Function at 0x1400017e0
Capabilities:
Persist via com hijack
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rax - 0x28]
sub rsp, 0x110
movaps xmmword [rax - 0x28], xmm6
movaps xmmword [rax - 0x38], xmm7
mov rax, qword [0x1400e9070]
xor rax, rsp
mov qword [rbp - 0x18], rax
mov rdi, rdx
xor r14d, r14d
lea rdx, [rbp - 0x80]
call qword [sym.imp.ole32.dll_StringFromCLSID]
mov qword [rbp - 0x38], r14
mov qword [rbp - 0x28], r14
mov qword [rbp - 0x20], r14
mov rdx, qword [rbp - 0x80]
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], r14w
jne 0x140001840
lea rcx, [rbp - 0x38]
call fcn.140003250
nop
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
movabs rsi, 0x7ffffffffffffffe
mov rax, rsi
mov rcx, qword [rbp - 0x28]
sub rax, rcx
cmp rax, 0x17
jb 0x140001c6e
lea rax, [rbp - 0x38]
cmp qword [rbp - 0x20], 8
cmovae rax, qword [rbp - 0x38]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x17
lea r9, str.SOFTWAREClassesCLSID_
lea rcx, [rsp + 0x40]
call fcn.140003500
nop
mov r8d, 0xe
lea rdx, str.LocalServer32
lea rcx, [rsp + 0x40]
call fcn.140003670
mov qword [rbp - 0x58], r14
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x48], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x58], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x48], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x140001933
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000192e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001c74
call fcn.140079b70
movdqa xmm0, xmmword [0x1400d6740]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], r14w
mov qword [rbp - 0x78], r14
mov qword [rbp - 0x68], r14
mov qword [rbp - 0x60], r14
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x140001953
mov r8, rbx
mov rdx, rdi
lea rcx, [rbp - 0x78]
call fcn.140003250
nop
mov rcx, qword [rbp - 0x68]
sub rsi, rcx
cmp rsi, 1
jb 0x140001c7a
lea rax, [rbp - 0x78]
cmp qword [rbp - 0x60], 8
cmovae rax, qword [rbp - 0x78]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 1
lea r9, [0x1400c31c8]
lea rcx, [rsp + 0x60]
call fcn.140003500
nop
mov r8d, 2
lea rdx, [0x1400c31c0]
lea rcx, [rsp + 0x60]
call fcn.140003670
mov qword [rsp + 0x40], r14
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
mov r8d, 0xf
lea rdx, str._ToastActivated
lea rcx, [rsp + 0x40]
call fcn.140003670
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x140001a65
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001a60
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001c80
call fcn.140079b70
movups xmmword [rbp - 0x78], xmm6
movups xmmword [rbp - 0x68], xmm7
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x140001aaf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001aaa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001c86
call fcn.140079b70
movdqa xmm0, xmmword [0x1400d6740]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], r14w
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x140001b05
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001b00
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001c8c
call fcn.140079b70
mov eax, dword [rbp - 0x68]
lea eax, [rax*2 + 2]
lea rcx, [rbp - 0x78]
cmp qword [rbp - 0x60], 8
cmovae rcx, qword [rbp - 0x78]
lea rdx, [rbp - 0x58]
cmp qword [rbp - 0x40], 8
cmovae rdx, qword [rbp - 0x58]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov ebx, eax
test eax, eax
jle 0x140001b59
movzx ebx, ax
or ebx, 0x80070000
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x140001b99
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001b94
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001c92
call fcn.140079b70
mov qword [rbp - 0x68], r14
mov qword [rbp - 0x60], 7
mov word [rbp - 0x78], r14w
mov rdx, qword [rbp - 0x40]
cmp rdx, 8
jb 0x140001bea
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001be5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001c98
call fcn.140079b70
movdqa xmm0, xmmword [0x1400d6740]
movdqu xmmword [rbp - 0x48], xmm0
mov word [rbp - 0x58], r14w
mov rdx, qword [rbp - 0x20]
cmp rdx, 8
jb 0x140001c38
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001c33
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001c68
call fcn.140079b70
mov eax, ebx
mov rcx, qword [rbp - 0x18]
xor rcx, rsp
call fcn.140079b50
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.140080d34
nop
call fcn.1400015a0
nop
call fcn.140080d34
nop
call fcn.1400015a0
nop
call fcn.140080d34
nop
call fcn.140080d34
nop
call fcn.140080d34
nop
call fcn.140080d34
nop
call fcn.140080d34
int3