Function at 0x140010ff0
Capabilities:
Persist via run registry key
Persist via winlogon helper dll registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xe0
mov rax, qword [0x1401198e8]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov qword [rbp - 0x49], rdx
mov rsi, rcx
mov qword [rbp - 0x21], rdx
xor ebx, ebx
mov dword [rsp + 0x38], ebx
call fcn.140008180
mov rcx, rax
test rax, rax
je 0x140012008
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x41], rax
lea rdi, str.SOFTWAREMicrosoftWindows_NTCurrentVersionTerminal_Server_
mov rdx, rdi
lea rcx, [rbp - 0x41]
call fcn.1400062d0
lea r15, [rbx - 1]
test al, al
jne 0x14001108a
mov rax, r15
nop dword [rax + rax]
inc rax
cmp word [rdi + rax*2], 0
jne 0x140011070
mov r8d, eax
mov rdx, rdi
lea rcx, [rbp - 0x41]
call fcn.1400068f0
nop
mov r9d, 0x2c
mov byte [rsp + 0x28], 1
mov qword [rsp + 0x20], rsi
lea r8, str.Shell
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
mov rcx, 0xffffffff80000001
call fcn.14000d530
mov r9d, 0x2c
mov byte [rsp + 0x28], 1
mov qword [rsp + 0x20], rsi
lea r8, str.Shell
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
mov rcx, 0xffffffff80000001
call fcn.14000d530
mov r9b, 1
mov r8, rsi
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000001
call fcn.14000caa0
mov r9b, 1
mov r8, rsi
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
mov rcx, 0xffffffff80000001
call fcn.14000caa0
mov r9b, 1
mov r8, rsi
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnceEx
mov rcx, 0xffffffff80000001
call fcn.14000caa0
mov r9b, 1
mov r8, rsi
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorerRun
mov rcx, 0xffffffff80000001
call fcn.14000caa0
call fcn.14002dc10
test al, al
jne 0x140011179
cmp byte [0x140135b10], al
jne 0x140011170
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [0x140135b0c]
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
mov byte [0x140135b10], 1
cmp dword [0x140135b0c], 0
je 0x1400111ec
call fcn.14002dc10
test al, al
je 0x14001118d
lea rcx, [rbp - 0x19]
call qword [sym.imp.KERNEL32.dll_Wow64DisableWow64FsRedirection]
nop
mov r9b, 1
mov r8, rsi
lea rdx, str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000001
call fcn.14000caa0
mov r9b, 1
mov r8, rsi
lea rdx, str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionRunOnce
mov rcx, 0xffffffff80000001
call fcn.14000caa0
mov r9b, 1
mov r8, rsi
lea rdx, str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionRunOnceEx
mov rcx, 0xffffffff80000001
call fcn.14000caa0
nop
call fcn.14002dc10
test al, al
je 0x1400111ec
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.KERNEL32.dll_Wow64RevertWow64FsRedirection]
mov r9d, 0x2c
mov byte [rsp + 0x28], 1
mov qword [rsp + 0x20], rsi
lea r8, str.UserInitMprLogonScript
lea rdx, str.Environment
mov rcx, 0xffffffff80000001
call fcn.14000d530
mov r9d, 0x20
mov byte [rsp + 0x28], 1
mov qword [rsp + 0x20], rsi
lea r8, str.Load
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionWindows
mov rcx, 0xffffffff80000001
call fcn.14000d530
mov r9d, 0x20
mov byte [rsp + 0x28], 1
mov qword [rsp + 0x20], rsi
lea r8, [0x1400f1030]
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionWindows
mov rcx, 0xffffffff80000001
call fcn.14000d530
nop
mov qword [rbp - 0x79], rbx
mov rdi, qword [rbp - 0x41]
lea r12, [rdi - 0x18]
mov rcx, qword [r12]
test rcx, rcx
je 0x14001128e
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x14001129f
call fcn.140008180
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x140012013
mov rax, qword [rcx]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x79], rbx
mov dword [rsp + 0x38], 2
lea rax, str.InstallSoftwareMicrosoftWindowsCurrentVersionRunOnce
mov r14, r15
nop dword [rax + rax]
inc r14
cmp word [rax + r14*2], 0
jne 0x1400112d0
mov eax, dword [r12 + 8]
mov dword [rbp - 0x39], eax
lea r13d, [r14 + rax]
test r13d, r13d
js 0x140011ffd
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, r13d
or eax, ecx
jge 0x140011312
mov edx, r13d
lea rcx, [rbp - 0x79]
call fcn.140006870
mov rbx, qword [rbp - 0x79]
movsxd rax, dword [rbp - 0x39]
add rax, rax
mov qword [rbp - 0x31], rax
je 0x140011359
test rbx, rbx
je 0x140011345
mov r8, rax
mov rcx, rbx
test rdi, rdi
je 0x140011339
mov rdx, rdi
call fcn.14009d3c0
jmp 0x140011355
xor edx, edx
call fcn.14009e880
test rdi, rdi
jne 0x140011355
call fcn.1400a31cc
mov dword [rax], 0x16
call fcn.1400a3060
mov rax, qword [rbp - 0x31]
movsxd r8, r14d
add r8, r8
lea rcx, [rax + rbx]
je 0x140011388
test rcx, rcx
jne 0x14001137c
call fcn.1400a31cc
mov dword [rax], 0x16
call fcn.1400a3060
jmp 0x140011388
lea rdx, str.InstallSoftwareMicrosoftWindowsCurrentVersionRunOnce
call fcn.14009d3c0
cmp r13d, dword [rbx - 0xc]
jg 0x140011ffd
mov dword [rbx - 0x10], r13d
movsxd rax, r13d
xor r14d, r14d
mov word [rbx + rax*2], r14w
mov r9b, 1
mov r8, rsi
mov rdx, rbx
mov rcx, 0xffffffff80000001
call fcn.14000caa0
mov dword [rsp + 0x38], r14d
mov eax, r15d
lock xadd dword [rbx - 8], eax
sub eax, 1
jg 0x1400113d7
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
lea rdx, [rbx - 0x18]
call qword [rax + VariantCopy]
nop
mov qword [rbp - 0x71], r14
mov rcx, qword [r12]
test rcx, rcx
je 0x1400113f2
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x140011403
call fcn.140008180
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x14001201e
mov rax, qword [rcx]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x71], rbx
mov dword [rsp + 0x38], 4
lea rax, str.InstallSoftwareMicrosoftWindowsCurrentVersionRunOnceEx
mov r14, r15
nop dword [rax]
inc r14
cmp word [rax + r14*2], 0
jne 0x140011430
movsxd rdi, dword [r12 + 8]
lea r13d, [r14 + rdi]
test r13d, r13d
js 0x140011ff2
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, r13d
or eax, ecx
jge 0x14001146f
mov edx, r13d
lea rcx, [rbp - 0x71]
call fcn.140006870
mov rbx, qword [rbp - 0x71]
mov rax, rdi
add rax, rax
mov qword [rsp + 0x30], rax
je 0x1400114bb
test rbx, rbx
je 0x1400114a6
mov rdi, qword [rbp - 0x41]
mov r8, rax
mov rcx, rbx
test rdi, rdi
je 0x14001149a
mov rdx, rdi
call fcn.14009d3c0
jmp 0x1400114b6
xor edx, edx
call fcn.14009e880
test rdi, rdi
jne 0x1400114b6
call fcn.1400a31cc
mov dword [rax], 0x16
call fcn.1400a3060
mov rax, qword [rsp + 0x30]
movsxd r8, r14d
add r8, r8
lea rcx, [rax + rbx]
je 0x1400114ea
test rcx, rcx
jne 0x1400114de
call fcn.1400a31cc
mov dword [rax], 0x16
call fcn.1400a3060
jmp 0x1400114ea
lea rdx, str.InstallSoftwareMicrosoftWindowsCurrentVersionRunOnceEx
call fcn.14009d3c0
cmp r13d, dword [rbx - 0xc]
jg 0x140011ff2
mov dword [rbx - 0x10], r13d
movsxd rax, r13d
xor r14d, r14d
mov word [rbx + rax*2], r14w
mov r9b, 1
mov r8, rsi
mov rdx, rbx
mov rcx, 0xffffffff80000001
call fcn.14000caa0
mov dword [rsp + 0x38], r14d
mov eax, r15d
lock xadd dword [rbx - 8], eax
sub eax, 1
jg 0x140011539
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
lea rdx, [rbx - 0x18]
call qword [rax + VariantCopy]
nop
mov qword [rbp - 0x69], r14
mov rcx, qword [r12]
test rcx, rcx
je 0x140011554
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x140011565
call fcn.140008180
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x140012029
mov rax, qword [rcx]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x69], rbx
mov dword [rsp + 0x38], 8
lea rax, str.InstallSoftwareMicrosoftWindowsCurrentVersionRun
mov r14, r15
nop
inc r14
cmp word [rax + r14*2], 0
jne 0x140011590
movsxd rdi, dword [r12 + 8]
lea r13d, [r14 + rdi]
test r13d, r13d
js 0x140012076
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, r13d
or eax, ecx
jge 0x1400115cf
mov edx, r13d
lea rcx, [rbp - 0x69]
call fcn.140006870
mov rbx, qword [rbp - 0x69]
mov rax, rdi
add rax, rax
mov qword [rsp + 0x30], rax
je 0x14001161b
test rbx, rbx
je 0x140011606
mov rdi, qword [rbp - 0x41]
mov r8, rax
mov rcx, rbx
test rdi, rdi
je 0x1400115fa
mov rdx, rdi
call fcn.14009d3c0
jmp 0x140011616
xor edx, edx
call fcn.14009e880
test rdi, rdi
jne 0x140011616
call fcn.1400a31cc
mov dword [rax], 0x16
call fcn.1400a3060
mov rax, qword [rsp + 0x30]
movsxd r8, r14d
add r8, r8
lea rcx, [rax + rbx]
je 0x14001164a
test rcx, rcx
jne 0x14001163e
call fcn.1400a31cc
mov dword [rax], 0x16
call fcn.1400a3060
jmp 0x14001164a
lea rdx, str.InstallSoftwareMicrosoftWindowsCurrentVersionRun
call fcn.14009d3c0
cmp r13d, dword [rbx - 0xc]
jg 0x140012076
mov dword [rbx - 0x10], r13d
movsxd rax, r13d
xor r14d, r14d
mov word [rbx + rax*2], r14w
mov r9b, 1
mov r8, rsi
mov rdx, rbx
mov rcx, 0xffffffff80000001
call fcn.14000caa0
mov dword [rsp + 0x38], r14d
mov eax, r15d
lock xadd dword [rbx - 8], eax
sub eax, 1
jg 0x140011698
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
lea rdx, [rbx - 0x18]
call qword [rax + VariantCopy]
cmp byte [0x14011a510], 0
je 0x140011f91
call fcn.14002dc10
test al, al
je 0x1400116b9
lea rcx, [rbp - 0x11]
call qword [sym.imp.KERNEL32.dll_Wow64DisableWow64FsRedirection]
nop
mov r9d, 0x2c
mov byte [rsp + 0x28], 1
mov qword [rsp + 0x20], rsi
lea r8, str.StartupPrograms
lea rdx, str.SystemCurrentControlSetControlTerminal_ServerWds_rdpwd
mov rcx, 0xffffffff80000002
call fcn.14000d530
mov r9d, 0x2c
mov byte [rsp + 0x28], 1
mov qword [rsp + 0x20], rsi
lea r8, str.AppSetup
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
mov rcx, 0xffffffff80000002
call fcn.14000d530
mov r9b, 1
mov r8, rsi
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000002
call fcn.14000caa0
mov r9b, 1
mov r8, rsi
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
mov rcx, 0xffffffff80000002
call fcn.14000caa0
mov r9b, 1
mov r8, rsi
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorerRun
mov rcx, 0xffffffff80000002
call fcn.14000caa0
mov r9b, 1
mov r8, rsi
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnceEx
mov rcx, 0xffffffff80000002
call fcn.14000caa0
mov r9d, 0x2c
mov byte [rsp + 0x28], 1
mov qword [rsp + 0x20], rsi
lea r8, str.Shell
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
mov rcx, 0xffffffff80000002
call fcn.14000d530
mov r9d, 0x2c
mov byte [rsp + 0x28], 1
mov qword [rsp + 0x20], rsi
lea r8, str.Shell
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
mov rcx, 0xffffffff80000002
call fcn.14000d530
mov r9d, 0x20
mov byte [rsp + 0x28], 1
mov qword [rsp + 0x20], rsi
lea r8, str.AlternateShell
lea rdx, str.SYSTEMCurrentControlSetControlSafeBoot
mov rcx, 0xffffffff80000002
call fcn.14000d530
mov r9d, 0x20
mov byte [rsp + 0x28], 1
mov qword [rsp + 0x20], rsi
lea r8, str.TaskMan
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionWinlogon
mov rcx, 0xffffffff80000002
call fcn.14000d530
mov r9d, 0x2c
mov byte [rsp + 0x28], 1
mov qword [rsp + 0x20], rsi
lea r8, str.UserInit
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionWinlogon
mov rcx, 0xffffffff80000002
call fcn.14000d530
xor r9d, r9d
mov byte [rsp + 0x28], 1
mov qword [rsp + 0x20], rsi
lea r8, str.VmApplet
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionWinlogon
mov rcx, 0xffffffff80000002
call fcn.14000d530
mov r9b, 1
mov r8, rsi
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionWinlogonAlternateShellsAvailableShells
mov rcx, 0xffffffff80000002
call fcn.14000caa0
mov r9d, 0x2c
mov byte [rsp + 0x28], 1
mov qword [rsp + 0x20], rsi
lea r8, str.UserInitMprLogonScript
lea rdx, str.Environment
mov rcx, 0xffffffff80000002
call fcn.14000d530
mov r9b, 1
mov r8, rsi
lea rdx, str.SOFTWAREMicrosoftActive_SetupInstalled_Components
call fcn.140012090
mov r9d, 0x2c
mov byte [rsp + 0x28], 1
mov qword [rsp + 0x20], rsi
lea r8, str.IconServiceLib
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionWindows
mov rcx, 0xffffffff80000002
call fcn.14000d530
mov r9b, 1
mov r8, rsi
lea rdx, str.SOFTWAREMicrosoftWindows_CE_ServicesAutoStartOnConnect
mov rcx, 0xffffffff80000002
call fcn.14000caa0
mov r9b, 1
mov r8, rsi
lea rdx, str.SOFTWAREMicrosoftWindows_CE_ServicesAutoStartDisconnect
mov rcx, 0xffffffff80000002
call fcn.14000caa0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 1], xmm0
mov qword [rbp + 0xf], rax
mov r9d, 0x20019
lea r8, str.SystemCurrentControlSetControlSafeBootOption
mov rdx, 0xffffffff80000002
lea rcx, [rbp - 1]
call fcn.140027410
nop
mov rbx, qword [rbp - 1]
test rbx, rbx
je 0x1400119b1
mov dword [rbp - 0x39], 4
lea rax, [rbp - 0x39]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x31]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x29]
xor r8d, r8d
lea rdx, str.UseAlternateShell
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400119b1
cmp dword [rbp - 0x29], 4
jne 0x1400119b1
lea r9d, [rax + 0x20]
mov byte [rsp + 0x28], 1
mov qword [rsp + 0x20], rsi
lea r8, str.AlternateShell
lea rdx, str.SYSTEMCurrentControlSetControlSafeBoot
mov rcx, 0xffffffff80000002
call fcn.14000d530
mov r9b, 1
mov r8, rsi
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
mov rcx, 0xffffffff80000002
call fcn.14000caa0
nop
test rbx, rbx
je 0x1400119da
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
call fcn.14002dc10
test al, al
je 0x1400119ed
mov rcx, qword [rbp - 0x11]
call qword [sym.imp.KERNEL32.dll_Wow64RevertWow64FsRedirection]
cmp byte [0x14011a510], 0
je 0x140011f91
call fcn.14002dc10
test al, al
jne 0x140011a35
cmp byte [0x140135b10], al
jne 0x140011a28
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [0x140135b0c]
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
mov byte [0x140135b10], 1
cmp dword [0x140135b0c], 0
je 0x140011ac4
mov r9b, 1
mov r8, rsi
lea rdx, str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000002
call fcn.14000caa0
mov r9b, 1
mov r8, rsi
lea rdx, str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionRunOnce
mov rcx, 0xffffffff80000002
call fcn.14000caa0
mov r9b, 1
mov r8, rsi
lea rdx, str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionRunOnceEx
mov rcx, 0xffffffff80000002
call fcn.14000caa0
mov r9b, 1
mov r8, rsi
lea rdx, str.SOFTWAREWow6432NodeMicrosoftActive_SetupInstalled_Components
call fcn.140012090
mov r9b, 1
mov r8, rsi
lea rdx, str.SOFTWAREWow6432NodeMicrosoftWindows_CE_ServicesAutoStartOnConnect
mov rcx, 0xffffffff80000002
call fcn.14000caa0
mov r9b, 1
mov r8, rsi
lea rdx, str.SOFTWAREWow6432NodeMicrosoftWindows_CE_ServicesAutoStartOnDisconnect
mov rcx, 0xffffffff80000002
call fcn.14000caa0
call fcn.14002dc10
test al, al
je 0x140011ad8
lea rcx, [rbp - 9]
call qword [sym.imp.KERNEL32.dll_Wow64DisableWow64FsRedirection]
nop
mov qword [rbp - 0x61], r14
mov rcx, qword [r12]
test rcx, rcx
je 0x140011af3
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x140011b04
call fcn.140008180
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x140012034
mov rax, qword [rcx]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x61], rbx
mov dword [rsp + 0x38], 0x10
mov r14, r15
lea rax, str.InstallSoftwareMicrosoftWindowsCurrentVersionRunOnce
nop dword [rax]
inc r14
cmp word [rax + r14*2], 0
jne 0x140011b30
movsxd rdi, dword [r12 + 8]
lea r13d, [r14 + rdi]
test r13d, r13d
js 0x14001206b
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, r13d
or eax, ecx
jge 0x140011b6f
mov edx, r13d
lea rcx, [rbp - 0x61]
call fcn.140006870
mov rbx, qword [rbp - 0x61]
mov rax, rdi
add rax, rax
mov qword [rsp + 0x30], rax
je 0x140011bbb
test rbx, rbx
je 0x140011ba6
mov rdi, qword [rbp - 0x41]
mov r8, rax
mov rcx, rbx
test rdi, rdi
je 0x140011b9a
mov rdx, rdi
call fcn.14009d3c0
jmp 0x140011bb6
xor edx, edx
call fcn.14009e880
test rdi, rdi
jne 0x140011bb6
call fcn.1400a31cc
mov dword [rax], 0x16
call fcn.1400a3060
mov rax, qword [rsp + 0x30]
movsxd r8, r14d
add r8, r8
lea rcx, [rax + rbx]
je 0x140011bea
test rcx, rcx
jne 0x140011bde
call fcn.1400a31cc
mov dword [rax], 0x16
call fcn.1400a3060
jmp 0x140011bea
lea rdx, str.InstallSoftwareMicrosoftWindowsCurrentVersionRunOnce
call fcn.14009d3c0
cmp r13d, dword [rbx - 0xc]
jg 0x14001206b
mov dword [rbx - 0x10], r13d
movsxd rax, r13d
xor r14d, r14d
mov word [rbx + rax*2], r14w
mov r9b, 1
mov r8, rsi
mov rdx, rbx
mov rcx, 0xffffffff80000002
call fcn.14000caa0
mov dword [rsp + 0x38], r14d
mov eax, r15d
lock xadd dword [rbx - 8], eax
sub eax, 1
jg 0x140011c39
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
lea rdx, [rbx - 0x18]
call qword [rax + VariantCopy]
nop
mov qword [rbp - 0x59], r14
mov rcx, qword [r12]
test rcx, rcx
je 0x140011c54
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x140011c65
call fcn.140008180
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x14001203f
mov rax, qword [rcx]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x59], rbx
mov dword [rsp + 0x38], 0x20
mov r14, r15
lea rax, str.InstallSoftwareMicrosoftWindowsCurrentVersionRunOnceEx
nop
inc r14
cmp word [rax + r14*2], 0
jne 0x140011c90
movsxd rdi, dword [r12 + 8]
lea r13d, [r14 + rdi]
test r13d, r13d
js 0x140012060
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, r13d
or eax, ecx
jge 0x140011ccf
mov edx, r13d
lea rcx, [rbp - 0x59]
call fcn.140006870
mov rbx, qword [rbp - 0x59]
mov rax, rdi
add rax, rax
mov qword [rsp + 0x30], rax
je 0x140011d1b
test rbx, rbx
je 0x140011d06
mov rdi, qword [rbp - 0x41]
mov r8, rax
mov rcx, rbx
test rdi, rdi
je 0x140011cfa
mov rdx, rdi
call fcn.14009d3c0
jmp 0x140011d16
xor edx, edx
call fcn.14009e880
test rdi, rdi
jne 0x140011d16
call fcn.1400a31cc
mov dword [rax], 0x16
call fcn.1400a3060
mov rax, qword [rsp + 0x30]
movsxd r8, r14d
add r8, r8
lea rcx, [rax + rbx]
je 0x140011d4a
test rcx, rcx
jne 0x140011d3e
call fcn.1400a31cc
mov dword [rax], 0x16
call fcn.1400a3060
jmp 0x140011d4a
lea rdx, str.InstallSoftwareMicrosoftWindowsCurrentVersionRunOnceEx
call fcn.14009d3c0
cmp r13d, dword [rbx - 0xc]
jg 0x140012060
mov dword [rbx - 0x10], r13d
movsxd rax, r13d
xor r14d, r14d
mov word [rbx + rax*2], r14w
mov r9b, 1
mov r8, rsi
mov rdx, rbx
mov rcx, 0xffffffff80000002
call fcn.14000caa0
mov dword [rsp + 0x38], r14d
mov eax, r15d
lock xadd dword [rbx - 8], eax
sub eax, 1
jg 0x140011d98
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
lea rdx, [rbx - 0x18]
call qword [rax + VariantCopy]
mov r9d, 0x2c
mov byte [rsp + 0x28], 1
mov qword [rsp + 0x20], rsi
lea r8, str.InitialProgram
lea rdx, str.SYSTEMCurrentControlSetControlTerminal_ServerWinStationsRDP_Tcp
mov rcx, 0xffffffff80000002
call fcn.14000d530
nop
mov qword [rbp - 0x51], r14
mov rcx, qword [r12]
test rcx, rcx
je 0x140011dde
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x140011def
call fcn.140008180
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x14001204a
mov rax, qword [rcx]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x51], rbx
mov ecx, 1
mov dword [rsp + 0x38], ecx
mov r14, r15
lea rax, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
nop dword [rax]
