14029b4d8
mov edx, 4
lea rcx, [rbp - 0x69]
call fcn.1401ea290
nop
lea rdx, [rbp - 0x69]
mov rcx, rbx
call fcn.1401f0dd0
mov rbx, rax
cmp dword [rbp - 0x61], 0
jle 0x1401a8dab
mov rcx, qword [rbp - 0x69]
call fcn.140298600
test rbx, rbx
je 0x1401a8e75
lea r8, str.path
lea rdx, [rbp - 0x59]
mov rcx, rbx
call fcn.1401edd30
nop
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x69]
call fcn.1400dff30
mov rbx, rax
mov edx, dword [rax + 0xc]
lea rcx, [rbp - 0x59]
call fcn.1401e9030
movsxd r9, dword [rbx + 0xc]
mov eax, dword [rbp - 0x51]
inc eax
movsxd rdx, eax
mov r8, qword [rbx]
mov rcx, qword [rbp - 0x59]
call fcn.14029b4d8
mov edx, dword [rbx + 0xc]
lea rcx, [rbp - 0x59]
call fcn.1401ea290
nop
cmp dword [rbp - 0x61], 0
jle 0x1401a8e18
mov rcx, qword [rbp - 0x69]
call fcn.140298600
mov r8, qword [rbp - 0x59]
lea rdx, str._ServerDll_s:
lea rcx, [rbp - 0x11]
call fcn.1401e94c0
nop
lea r8, str._ServerDllwinsrv:
mov rdx, qword [rbp - 0x11]
lea rcx, [rbp - 0x49]
call fcn.1401ea660
lea r8, [rbp - 0x49]
mov rdx, rdi
mov rcx, rsi
call fcn.1401ac950
mov r14d, 2
cmp dword [rbp - 9], 0
jle 0x1401a8e66
mov rcx, qword [rbp - 0x11]
call fcn.140298600
nop
cmp dword [rbp - 0x51], 0
jle 0x1401a8e75
mov rcx, qword [rbp - 0x59]
call fcn.140298600
mov rax, qword [r15]
mov edx, 1
mov rcx, r15
call qword [rax]
nop
cmp dword [rbp - 0x41], 0
jle 0x1401a8e93
mov rcx, qword [rbp - 0x49]
call fcn.140298600
nop
cmp dword [rbp - 0x31], 0
jle 0x1401a9bdc
mov rcx, qword [rbp - 0x39]
call fcn.140298600
jmp 0x1401a9bdc
xor r8d, r8d
lea rdx, str.HKLMSYSTEM
mov rcx, rdi
call fcn.1401e8da0
test al, al
je 0x1401a8edb
xor r8d, r8d
lea rdx, str.ControlSecurityProvidersSecurityProviders
mov rcx, rdi
call fcn.1401e8ee0
test al, al
jne 0x1401a9bdc
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftInternet_ExplorerDesktopGeneralWallpaper
mov rcx, rdi
call fcn.1401e8da0
test al, al
je 0x1401a8ff8
xor r15b, r15b
or rbx, 0xffffffffffffffff
cmp dword [rdi + 0xc], 0
jne 0x1401a8f06
mov eax, ebx
jmp 0x1401a8f22
mov edx, 0x5c
mov rcx, qword [rdi]
call fcn.14029aea8
test rax, rax
jne 0x1401a8f1c
mov eax, ebx
jmp 0x1401a8f22
sub rax, qword [rdi]
sar rax, 1
lea r8d, [rax + 1]
lea rdx, [rbp - 0x11]
mov rcx, rdi
call fcn.1401eaef0
nop
cmp dword [rdi + 0xc], 0
je 0x1401a8f53
mov edx, 0x5c
mov rcx, qword [rdi]
call fcn.14029aea8
test rax, rax
je 0x1401a8f53
sub rax, qword [rdi]
sar rax, 1
mov ebx, eax
mov r9d, ebx
xor r8d, r8d
lea rdx, [rbp - 0x39]
mov rcx, rdi
call fcn.1401eb1b0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rbp - 0x39]
call fcn.1400ecf50
mov rbx, rax
mov esi, 1
test rax, rax
je 0x1401a8fb2
