Function at 0x140001a44
Capabilities:
Check os version
Get common file path
Hash data with md5
Persist via windows service
Query or enumerate registry value
Set file attributes
Set registry value

Disassembly:
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1ea0
call fcn.1400372a0
sub rsp, rax
mov qword [rsp + 0xf0], 0xfffffffffffffffe
mov qword [rsp + 0x1ed0], rbx
mov qword [rsp + 0x1ed8], rbp
mov qword [rsp + 0x1ee0], rsi
mov rax, qword [0x140050110]
xor rax, rsp
mov qword [rsp + 0x1e90], rax
call fcn.140033c50
xor ebx, ebx
mov word [rsp + 0x840], bx
xor edx, edx
mov r8d, 0x3fe
lea rcx, [rsp + 0x842]
call fcn.14001da40
mov ebp, 0x400
mov dword [rsp + 0xa0], ebp
lea r9, str.diskpt
lea r8, str.SYSTEMCurrentControlSetServices_s
mov edx, 0x80
lea rcx, [rsp + 0x530]
call fcn.14001d240
lea rdx, [rsp + 0xa0]
mov qword [rsp + 0x28], rdx
lea rax, [rsp + 0x840]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xa4]
lea r8, str.Sync
lea rdx, [rsp + 0x530]
mov rsi, 0xffffffff80000002
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp eax, ebx
je 0x140001b33
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140002319
lea rax, [rsp + 0x630]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x801a
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
cmp eax, ebx
jl 0x140002319
mov edi, 0x5c
mov edx, edi
lea rcx, [rsp + 0x630]
call fcn.14001d488
cmp rax, rbx
jne 0x140001b82
lea ecx, [rdi - 5]
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140002319
mov word [rax], bx
mov edx, edi
lea rcx, [rsp + 0x630]
call fcn.14001d488
cmp rax, rbx
jne 0x140001ba9
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140002319
mov word [rax], bx
mov edx, edi
lea rcx, [rsp + 0x630]
call fcn.14001d518
cmp rax, rbx
jne 0x140001bd0
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140002319
mov edx, edi
lea rcx, [rax + 2]
call fcn.14001d518
cmp rax, rbx
je 0x140001bf2
mov edx, edi
lea rcx, [rsp + 0x630]
call fcn.14001d488
mov word [rax], bx
lea r8, str.Shadow_Defenderuser.dat
mov edx, 0x104
lea rcx, [rsp + 0x630]
call fcn.14001d288
lea r8, [0x1400427e8]
mov r13d, 0x200
mov rdx, r13
lea rcx, [rsp + 0x840]
call fcn.14001d288
lea r8, [rsp + 0x630]
mov rdx, r13
lea rcx, [rsp + 0x840]
call fcn.14001d288
xor eax, eax
or r12, 0xffffffffffffffff
mov rcx, r12
lea rdi, [rsp + 0x840]
repne scasw ax, word [rdi]
not rcx
lea eax, [rcx + rcx]
mov dword [rsp + 0xa0], eax
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x840]
mov qword [rsp + 0x20], rax
lea r9d, [r12 + 2]
lea r8, str.Sync
lea rdx, [rsp + 0x530]
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov dword [rsp + 0xa0], ebp
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x840]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xa4]
lea r8, str.GUID
lea rdx, [rsp + 0x530]
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea r8, str._BLANKPWD
mov rdx, r13
lea rcx, [rsp + 0x840]
call fcn.14001d288
lea rdx, vtable.MD5_CTX.0
mov qword [rsp + 0x100], rdx
mov dword [rsp + 0x11c], ebx
mov dword [rsp + 0x118], ebx
mov dword [rsp + 0x108], 0x67452301
mov dword [rsp + 0x10c], 0xefcdab89
mov dword [rsp + 0x110], 0x98badcfe
mov dword [rsp + 0x114], 0x10325476
xor edx, edx
lea r8d, [r12 + 0x41]
lea rcx, [rsp + 0x160]