inc r14
cmp word [rax + r14*2], 0
jne 0x140011e20
movsxd rdi, dword [r12 + 8]
lea r13d, [r14 + rdi]
test r13d, r13d
js 0x140012055
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, r13d
or eax, ecx
jge 0x140011e5a
mov edx, r13d
lea rcx, [rbp - 0x51]
call fcn.140006870
mov rbx, qword [rbp - 0x51]
mov rax, rdi
add rax, rax
mov qword [rsp + 0x30], rax
je 0x140011ea6
test rbx, rbx
je 0x140011e91
mov rdi, qword [rbp - 0x41]
mov r8, rax
mov rcx, rbx
test rdi, rdi
je 0x140011e85
mov rdx, rdi
call fcn.14009d3c0
jmp 0x140011ea1
xor edx, edx
call fcn.14009e880
test rdi, rdi
jne 0x140011ea1
call fcn.1400a31cc
mov dword [rax], 0x16
call fcn.1400a3060
mov rax, qword [rsp + 0x30]
movsxd r8, r14d
add r8, r8
lea rcx, [rax + rbx]
je 0x140011ed5
test rcx, rcx
jne 0x140011ec9
call fcn.1400a31cc
mov dword [rax], 0x16
call fcn.1400a3060
jmp 0x140011ed5
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
call fcn.14009d3c0
cmp r13d, dword [rbx - 0xc]
jg 0x140012055
mov dword [rbx - 0x10], r13d
movsxd rax, r13d
xor r14d, r14d
mov word [rbx + rax*2], r14w
mov r9b, 1
mov r8, rsi
mov rdx, rbx
mov rcx, 0xffffffff80000002
call fcn.14000caa0
nop
mov eax, r15d
lock xadd dword [rbx - 8], eax
sub eax, 1
jg 0x140011f1f
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
lea rdx, [rbx - 0x18]
call qword [rax + VariantCopy]
call fcn.14002dc10
test al, al
jne 0x140011f56
cmp byte [0x140135b10], al
jne 0x140011f4d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [0x140135b0c]
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
mov byte [0x140135b10], 1
cmp dword [0x140135b0c], 0
je 0x140011f7d
call fcn.14002dc10
test al, al
je 0x140011f69
lea rcx, [rbp - 0x21]
call qword [sym.imp.KERNEL32.dll_Wow64DisableWow64FsRedirection]
call fcn.14002dc10
test al, al
je 0x140011f7d
mov rcx, qword [rbp - 0x21]
call qword [sym.imp.KERNEL32.dll_Wow64RevertWow64FsRedirection]
nop
call fcn.14002dc10
test al, al
je 0x140011f91
mov rcx, qword [rbp - 9]
call qword [sym.imp.KERNEL32.dll_Wow64RevertWow64FsRedirection]
nop
lock xadd dword [r12 + 0x10], r15d
sub r15d, 1
jg 0x140011fac
mov rcx, qword [r12]
mov rax, qword [rcx]
mov rdx, r12
call qword [rax + VariantCopy]
nop
mov rbx, qword [rbp - 0x49]
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x140011fc9
mov rax, qword [rcx]
cmp rcx, rbx
setne dl
call qword [rax + 0x20]
mov qword [rbx + 0x38], r14
mov al, 1
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.14009c570
mov rbx, qword [rsp + 0x130]
add rsp, 0xe0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80070057
call fcn.140007f00
nop
mov ecx, 0x80070057
call fcn.140007f00
nop
mov ecx, 0x80004005
call fcn.140007f00
nop
mov ecx, 0x80004005
call fcn.140007f00
nop
mov ecx, 0x80004005
call fcn.140007f00
nop
mov ecx, 0x80004005
call fcn.140007f00
nop
mov ecx, 0x80004005
call fcn.140007f00
nop
mov ecx, 0x80004005
call fcn.140007f00
nop
mov ecx, 0x80004005
call fcn.140007f00
nop
mov ecx, 0x80070057
call fcn.140007f00
nop
mov ecx, 0x80070057
call fcn.140007f00
nop
mov ecx, 0x80070057
call fcn.140007f00
nop
mov ecx, 0x80070057
call fcn.140007f00
int3