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], r12
mov r9d, esi
xor r8d, r8d
mov rdx, qword [rbp - 0x11]
mov rcx, qword [rax + 8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete r15b
mov rax, qword [rbx]
mov edx, esi
mov rcx, rbx
call qword [rax]
mov r9d, esi
mov r8, r12
xor edx, edx
lea ecx, [rdx + 0x14]
call qword [sym.imp.USER32.dll_SystemParametersInfoW]
mov r14d, 3
test r15b, r15b
cmovne r14d, esi
cmp dword [rbp - 0x31], 0
jle 0x1401a8fe0
mov rcx, qword [rbp - 0x39]
call fcn.140298600
nop
cmp dword [rbp - 9], 0
jle 0x1401a9bdc
mov rcx, qword [rbp - 0x11]
call fcn.140298600
jmp 0x1401a9bdc
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftInternet_ExplorerMainStart_Page
mov rcx, rdi
call fcn.1401e8da0
test al, al
je 0x1401a910b
xor r15b, r15b
or rbx, 0xffffffffffffffff
cmp dword [rdi + 0xc], 0
jne 0x1401a9023
mov eax, ebx
jmp 0x1401a903f
mov edx, 0x5c
mov rcx, qword [rdi]
call fcn.14029aea8
test rax, rax
jne 0x1401a9039
mov eax, ebx
jmp 0x1401a903f
sub rax, qword [rdi]
sar rax, 1
lea r8d, [rax + 1]
lea rdx, [rbp - 0x11]
mov rcx, rdi
call fcn.1401eaef0
nop
cmp dword [rdi + 0xc], 0
je 0x1401a9070
mov edx, 0x5c
mov rcx, qword [rdi]
call fcn.14029aea8
test rax, rax
je 0x1401a9070
sub rax, qword [rdi]
sar rax, 1
mov ebx, eax
mov r9d, ebx
xor r8d, r8d
lea rdx, [rbp - 0x39]
mov rcx, rdi
call fcn.1401eb1b0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rbp - 0x39]
call fcn.1400ecf50
mov rbx, rax
mov esi, 1
test rax, rax
je 0x1401a90d6
mov dword [rsp + 0x28], 0x16
lea rax, str.about:blank
mov qword [rsp + 0x20], rax
mov r9d, esi
xor r8d, r8d
mov rdx, qword [rbp - 0x11]
mov rcx, qword [rbx + 8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete r15b
mov rax, qword [rbx]
mov edx, esi
mov rcx, rbx
call qword [rax]
mov r14d, 3
test r15b, r15b
cmovne r14d, esi
cmp dword [rbp - 0x31], 0
jle 0x1401a90f3
mov rcx, qword [rbp - 0x39]
call fcn.140298600
nop
cmp dword [rbp - 9], 0
jle 0x1401a9bdc
mov rcx, qword [rbp - 0x11]
call fcn.140298600
jmp 0x1401a9bdc
mov esi, 1
mov r8d, esi
lea rdx, str.HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionWindowsAppInit_DLLS
mov rcx, rdi
call fcn.1401e9310
test al, al
je 0x1401a9217
xor r15b, r15b
or rbx, 0xffffffffffffffff
cmp dword [rdi + 0xc], 0
jne 0x1401a913b
mov eax, ebx
jmp 0x1401a9157
mov edx, 0x5c
mov rcx, qword [rdi]
call fcn.14029aea8
test rax, rax
jne 0x1401a9151
mov eax, ebx
jmp 0x1401a9157
sub rax, qword [rdi]
sar rax, 1
lea r8d, [rax + 1]
lea rdx, [rbp - 0x11]
mov rcx, rdi
call fcn.1401eaef0
nop
cmp dword [rdi + 0xc], 0
je 0x1401a9188
mov edx, 0x5c
mov rcx, qword [rdi]
call fcn.14029aea8
test rax, rax
je 0x1401a9188
sub rax, qword [rdi]
sar rax, 1
