Function at 0x140004020
Capabilities:
Persist via winlogon helper dll registry key
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0xf0
mov rax, qword [0x14000d208]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov r14, rcx
xor r15d, r15d
mov edi, r15d
mov dword [rbp - 0x59], r15d
mov r8, rcx
lea rdx, [rbp - 0x21]
lea rcx, [rbp - 0x29]
call fcn.140002a00
movzx ebx, al
test al, al
je 0x140003051
mov dword [rbp - 0x59], r15d
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.IsWow64Process
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x140002bbd
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rbp - 0x59]
call rbx
test eax, eax
je 0x140002bbd
mov eax, r15d
cmp dword [rbp - 0x59], eax
setne al
jmp 0x140002bc0
mov eax, r15d
shl eax, 8
add eax, 0xf003f
mov qword [rbp - 0x41], r15
mov qword [rsp + 0x40], r15
lea rcx, [rbp - 0x41]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionWinLogon
mov rcx, qword [rbp + 0xf]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov rsi, qword [rbp - 0x41]
test rsi, rsi
je 0x140002cd7
lea rcx, [rbp - 0x39]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QCoreApplication::applicationDirPath_void_]
nop
mov rdx, rax
lea rcx, [rbp - 0x51]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QDir::constructor_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp - 0x39]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
mov r8d, 0xffffffff
lea rdx, str.bspsh.exe
lea rcx, [rbp - 0x31]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromWCharArray_wchar_t_const____ptr64__int_]
nop
mov r8, rax
lea rdx, [rbp - 0x49]
lea rcx, [rbp - 0x51]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QDir::absoluteFilePath_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp - 0x31]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea rcx, [rbp - 0x49]
call qword [sym.imp.Qt5Core.dll_public:_unsigned_short_int_const____ptr64___cdecl_QString::utf16_void_const___ptr64]
test rax, rax
je 0x140002cb4
mov rax, qword [rbp - 0x49]
mov ecx, dword [rax + 4]
lea ebx, [rcx*2 + 2]
lea rcx, [rbp - 0x49]
call qword [sym.imp.Qt5Core.dll_public:_unsigned_short_int_const____ptr64___cdecl_QString::utf16_void_const___ptr64]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.Shell
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140002cb4
mov bl, 1
jmp 0x140002cb6
xor bl, bl
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rbp - 0x49]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x51]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QDir::destructor_void____ptr64]
jmp 0x140002cd9
xor bl, bl
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 6]
call fcn.140001e90
test al, al
je 0x140002e0d
lea rdx, [rbp - 0x21]
lea rcx, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
call fcn.1400025b0
mov rsi, rax
test rax, rax
je 0x140002d65
test bl, bl
je 0x140002d45
mov edx, 0x2c
lea rcx, str._WINDIR_ResourcesThemesAero_aero.msstyles
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp - 0x51], rax
mov edi, 1
mov dword [rbp - 0x59], edi
lea r8, [rbp - 0x51]
lea rdx, str.SetVisualStyle
mov rcx, rsi
call fcn.140003090
test al, al
je 0x140002d45
movzx ebx, dil
jmp 0x140002d47
xor bl, bl
test dil, 1
je 0x140002d5a
and edi, 0xfffffffe
lea rcx, [rbp - 0x51]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140002d67
xor bl, bl
lea rdx, [rbp - 0x21]
lea rcx, str.SoftwareMicrosoftWindowsDWM
call fcn.1400025b0
mov rsi, rax
test rax, rax
je 0x140002e0b
test bl, bl
je 0x140002dfe
mov dword [rbp - 0x59], 1
mov dword [rsp + 0x28], 4
lea rax, [rbp - 0x59]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Composition
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140002dfe
mov dword [rbp - 0x59], 2
mov dword [rsp + 0x28], 4
lea rax, [rbp - 0x59]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.CompositionPolicy
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140002dfe
mov bl, 1
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140002e0d
xor bl, bl
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140002e0d
xor bl, bl
xor r8d, r8d
lea edx, [r8 + 1]
lea ecx, [rdx + 5]
call fcn.140001e90
