Function at 0x14009b982
Capabilities:
Persist via winlogon helper dll registry key

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x90
movaps xmmword [rsp + 0x80], xmm6
mov rax, qword [0x140267e38]
xor rax, rsp
mov qword [rsp + 0x78], rax
call fcn.1400841b0
mov esi, 1
cmp eax, 0xb
jl 0x14009b9c1
mov ecx, 0x1d
call qword [sym.imp.SHLWAPI.dll_IsOS]
test eax, eax
je 0x14009b9e3
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1401ca2e0
mov eax, esi
movaps xmm6, xmmword [rsp + 0x80]
add rsp, 0x90
pop rbx
pop rdi
pop rsi
ret
lea rcx, [rsp + 0x74]
mov dword [rcx], 0
call qword [sym.imp.USERENV.dll_GetProfileType]
test eax, eax
je 0x14009ba04
mov esi, 2
test byte [rsp + 0x74], 1
jne 0x14009b9c1
call fcn.140083070
test al, al
je 0x14009bb6d
call fcn.14009b842
mov esi, 5
cmp eax, 1
je 0x14009b9c1
mov ecx, 0x43
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov esi, 6
test eax, eax
jne 0x14009b9c1
lea rcx, str.SYSTEMSetupStatus
lea rdx, str.AuditBoot
call fcn.14009bc3b
mov esi, 7
test al, al
jne 0x14009b9c1
lea rcx, str.SOFTWAREMicrosoftWindowsCurrentVersionRetailDemoOobeWrite
lea rdx, str.Enabled
call fcn.14009bc3b
mov esi, 8
test al, al
jne 0x14009b9c1
lea rcx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
lea rdx, str.AutoAdminLogon
call fcn.14009bc3b
mov esi, 9
test al, al
jne 0x14009b9c1
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
lea rsi, [rsp + 0x58]
mov rcx, rsi
mov rdx, 0xffffffff80000002
mov r9d, 1
call fcn.140080130
cmp qword [rsi], 0
je 0x14009bafb
xorps xmm0, xmm0
lea rsi, [rsp + 0x40]
movaps xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
lea rdx, str.shell
lea rcx, [rsp + 0x58]
mov r8, rsi
call fcn.140080bd0
test eax, eax
je 0x14009bb96
cmp byte [rsp + 0x57], 0
jns 0x14009bafb
mov rcx, qword [rsp + 0x40]
call fcn.1401c9f6c
lea rcx, str.SOFTWAREMicrosoftWindowsCurrentVersionSetupOOBE
lea rdx, str.UnattendSetAutologon
call fcn.14009bc3b
mov esi, 0xb
test al, al
jne 0x14009bc2c
xorps xmm6, xmm6
lea rdi, [rsp + 0x40]
movaps xmmword [rdi], xmm6
mov qword [rdi + 0x10], 0
mov rcx, rdi
call fcn.1400823f0
test al, al
je 0x14009bc1a
lea rsi, [rsp + 0x20]
movaps xmmword [rsi], xmm6
mov qword [rsi + 0x10], 0
lea rdx, str.SOFTWAREMicrosoftWindowsAssignedAccessConfigurationConfigs_
mov rcx, rsi
call fcn.14003bf5e
xor edi, edi
cmp byte [rsp + 0x57], dil
jns 0x14009bbd1
mov rdx, qword [rsp + 0x40]
jmp 0x14009bbd6
mov esi, 3
call fcn.140082c40
test al, al
jne 0x14009b9c1
mov esi, 4
call fcn.140082cb0
test al, al
jne 0x14009b9c1
jmp 0x14009ba11
cmp byte [rsp + 0x57], 0
jns 0x14009bba2
mov rsi, qword [rsp + 0x40]
lea rdx, str.explorer.exe
mov rcx, rsi
call fcn.1401e1a60
test eax, eax
je 0x14009baea
cmp byte [rsp + 0x57], 0
jns 0x14009bbca
mov rcx, qword [rsp + 0x40]
call fcn.1401c9f6c
mov esi, 0xa
jmp 0x14009bc2c
lea rdx, [rsp + 0x40]
mov rcx, rax
call fcn.14003bf5e
cmp byte [rsp + 0x37], dil
jns 0x14009bbea
mov rsi, qword [rsp + 0x20]
lea rdx, str.ConfigSource
mov rcx, rsi
call fcn.14009bc3b
mov ebx, eax
cmp byte [rsp + 0x37], dil
jns 0x14009bc0c
mov rcx, qword [rsp + 0x20]
call fcn.1401c9f6c
lea rdi, [rsp + 0x40]
mov esi, 0xc
test bl, bl
jne 0x14009bc1c
xor esi, esi
cmp byte [rdi + 0x17], 0
jns 0x14009bc2c
mov rcx, qword [rsp + 0x40]
call fcn.1401c9f6c
lea rcx, [rsp + 0x58]
call fcn.140080370
jmp 0x14009b9c1