mov ebx, eax
mov r9d, ebx
xor r8d, r8d
lea rdx, [rbp - 0x39]
mov rcx, rdi
call fcn.1401eb1b0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rbp - 0x39]
call fcn.1400ecf50
mov rbx, rax
test rax, rax
je 0x1401a91e2
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], r12
mov r9d, esi
xor r8d, r8d
mov rdx, qword [rbp - 0x11]
mov rcx, qword [rax + 8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete r15b
mov rax, qword [rbx]
mov edx, esi
mov rcx, rbx
call qword [rax]
mov r14d, 3
test r15b, r15b
cmovne r14d, esi
cmp dword [rbp - 0x31], 0
jle 0x1401a91ff
mov rcx, qword [rbp - 0x39]
call fcn.140298600
nop
cmp dword [rbp - 9], 0
jle 0x1401a9bdc
mov rcx, qword [rbp - 0x11]
call fcn.140298600
jmp 0x1401a9bdc
xor r8d, r8d
lea rdx, str.F3130CDB_AA52_4C3A_AB32_85FFC23AF9C1
mov rcx, rdi
call fcn.1401e8da0
test al, al
jne 0x1401a9a7c
xor r8d, r8d
lea rdx, str.42AEDC87_2188_41FD_B9A3_0C966FEABEC1
mov rcx, rdi
call fcn.1401e8da0
test al, al
jne 0x1401a9a7c
lea rdx, [rbp + 7]
mov rcx, rdi
call fcn.1401a9db0
test al, al
je 0x1401a955a
lea rax, str.winmgmt
mov qword [rbp - 0x39], rax
lea rax, str._systemroot__system32_svchost.exe__k_netsvcs
mov qword [rbp - 0x31], rax
lea rax, str._SystemRoot__system32wbemWMIsvc.dll
mov qword [rbp - 0x29], rax
lea rax, str.ServiceMain
mov qword [rbp - 0x21], rax
movzx r15d, sil
mov r13d, ebx
mov dword [rbp - 1], ebx
lea r12, [rbp - 0x29]
mov qword [rbp - 0x49], r12
or rbx, 0xffffffffffffffff
lea r14, vtable.Core::Win32::RegistryKey.0
nop dword [rax + rax]
xor r8d, r8d
mov rdx, qword [r12 - 0x10]
lea rcx, [rbp + 7]
call fcn.1401e9310
test al, al
je 0x1401a940f
xor r8d, r8d
movzx edx, sil
mov rcx, rdi
call fcn.1400ecf50
mov r13, rax
test rax, rax
je 0x1401a9408
mov rdx, qword [r12 - 8]
mov rcx, rbx
nop dword [rax]
inc rcx
cmp word [rdx + rcx*2], 0
jne 0x1401a92f0
add ecx, ecx
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rdx
mov r9d, 2
xor r8d, r8d
lea rdx, str.ImagePath
mov rcx, qword [rax + 8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov r15, qword [r12]
test r15, r15
je 0x1401a93fd
mov qword [rbp - 0x59], 0
lea rax, [rbp - 0x59]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
lea rdx, str.Parameters
mov rcx, qword [r13 + 8]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401a93fd
lea ecx, [rax + 0x10]
call fcn.14029806c
mov r12, rax
test rax, rax
je 0x1401a93f9
mov rcx, qword [rbp - 0x59]
mov qword [rax], r14
mov qword [rax + 8], rcx
mov rcx, rbx
inc rcx
cmp word [r15 + rcx*2], 0
jne 0x1401a9381
add ecx, ecx
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], r15
mov r9d, 2
xor r8d, r8d
lea rdx, str.ServiceDll
mov rcx, qword [rax + 8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rax, qword [rbp - 0x49]
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x1401a93ee
mov rax, rbx
inc rax
cmp word [rcx + rax*2], 0
jne 0x1401a93c1
add eax, eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, esi
xor r8d, r8d
lea rdx, str.ServiceMain
mov rcx, qword [r12 + 8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rax, qword [r12]
mov edx, esi
mov rcx, r12
call qword [rax]
mov r12, qword [rbp - 0x49]
mov rax, qword [r13]
mov edx, esi
mov rcx, r13
call qword [rax]
xor r15b, r15b
mov r13d, dword [rbp - 1]
inc r13d
mov dword [rbp - 1], r13d
add r12, 0x20
mov qword [rbp - 0x49], r12
movsxd rax, r13d
cmp rax, rsi
jb 0x1401a92b0
test r15b, r15b
mov r14d, dword [rbp - 0x19]
je 0x1401a9bdc
xor r8d, r8d
movzx edx, sil
mov rcx, rdi
call fcn.1400ecf50
mov rbx, rax
test rax, rax
je 0x1401a94b8
mov dword [rbp - 0x19], esi
mov dword [rsp + 0x28], 4
lea rax, [rbp - 0x19]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.DeleteFlag
mov rcx, qword [rbx + 8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rbp - 0x19], 4
mov dword [rsp + 0x28], 4
lea rax, [rbp - 0x19]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Start
mov rcx, qword [rbx + 8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rax, qword [rbx]
mov edx, esi
mov rcx, rbx
call qword [rax]
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
test rax, rax
je 0x1401a94e1
mov rdx, rax
lea rcx, [rbp + 7]
call fcn.1401aaa20
test al, al
jne 0x1401a9bdc
lea rcx, [rbp + 7]
call fcn.1401ac1e0
movzx ebx, al
lea rax, [0x1402e9000]
lea r8, str.FAIL
test bl, bl
cmovne r8, rax
mov rdx, qword [rbp + 7]
lea rcx, str.Physically_disable_service___s_____s_n
call fcn.1401a2060
test bl, bl
je 0x1401a9520
mov r14d, 2
jmp 0x1401a9bdc
mov rbx, qword [rbp - 0x69]
mov rax, qword [rbx + 0xd8]
lea rdx, [rbp + 7]
lea rcx, [rbx + 0xd8]
call qword [rax + 0x10]
test al, al
jne 0x1401a9bdc
mov rax, qword [rbx + 0xd8]
lea rdx, [rbp + 7]
lea rcx, [rbx + 0xd8]
call qword [rax]
jmp 0x1401a9bdc
xor r8d, r8d
lea rdx, [0x1403232c8]
mov rcx, rdi
call fcn.1401e8ee0
test al, al
je 0x1401a974b
mov r8d, esi
lea rdx, str.HKLMSOFTWAREMicrosoftWindowsCurrentVersion_
mov rcx, rdi
call fcn.1401e9310
test al, al
jne 0x1401a974b
or rbx, 0xffffffffffffffff
cmp dword [rdi + 0xc], 0
jne 0x1401a959c
mov eax, ebx
jmp 0x1401a95b8
mov edx, 0x5c
mov rcx, qword [rdi]
call fcn.14029aea8
test rax, rax
jne 0x1401a95b2
mov eax, ebx
jmp 0x1401a95b8
sub rax, qword [rdi]
sar rax, 1
mov r9d, eax
xor r8d, r8d
lea rdx, [rbp - 0x69]
mov rcx, rdi
call fcn.1401eb1b0
nop
cmp dword [rbp - 0x5d], 0
jne 0x1401a95d5
mov eax, ebx
jmp 0x1401a95f3
mov edx, 0x5c
mov rcx, qword [rbp - 0x69]
call fcn.14029aea8
test rax, rax
jne 0x1401a95ec
mov eax, ebx
jmp 0x1401a95f3
sub rax, qword [rbp - 0x69]
sar rax, 1
lea r9d, [rax + 1]
xor r8d, r8d
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x69]
call fcn.1401eb1b0
nop
cmp dword [rbp - 0x5d], 0
je 0x1401a962a
mov edx, 0x5c
mov rcx, qword [rbp - 0x69]
call fcn.14029aea8
test rax, rax
je 0x1401a962a
sub rax, qword [rbp - 0x69]
sar rax, 1
mov ebx, eax
lea r8d, [rbx + 1]
lea rdx, [rbp - 0x49]
lea rcx, [rbp - 0x69]
call fcn.1401eaef0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rbp - 0x59]
call fcn.1400ecf50
mov rbx, rax
test rax, rax
je 0x1401a9702
mov r8, qword [rbp - 0x59]
mov rdx, qword [rbp - 0x49]
lea rcx, str.Deleting_key__s_under__s
call fcn.1401a2060
mov rdx, qword [rbp - 0x49]
mov rcx, rbx
call fcn.1400ec4d0
test al, al
je 0x1401a96dc
lea rcx, str.___Success_r_n
call fcn.1401a2060
mov r14d, esi
lea r8, [0x140328260]
lea rdx, [rbp - 0x39]
mov rcx, r13
call fcn.1401edd30
nop
xor r8d, r8d
lea rdx, [0x140328268]
lea rcx, [rbp - 0x39]
call fcn.1401e9310
test al, al
je 0x1401a96cb
lea r8, [0x140328268]
lea rdx, str.skip
mov rcx, r13
call fcn.1401edd80
nop
cmp dword [rbp - 0x31], 0
jle 0x1401a96f6
mov rcx, qword [rbp - 0x39]
call fcn.140298600
jmp 0x1401a96f6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.___Failed__error__d__r_n
call fcn.1401a2060
mov r14d, 2
mov rax, qword [rbx]
mov edx, esi
mov rcx, rbx
call qword [rax]
jmp 0x1401a9713
mov rdx, qword [rbp - 0x59]
lea rcx, str.Failed_to_open_key__s_r_n
call fcn.1401a2060
nop
cmp dword [rbp - 0x41], 0
jle 0x1401a9723
mov rcx, qword [rbp - 0x49]
call fcn.140298600
nop
cmp dword [rbp - 0x51], 0
jle 0x1401a9733
mov rcx, qword [rbp - 0x59]
call fcn.140298600
nop
cmp dword [rbp - 0x61], 0
jle 0x1401a9bdc
mov rcx, qword [rbp - 0x69]
call fcn.140298600
jmp 0x1401a9bdc
mov r8d, esi
lea rdx, [0x14033c4b4]
mov rcx, rdi
call fcn.1401ea030
mov r15d, eax
or rbx, 0xffffffffffffffff
test eax, eax
jle 0x1401a97b8
mov r9d, eax
xor r8d, r8d
lea rdx, [rbp - 0x39]
mov rcx, rdi
call fcn.1401eb1b0
mov r12, rax
cmp dword [rax + 0xc], 0
jne 0x1401a9788
mov r15d, ebx
jmp 0x1401a97a9
mov edx, 0x5c
mov rcx, qword [rax]
call fcn.14029aea8
mov r15, rax
test rax, rax
jne 0x1401a97a2
mov r15d, ebx
jmp 0x1401a97a9
sub r15, qword [r12]
sar r15, 1
cmp dword [rbp - 0x31], 0
jle 0x1401a97b8
mov rcx, qword [rbp - 0x39]
call fcn.140298600
test r15d, r15d
jns 0x1401a97e8
cmp dword [rdi + 0xc], 0
jne 0x1401a97c8
mov r15d, ebx
jmp 0x1401a97e8
mov edx, 0x5c
mov rcx, qword [rdi]
call fcn.14029aea8
test rax, rax
jne 0x1401a97df
mov r15d, ebx
jmp 0x1401a97e8
sub rax, qword [rdi]
sar rax, 1
mov r15d, eax
mov r9d, r15d
xor r8d, r8d
lea rdx, [rbp - 0x59]
mov rcx, rdi
call fcn.1401eb1b0
nop
lea r8d, [r15 + 1]
lea rdx, [rbp - 0x69]
mov rcx, rdi
call fcn.1401eaef0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rbp - 0x59]
call fcn.1400ecf50
mov r15, rax
test rax, rax
jne 0x1401a9837
mov rdx, qword [rbp - 0x59]
lea rcx, str.Failed_to_open_key__s_r_n
call fcn.1401a2060
jmp 0x1401a9a54
mov r8, qword [rdi]
mov rdx, qword [rbp - 0x69]
lea rcx, str.Deleting_VALUE__s_under__s
call fcn.1401a2060
mov r8d, esi
lea rdx, [0x1403310ec]
lea rcx, [rbp - 0x69]
call fcn.1401e9310
test al, al
je 0x1401a9872
cmp dword [rbp - 0x5d], 0
jle 0x1401a9872
xor edx, edx
lea rcx, [rbp - 0x69]
call fcn.1401ea290
mov rdx, qword [rbp - 0x69]
mov rcx, qword [r15 + 8]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ebx, eax
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test ebx, ebx
jne 0x1401a9945
lea rcx, str.___Success_r_n
call fcn.1401a2060
mov r14d, esi
xor dil, dil
xor r8d, r8d
lea rdx, [0x14033c4a0]
lea rcx, [rbp - 0x69]
call fcn.1401e9310
test al, al
je 0x1401a9962
xor r8d, r8d
lea rdx, str.Image_File_Execution_Options_
lea rcx, [rbp - 0x59]
call fcn.1401e8da0
test al, al
je 0x1401a9962
lea rax, vtable.Core::Array_class_Core::String_.0
mov qword [rbp - 0x39], rax
xor eax, eax
mov dword [rbp - 0x31], eax
mov qword [rbp - 0x29], rax
lea rdx, [rbp - 0x39]
mov rcx, r15
call fcn.1400eca70
test al, al
je 0x1401a991a
cmp dword [rbp - 0x31], ebx
jne 0x1401a991a
lea rdx, [rbp - 0x39]
mov rcx, r15
call fcn.1400ec710
test al, al
je 0x1401a991a
cmp dword [rbp - 0x31], ebx
sete dil
mov rcx, qword [rbp - 0x29]
test rcx, rcx
je 0x1401a9962
lea rbx, [rcx - 8]
lea r9, [fcn.140005d80]
mov r8d, dword [rbx]
mov edx, 0x10
call fcn.140298fa4
mov rcx, rbx
call fcn.1402983dc
jmp 0x1401a9962
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.___Failed__d_r_n
call fcn.1401a2060
xor dil, dil
mov r14d, 2
mov rax, qword [r15]
mov edx, esi
mov rcx, r15
call qword [rax]
test dil, dil
je 0x1401a9a54
mov r8d, esi
lea rdx, [0x1403232c8]
lea rcx, [rbp - 0x59]
call fcn.1401ea030
mov ebx, eax
test eax, eax
jle 0x1401a9a54
mov r9d, eax
xor r8d, r8d
lea rdx, [rbp - 0x11]
lea rcx, [rbp - 0x59]
call fcn.1401eb1b0
nop
lea r8d, [rbx + 1]
lea rdx, [rbp - 0x49]
lea rcx, [rbp - 0x59]
call fcn.1401eaef0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rbp - 0x11]
call fcn.1400ecf50
mov rdi, rax
test rax, rax
je 0x1401a9a34
mov r8, qword [rbp - 0x11]
mov rdx, qword [rbp - 0x49]
lea rcx, str.Deleting_key__s_under__s
call fcn.1401a2060
mov rdx, qword [rbp - 0x49]
mov rcx, qword [rdi + 8]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ebx, eax
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test ebx, ebx
jne 0x1401a9a0f
lea rcx, str.___Success_r_n
call fcn.1401a2060
mov r14d, esi
jmp 0x1401a9a29
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.___Failed__d_r_n
call fcn.1401a2060
mov r14d, 2
mov rax, qword [rdi]
mov edx, esi
mov rcx, rdi
call qword [rax]
nop
cmp dword [rbp - 0x41], 0
jle 0x1401a9a44
mov rcx, qword [rbp - 0x49]
call fcn.140298600
nop
cmp dword [rbp - 9], 0
jle 0x1401a9a54
mov rcx, qword [rbp - 0x11]
call fcn.140298600
nop
cmp dword [rbp - 0x61], 0
jle 0x1401a9a64
mov rcx, qword [rbp - 0x69]
call fcn.140298600
nop
cmp dword [rbp - 0x51], 0
jle 0x1401a9bdc
mov rcx, qword [rbp - 0x59]
call fcn.140298600
jmp 0x1401a9bdc
xor r15b, r15b
mov r8d, esi
lea rdx, [0x14033c120]
mov rcx, rdi
call fcn.1401ea030
test eax, eax
jle 0x1401a9bcf
lea r9d, [rax + 2]
xor r8d, r8d
lea rdx, [rbp - 0x59]
mov rcx, rdi
call fcn.1401eb1b0
nop
lea rdx, [0x14033c098]
lea rcx, [rbp - 0x59]
call fcn.1401e7680
xor r8d, r8d
mov dl, 1
lea rcx, [rbp - 0x59]
call fcn.1400ecf50
mov rbx, rax
mov rdx, qword [rbp - 0x59]
lea rcx, str.Repair__s_r_n
call fcn.14029a88c
test rbx, rbx
je 0x1401a9bc0
xor eax, eax
mov qword [rbp - 0x61], rax
lea edx, [rax + 0x16]
lea rcx, [rbp - 0x69]
call fcn.1401e9030
mov eax, dword [rbp - 0x61]
inc eax
movsxd rdx, eax
mov r9d, 0x16
lea r8, str._SystemRoot__system32_
mov rcx, qword [rbp - 0x69]
call fcn.14029b4d8
mov edx, 0x16
lea rcx, [rbp - 0x69]
call fcn.1401ea290
nop
xor r8d, r8d
lea rdx, str.42AEDC87
mov rcx, rdi
call fcn.1401e8da0
test al, al
je 0x1401a9b5b
call fcn.1401acf80
lea rcx, [rbp - 0x69]
test al, al
je 0x1401a9b52
lea rdx, str.shell32.dll
jmp 0x1401a9b66
lea rdx, str.shdocvw.dll
jmp 0x1401a9b66
lea rdx, str.wbemwbemess.dll
lea rcx, [rbp - 0x69]
call fcn.1401e7680
mov rdx, qword [rbp - 0x69]
lea rcx, str._____s_r_n
call fcn.14029a88c
mov eax, dword [rbp - 0x5d]
add eax, eax
mov dword [rsp + 0x28], eax
mov rax, qword [rbp - 0x69]
mov qword [rsp + 0x20], rax
mov r9d, esi
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbx + 8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete r15b
mov rax, qword [rbx]
mov edx, esi
mov rcx, rbx
call qword [rax]
nop
cmp dword [rbp - 0x61], 0
jle 0x1401a9bc0
mov rcx, qword [rbp - 0x69]
call fcn.140298600
nop
cmp dword [rbp - 0x51], 0
jle 0x1401a9bcf
mov rcx, qword [rbp - 0x59]
call fcn.140298600
mov r14d, 3
test r15b, r15b
cmovne r14d, esi
cmp dword [rbp + 0xf], 0
jle 0x1401a9beb
mov rcx, qword [rbp + 7]
call fcn.140298600
mov eax, r14d
mov rbx, qword [rsp + 0x118]
add rsp, 0xc0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret