Function at 0x1400195f0
Capabilities:
Delete file
Get file attributes
Persist via run registry key
Set registry value

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x1e8]
sub rsp, 0x2b0
mov qword [rbp - 0x78], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rax, qword [0x14002a7b8]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
mov rdi, r9
mov rsi, rdx
lea r12, [0x14002a0c8]
lea r13, [0x140021f20]
mov rcx, qword [0x14002a0c8]
cmp rcx, r12
je 0x140019663
test byte [rcx + 0x1c], 8
je 0x140019663
mov edx, 0x24
mov r9, rsi
mov r8, r13
mov rcx, qword [rcx + 0x10]
call fcn.140001a48
lea rax, [rbp - 0x80]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x28], 3
xor r14d, r14d
mov dword [rsp + 0x20], r14d
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersionAccessibility
mov rdx, 0xffffffff80000001
mov rcx, rdi
call fcn.140010e4c
mov ebx, eax
test eax, eax
je 0x1400196cf
mov rcx, qword [0x14002a0c8]
cmp rcx, r12
je 0x1400196bd
test byte [rcx + 0x1c], 8
je 0x1400196bd
lea edx, [r14 + 0x25]
mov r9d, ebx
mov r8, r13
mov rcx, qword [rcx + 0x10]
call fcn.140001a0c
movzx eax, bx
or eax, 0x80070000
test ebx, ebx
cmovle eax, ebx
jmp 0x1400199fd
test rsi, rsi
je 0x140019a27
or r15, 0xffffffffffffffff
mov rax, r15
inc rax
cmp word [rsi + rax*2], r14w
jne 0x1400196df
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
mov r9d, 1
xor r8d, r8d
lea rdx, str.Configuration
mov rcx, qword [rdi]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
test eax, eax
je 0x140019734
mov rcx, qword [0x14002a0c8]
cmp rcx, r12
je 0x1400196bd
test byte [rcx + 0x1c], 8
je 0x1400196bd
mov edx, 0x26
jmp 0x1400196ae
mov rbx, r14
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x60], r14
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test eax, eax
jne 0x140019785
mov edi, r14d
mov rbx, qword [rsp + 0x60]
mov qword [rsp + 0x68], rbx
test edi, edi
je 0x1400197c2
mov rcx, qword [0x14002a0c8]
cmp rcx, r12
je 0x1400197af
test byte [rcx + 0x1c], 8
je 0x1400197af
mov edx, 0x27
mov r9d, edi
mov r8, r13
mov rcx, qword [rcx + 0x10]
call fcn.140001a0c
movzx esi, di
or esi, 0x80070000
test edi, edi
cmovle esi, edi
jmp 0x1400199ed
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x70]
call sub.msvcrt.dll_memset
mov dword [rsp + 0x58], 0x104
lea r9, [rsp + 0x58]
lea r8, [rbp - 0x70]
lea rdx, str.Startup
lea rcx, [rsp + 0x68]
call fcn.1400159e0
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x50]
call fcn.140003130
nop
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x48]
call fcn.140003130
nop
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x40]
call fcn.140003130
nop
lea rdx, str.On_Screen_Keyboard.lnk
mov rax, r15
inc rax
cmp word [rdx + rax*2], r14w
jne 0x14001982c
mov r8d, eax
lea rcx, [rsp + 0x50]
call fcn.140016900
lea rdx, str.Narrator.lnk
mov rax, r15
inc rax
cmp word [rdx + rax*2], r14w
jne 0x14001984d
mov r8d, eax
lea rcx, [rsp + 0x48]
call fcn.140016900
lea rdx, str.Magnifier.lnk
mov rax, r15
inc rax
cmp word [rdx + rax*2], r14w
jne 0x14001986e
mov r8d, eax
lea rcx, [rsp + 0x40]
call fcn.140016900
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov bl, 0x10
or edi, 0xffffffff
cmp eax, edi
je 0x1400198d5
lea r8, str._osk
mov rcx, rsi
call fcn.140019ec4
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [0x14002a0c8]
cmp rcx, r12
je 0x1400198d5
test byte [rcx + 0x1c], bl
je 0x1400198d5
mov edx, 0x28
mov r8, r13
mov rcx, qword [rcx + 0x10]
call fcn.1400019e8
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, edi
je 0x140019920
lea r8, str._Narrator
mov rcx, rsi
call fcn.140019ec4
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [0x14002a0c8]
cmp rcx, r12
je 0x140019920
test byte [rcx + 0x1c], bl
je 0x140019920
mov edx, 0x29
mov r8, r13
mov rcx, qword [rcx + 0x10]
call fcn.1400019e8
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, edi
je 0x14001996b
lea r8, str._magnifierpane
mov rcx, rsi
call fcn.140019ec4
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [0x14002a0c8]
cmp rcx, r12
je 0x14001996b
test byte [rcx + 0x1c], bl
je 0x14001996b
mov edx, 0x2a
mov r8, r13
mov rcx, qword [rcx + 0x10]
call fcn.1400019e8
mov esi, r14d
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x140019997
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x1400200f0]
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x1400199c0
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x1400200f0]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x1400199e8
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x1400200f0]
mov rbx, qword [rsp + 0x68]
test rbx, rbx
je 0x1400199fb
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.14001d6c0
mov rbx, qword [rsp + 0x2f0]
add rsp, 0x2b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80004005
call fcn.1400017a4
int3