test al, al
je 0x140002f98
lea rdx, [rbp - 0x21]
lea rcx, str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers
call fcn.1400025b0
mov rsi, rax
test rax, rax
je 0x140002f96
lea rcx, [rbp - 0x31]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QCoreApplication::applicationDirPath_void_]
nop
mov rdx, rax
lea rcx, [rbp - 0x49]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QDir::constructor_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp - 0x31]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
mov r8d, 0xffffffff
lea rdx, str.bsp.exe
lea rcx, [rbp - 0x59]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromWCharArray_wchar_t_const____ptr64__int_]
nop
mov r8, rax
lea rdx, [rbp - 0x39]
lea rcx, [rbp - 0x49]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QDir::absoluteFilePath_class_QString_const____ptr64____ptr64]
nop
mov rdx, rax
lea rcx, [rbp - 0x41]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QDir::toNativeSeparators_class_QString_const____ptr64_]
nop
lea rcx, [rbp - 0x39]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x59]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
test bl, bl
je 0x140002f06
mov edx, 0xe
lea rcx, str._HIGHDPIAWARE
call qword [sym.imp.Qt5Core.dll_private:_static_struct_QTypedArrayData_unsigned_short_int_____ptr64___cdecl_QString::fromAscii_helper_char_const____ptr64__int_]
mov qword [rbp - 0x51], rax
or edi, 2
mov dword [rbp - 0x59], edi
lea rdx, [rbp + 0x17]
lea rcx, [rbp - 0x41]
call qword [sym.imp.Qt5Core.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____cdecl_QString::toStdWString_void____ptr64]
nop
or edi, 4
mov dword [rbp - 0x59], edi
cmp qword [rax + 0x18], 8
jb 0x140002eef
mov rax, qword [rax]
lea r8, [rbp - 0x51]
mov rdx, rax
mov rcx, rsi
call fcn.140003090
test al, al
je 0x140002f06
mov bl, 1
jmp 0x140002f08
xor bl, bl
test dil, 4
je 0x140002f65
and edi, 0xfffffffb
mov rdx, qword [rbp + 0x2f]
cmp rdx, 8
jb 0x140002f54
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x17]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002f4f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002f4f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400052e4
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], 7
mov word [rbp + 0x17], r15w
test dil, 2
je 0x140002f75
lea rcx, [rbp - 0x51]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rbp - 0x41]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x49]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QDir::destructor_void____ptr64]
jmp 0x140002f98
xor bl, bl
cmp qword [str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem], 0
je 0x140003025
lea rdi, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
nop dword [rax]
test bl, bl
je 0x140003029
mov rdx, qword [rdi - 8]
mov rcx, qword [rdi]
cmp rdx, 0xffffffff80000001
jne 0x140002fcf
lea rdx, [rbp - 0x21]
call fcn.1400025b0
jmp 0x140002fd4
call fcn.1400024f0
mov rsi, rax
test rax, rax
je 0x14000307d
mov eax, dword [rdi + 0x10]
mov dword [rbp - 0x59], eax
mov dword [rsp + 0x28], 4
lea rax, [rbp - 0x59]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rdx, qword [rdi + 8]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete bl
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rdi, 0x20
cmp qword [rdi], 0
jne 0x140002fb0
test bl, bl
jne 0x140003039
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov rdx, r14
call fcn.140001260
mov rdx, qword [rbp + 0xf]
mov rcx, qword [rbp - 0x29]
call qword [sym.imp.USERENV.dll_UnloadUserProfile]
mov rcx, qword [rbp - 0x29]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, bl
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.140005400
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
xor bl, bl
jmp 0x140003029
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov bl, 1
call fcn.140001730
test al, al
jne 0x140004047
mov rcx, rdi
call fcn.140001c60
movzx ebx, al
test al, al
je 0x140004068
mov rcx, rdi
call fcn.140001f80
test al, al
jne 0x140004065
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x140002b20
movzx eax, bl
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret