Function at 0x1400cad90
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
jmp 0x1400f5fa0
push rbp
push rdi
sub rsp, 0x758
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x13a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x1402c2078]
xor rax, rbp
mov qword [rbp + 0x710], rax
lea rcx, [0x1402e0130]
call fcn.1400ccc53
mov edx, 0x20
lea rcx, [rbp + 8]
call fcn.1400c7d39
lea rcx, [rbp + 8]
call fcn.1400c89cd
nop
mov dword [rbp + 0x44], 0
lea rcx, [rbp + 8]
call fcn.1400cc122
add rax, 0x104
mov rdx, rax
lea rcx, [rbp + 8]
call fcn.1400c83ce
lea rcx, [rbp + 8]
call fcn.1400cc122
mov dword [rbp + 0x6e4], eax
xor edx, edx
lea rcx, [rbp + 8]
call fcn.1400cb5f6
mov qword [rbp + 0x6e8], rax
mov r8d, dword [rbp + 0x6e4]
mov rdx, qword [rbp + 0x6e8]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [rbp + 0x44], eax
lea rcx, [rbp + 8]
call fcn.1400cc122
mov ecx, dword [rbp + 0x44]
cmp rcx, rax
jae 0x1400f5ffc
mov eax, dword [rbp + 0x44]
mov edx, eax
lea rcx, [rbp + 8]
call fcn.1400c83ce
lea rcx, [rbp + 0x514]
call fcn.1400ca179
mov qword [rbp + 0x6e8], rax
lea rax, [rbp + 0x538]
mov qword [rbp + 0x568], rax
mov rdx, qword [rbp + 0x568]
lea rcx, [rbp + 8]
call fcn.1400c773a
mov qword [rbp + 0x6f0], rax
mov rax, qword [rbp + 0x6f0]
mov qword [rbp + 0x6f8], rax
lea rax, [rbp + 0x588]
mov qword [rbp + 0x5b8], rax
mov rdx, qword [rbp + 0x5b8]
lea rcx, [rbp + 8]
call fcn.1400cceb5
mov qword [rbp + 0x700], rax
mov rax, qword [rbp + 0x700]
mov qword [rbp + 0x708], rax
mov r9, qword [rbp + 0x6e8]
mov r8, qword [rbp + 0x6f8]
mov rdx, qword [rbp + 0x708]
lea rcx, [rbp + 0x68]
call fcn.1400cccb2
nop
xor r8d, r8d
lea rdx, [rbp + 0x68]
lea rcx, [rbp + 0xa8]
call fcn.1400c74d3
nop
xor r8d, r8d
lea rdx, str.C:_test
lea rcx, [rbp + 0xe8]
call fcn.1400c72da
nop
lea rdx, [rbp + 0x5d8]
lea rcx, [rbp + 0xa8]
call fcn.1400c9a8f
mov qword [rbp + 0x6e8], rax
mov rax, qword [rbp + 0x6e8]
mov qword [rbp + 0x6f0], rax
mov r8, qword [rbp + 0x6f0]
lea rdx, [rbp + 0xe8]
lea rcx, [rbp + 0x128]
call fcn.1400cc366
nop
lea rcx, [rbp + 0x5d8]
call fcn.1400cc415
nop
lea rcx, [rbp + 0xe8]
call fcn.1400cc1b8
lea rax, [rbp + 0x614]
mov rdi, rax
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
lea rcx, [rbp + 0x614]
call fcn.1400ca7f0
mov rdx, qword [rax]
lea rcx, [rbp + 0x128]
call fcn.1400cc9ab
mov byte [rbp + 0x6e4], al
movzx eax, byte [rbp + 0x6e4]
test eax, eax
jne 0x1400f61e8
mov r8d, 2
lea rdx, [rbp + 0x128]
lea rcx, [rbp + 0xa8]
call fcn.1400c8b12
nop
jmp 0x1400f61ea
lea rax, str.WinStart
mov qword [rbp + 0x1a8], rax
lea rdx, [rbp + 0x1c8]
lea rcx, [rbp + 0x128]
call fcn.1400cd2de
nop
lea rcx, [rbp + 0x1c8]
call fcn.1400c8fbd
mov qword [rbp + 0x208], rax
lea rcx, [rbp + 0x634]
call fcn.1400c8527
mov qword [rbp + 0x6e8], rax
lea rax, [rbp + 0x658]
mov qword [rbp + 0x688], rax
mov rdx, qword [rbp + 0x688]
lea rcx, [rbp + 0x1c8]
call fcn.1400cb6d7
mov qword [rbp + 0x6f0], rax
mov rax, qword [rbp + 0x6f0]
mov qword [rbp + 0x6f8], rax
lea rax, [rbp + 0x6a8]
mov qword [rbp + 0x6d8], rax
mov rdx, qword [rbp + 0x6d8]
lea rcx, [rbp + 0x1c8]
call fcn.1400c9c6f
mov qword [rbp + 0x700], rax
mov rax, qword [rbp + 0x700]
mov qword [rbp + 0x708], rax
mov r9, qword [rbp + 0x6e8]
mov r8, qword [rbp + 0x6f8]
mov rdx, qword [rbp + 0x708]
lea rcx, [rbp + 0x228]
call fcn.1400c9ea9
nop
lea rcx, [rbp + 0x228]
call fcn.1400c78bb
mov qword [rbp + 0x268], rax
lea rax, [rbp + 0x188]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rbp + 0x284], eax
cmp dword [rbp + 0x284], 0
jne 0x1400f6364
mov rcx, qword [rbp + 0x268]
call fcn.1400c9963
mov dword [rbp + 0x6e4], eax
mov rax, qword [rbp + 0x188]
mov qword [rbp + 0x6e8], rax
mov eax, dword [rbp + 0x6e4]
mov dword [rsp + 0x28], eax
mov rax, qword [rbp + 0x268]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov rdx, qword [rbp + 0x1a8]
mov rcx, qword [rbp + 0x6e8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [rbp + 0x284], eax
mov rcx, qword [rbp + 0x188]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edx, edx
lea rcx, str.ConsoleWindowClass
call qword [sym.imp.USER32.dll_FindWindowA]
mov edx, 1
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
lea rdx, [0x1400cab15]
lea rcx, [rbp + 0x2a8]
call fcn.1400c995e
nop
lea rcx, [rbp + 0x2a8]
call fcn.1400c7050
nop
lea rcx, [rbp + 0x2a8]
call fcn.1400c99c2
nop
lea rcx, [rbp + 0x228]
call fcn.1400c8121
nop
lea rcx, [rbp + 0x1c8]
call fcn.1400cbe6b
nop
lea rcx, [rbp + 0x128]
call fcn.1400cc415
nop
lea rcx, [rbp + 0xe8]
call fcn.1400cc415
nop
lea rcx, [rbp + 0xa8]
call fcn.1400cc415
nop
lea rcx, [rbp + 0x68]
call fcn.1400cbe6b
nop
lea rcx, [rbp + 8]
call fcn.1400c7109
xor eax, eax
mov edi, eax
lea rcx, [rbp - 0x30]
lea rdx, [0x14026efa0]
call fcn.1400cbc18
mov eax, edi
mov rcx, qword [rbp + 0x710]
xor rcx, rbp
call fcn.1400c9c97
lea rsp, [rbp + 0x728]
pop rdi
pop rbp
ret