call fcn.14001da40
mov byte [rsp + 0x160], 0x80
xor eax, eax
mov rcx, r12
lea rdi, [rsp + 0x840]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx + rcx - 2]
lea rdx, [rsp + 0x840]
lea rcx, [rsp + 0x100]
call fcn.140005384
lea rdx, [rsp + 0x510]
lea rcx, [rsp + 0x100]
call fcn.140005470
movzx edx, byte [rsp + 0x51f]
movzx eax, byte [rsp + 0x51e]
movzx ecx, byte [rsp + 0x51d]
movzx edi, byte [rsp + 0x51c]
movzx r8d, byte [rsp + 0x51b]
movzx r10d, byte [rsp + 0x51a]
movzx r11d, byte [rsp + 0x519]
movzx ebx, byte [rsp + 0x518]
movzx esi, byte [rsp + 0x517]
movzx ebp, byte [rsp + 0x516]
movzx r12d, byte [rsp + 0x515]
movzx r13d, byte [rsp + 0x514]
movzx r14d, byte [rsp + 0x513]
movzx r15d, byte [rsp + 0x512]
movzx r9d, byte [rsp + 0x510]
mov dword [rsp + 0x90], edx
mov dword [rsp + 0x88], eax
mov dword [rsp + 0x80], ecx
mov dword [rsp + 0x78], edi
mov dword [rsp + 0x70], r8d
mov dword [rsp + 0x68], r10d
mov dword [rsp + 0x60], r11d
mov dword [rsp + 0x58], ebx
mov dword [rsp + 0x50], esi
mov dword [rsp + 0x48], ebp
mov dword [rsp + 0x40], r12d
mov dword [rsp + 0x38], r13d
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x28], r15d
movzx eax, byte [rsp + 0x511]
mov dword [rsp + 0x20], eax
lea r8, str._02x_02x_02x_02x_02x_02x_02x_02x_02x_02x_02x_02x_02x_02x_02x_02x
mov r12d, 0x200
mov rdx, r12
lea rcx, [rsp + 0x840]
call fcn.14001d240
mov dword [rsp + 0xa0], 0x400
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xe50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xa4]
lea r8, str.Path
lea rdx, str.SOFTWAREShadow_Defender
mov rbp, 0xffffffff80000002
mov rcx, rbp
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
xor ebx, ebx
cmp eax, ebx
je 0x140001efd
mov esi, 0x104
mov r8d, esi
lea rdx, [rsp + 0xe50]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [rbx + 0x5c]
lea rcx, [rsp + 0xe50]
call fcn.14001d488
mov word [rax], bx
jmp 0x140001f02
mov esi, 0x104
mov dword [rsp + 0x1a0], 0x114
lea rcx, [rsp + 0x1a0]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov edi, 4
cmp dword [rsp + 0x1a4], 5
jne 0x140001fca
cmp dword [rsp + 0x1a8], ebx
jne 0x140001fca
mov dword [rsp + 0xa0], edi
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xa4]
lea r8, str.Control
lea rdx, [rsp + 0x530]
mov rcx, rbp
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov edx, dword [rsp + 0xa8]
mov ecx, 0x10000000
cmp eax, ebx
cmovne edx, ecx
and edx, 0xfffffffe
mov dword [rsp + 0xa8], edx
mov dword [rsp + 0xa0], edi
mov dword [rsp + 0x28], edi
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x20], rax
mov r9d, edi
lea r8, str.Control
lea rdx, [rsp + 0x530]
mov rcx, rbp
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
lea r9, [rsp + 0xe50]
lea r8, str._suser.dat
mov rdx, r12
lea rcx, [rsp + 0x1a90]
call fcn.14001d240
mov edx, 0x80
lea rcx, [rsp + 0x1a90]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea r9, [rsp + 0x1a90]
lea r8, [rsp + 0x840]
lea rdx, str.hash
lea rcx, str.common
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea r9, [rsp + 0xe50]
lea r8, str._sDefender.exe
mov rdx, rsi
lea rcx, [rsp + 0x1670]
call fcn.14001d240
lea r9, [rsp + 0xe50]
lea r8, str._sCommit.exe
mov rdx, rsi
lea rcx, [rsp + 0x1460]
call fcn.14001d240
lea r9, [rsp + 0xe50]
lea r8, str._sDefenderDaemon.exe
mov rdx, rsi
lea rcx, [rsp + 0x1880]
call fcn.14001d240
lea r9, [rsp + 0xe50]
lea r8, str._sCmdTool.exe
mov rdx, rsi
lea rcx, [rsp + 0x1250]
call fcn.14001d240
lea rdx, [rsp + 0x1880]
mov qword [rsp + 0xc0], rdx
lea rax, [rsp + 0x1460]
mov qword [rsp + 0xc8], rax
lea rax, [rsp + 0x1670]
mov qword [rsp + 0xd0], rax
lea rax, [rsp + 0x1250]
mov qword [rsp + 0xd8], rax
mov dword [rsp + 0xb0], ebx
mov r14d, 1
mov dword [rsp + 0xb4], r14d
lea r12d, [r14 + 2]
mov dword [rsp + 0xb8], r12d
mov dword [rsp + 0xbc], r12d
lea rdx, [rsp + 0x2c0]
lea rcx, [rsp + 0x1250]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
or r15, 0xffffffffffffffff
cmp rax, r15
je 0x140002147
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
mov r8d, edi
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0xc0]
call fcn.140033eb0
jmp 0x14000215f
mov r8d, r12d
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0xc0]
call fcn.140033eb0
lea r9, [rsp + 0xe50]
lea r8, str._sShellExt.dll
mov rdx, rsi
lea rcx, [rsp + 0xc40]
call fcn.14001d240
lea rcx, [rsp + 0xc40]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rdi, rax
cmp rax, rbx
je 0x1400021b4
lea rdx, str.DllRegisterServer
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp rax, rbx
je 0x1400021ab
call rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edi, 0x10
mov dword [rsp + 0xa0], edi
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xa4]
lea r13, [0x14004376c]
mov r8, r13
lea rdx, str.CLSID78C3F4BC_C7BC_48E4_AD72_2DD16F6704A9
mov rbp, 0xffffffff80000000
mov rcx, rbp
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp eax, ebx
je 0x140002319
lea rcx, [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [rsp + 0xa0], edi
mov dword [rsp + 0x28], edi
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x20], rax
mov r9d, r12d
mov r8, r13
lea rdx, str.CLSID78C3F4BC_C7BC_48E4_AD72_2DD16F6704A9
mov rcx, rbp
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov edx, esi
lea rcx, [rsp + 0xc40]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea r8, str._shell32.dll
mov edx, 0x105
lea rcx, [rsp + 0xc40]
call fcn.14001d288
xor eax, eax
mov rcx, r15
lea rdi, [rsp + 0xc40]
repne scasw ax, word [rdi]
not rcx
sub rcx, r14
add ecx, ecx
mov dword [rsp + 0x28], ecx
lea rax, [rsp + 0xc40]
mov qword [rsp + 0x20], rax
mov r9d, r14d
mov r8, r13
lea rdx, str.CLSID78C3F4BC_C7BC_48E4_AD72_2DD16F6704A9InprocServer32
mov rcx, rbp
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
lea rcx, [rsp + 0x510]
mov rax, qword [0x140042a48]
mov qword [rcx], rax
mov rax, qword [0x140042a50]
mov qword [rcx + 8], rax
mov eax, dword [0x140042a58]
mov dword [rcx + 0x10], eax
xor eax, eax
mov rcx, r15
lea rdi, [rsp + 0x510]
repne scasw ax, word [rdi]
not rcx
sub rcx, r14
add ecx, ecx
mov dword [rsp + 0x28], ecx
lea rax, [rsp + 0x510]
mov qword [rsp + 0x20], rax
mov r9d, r14d
lea r8, str.ThreadingModel
lea rdx, str.CLSID78C3F4BC_C7BC_48E4_AD72_2DD16F6704A9InprocServer32
mov rcx, rbp
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
nop
mov rcx, qword [rsp + 0x1e90]
xor rcx, rsp
call fcn.14001cb20
lea r11, [rsp + 0x1ea0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret