Function at 0x18005d002
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push rbp
sub rsp, 0x6b0
lea rbp, [rsp + 0x50]
mov qword [rsp], rax
mov rax, 0x6ac
mov dword [rsp + rax], 0xcccccccc
sub rax, 4
cmp rax, 4
jg 0x18005cff1
mov rax, qword [rsp]
mov dword [rsp], 0xcccccccc
mov dword [rsp + 4], 0xcccccccc
mov qword [rbp + 0x1a8], rsi
mov qword [rbp + 0x1a0], rbx
mov qword [rbp + 0x670], rcx
mov qword [rbp + 0x678], rdx
mov rax, qword [0x1800f4ae8]
xor rax, rbp
mov qword [rbp + 0x658], rax
mov byte [rbp + 0x59], 0
mov byte [rbp + 0x5a], 0
mov byte [rbp + 0x58], 0
mov dword [rbp + 0x60], 0
mov dword [rbp + 0x14], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x48], 0
lea rax, [rbp + 0x1b8]
lea rdx, [0x180104fa0]
mov rcx, rax
call fcn.180062660
mov qword [rbp + 0xc8], rax
lea rax, [rbp + 0x240]
mov edx, 0x100
lea rcx, [0x180104fe4]
mov rbx, qword [rbp + 0x670]
mov qword [rbp + 0x148], rcx
mov rcx, rax
mov rax, qword [rbp + 0x148]
mov r8, rax
mov r9, rbx
call fcn.1800667e0
mov dword [rbp + 0x64], eax
lea rax, [rbp + 0x448]
lea rdx, [rbp + 0x1b8]
mov rcx, rax
call fcn.180062660
mov qword [rbp + 0xd0], rax
lea rax, [rbp + 0x448]
lea rdx, [0x180104ff4]
mov rcx, rax
call fcn.1800625e0
mov qword [rbp + 0xd8], rax
lea rax, [rbp + 0x448]
mov rdx, qword [rbp + 0x678]
mov rcx, rax
call fcn.1800625e0
mov qword [rbp + 0xe0], rax
lea rax, [rbp + 0x550]
lea rdx, [0x180104ff8]
mov rcx, rax
call fcn.180062660
mov qword [rbp + 0xe8], rax
lea rax, [rbp + 0x550]
lea rdx, [rbp + 0x1b8]
mov rcx, rax
call fcn.1800625e0
mov qword [rbp + 0xf0], rax
lea rax, [rbp + 0x550]
lea rdx, [0x180105020]
mov rcx, rax
call fcn.1800625e0
mov qword [rbp + 0xf8], rax
lea rax, [rbp + 0x550]
mov rdx, qword [rbp + 0x678]
mov rcx, rax
call fcn.1800625e0
mov qword [rbp + 0x100], rax
lea rax, [0x180105043]
mov rdx, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
call rdx
mov qword [rbp + 0x108], rax
mov rax, qword [rbp + 0x108]
lea rdx, [0x18010504d]
mov rcx, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x150], rcx
mov rcx, rax
mov rax, qword [rbp + 0x150]
call rax
mov qword [rbp + 0x110], rax
mov rax, qword [rbp + 0x110]
mov qword [rbp + 0x118], rax
mov rax, qword [rbp + 0x118]
test rax, rax
jne 0x18005d23c
mov eax, 0
mov dword [rbp + 0xb8], eax
lea rax, reloc.WS2_32.dll_htons
mov rdx, rax
mov rcx, rbp
call fcn.180061140
mov rax, qword [rbp + 0x658]
xor rax, rbp
mov rcx, rax
call fcn.1800612f0
mov eax, dword [rbp + 0xb8]
mov rbx, qword [rbp + 0x1a0]
mov rsi, qword [rbp + 0x1a8]
lea rsp, [rbp + 0x660]
pop rbp
ret
lea rax, [0x18010505a]
mov rdx, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
call rdx
mov qword [rbp + 0x120], rax
mov rax, qword [rbp + 0x120]
lea rdx, [0x180105064]
mov rcx, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x158], rcx
mov rcx, rax
mov rax, qword [rbp + 0x158]
call rax
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x128]
mov qword [rbp + 0x130], rax
mov rax, qword [rbp + 0x118]
test rax, rax
jne 0x18005d2eb
mov eax, 0
mov dword [rbp + 0xbc], eax
lea rax, reloc.WS2_32.dll_htons
mov rdx, rax
mov rcx, rbp
call fcn.180061140
mov rax, qword [rbp + 0x658]
xor rax, rbp
mov rcx, rax
call fcn.1800612f0
mov eax, dword [rbp + 0xbc]
mov rbx, qword [rbp + 0x1a0]
mov rsi, qword [rbp + 0x1a8]
lea rsp, [rbp + 0x660]
pop rbp
ret
call fcn.180010939
mov dword [rbp + 0x68], eax
mov eax, dword [rbp + 0x68]
and eax, 0xffff0000
cmp eax, 0x6000000
jb 0x18005d3a3
call fcn.180014b8f
mov dword [rbp + 0x6c], eax
mov eax, dword [rbp + 0x6c]
test eax, eax
je 0x18005d3a3
mov rax, qword [rbp + 0x670]
mov rcx, rax
call fcn.18005c4b0
mov dword [rbp + 0x78], eax
mov eax, dword [rbp + 0x78]
test eax, eax
jne 0x18005d3a3
call fcn.180014ec4
mov dword [rbp + 0x80], eax
mov eax, dword [rbp + 0x80]
test eax, eax
jne 0x18005d3a3
mov eax, 0x4fb
mov rdx, qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, eax
call rdx
mov eax, 0
mov dword [rbp + 0xc0], eax
lea rax, reloc.WS2_32.dll_htons
mov rdx, rax
mov rcx, rbp
call fcn.180061140
mov rax, qword [rbp + 0x658]
xor rax, rbp
mov rcx, rax
call fcn.1800612f0
mov eax, dword [rbp + 0xc0]
mov rbx, qword [rbp + 0x1a0]
mov rsi, qword [rbp + 0x1a8]
lea rsp, [rbp + 0x660]
pop rbp
ret
mov rax, 0xffffffff80000002
lea rdx, [rbp + 0x1b8]
mov ecx, 0
mov ebx, 0xf003f
lea rsi, [rbp + 0x38]
mov qword [rsp + 0x20], rsi
mov rsi, qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rbp + 0x160], ecx
mov rcx, rax
mov eax, dword [rbp + 0x160]
mov r8d, eax
mov r9d, ebx
call rsi
mov dword [rbp + 0x70], eax
mov byte [rbp + 0x58], 1
mov eax, dword [rbp + 0x70]
mov dword [rbp + 0x74], eax
movzx eax, byte [rbp + 0x58]
test eax, eax
jne 0x18005d406
lea rax, [0x180105038]
mov rcx, rax
call fcn.180064a90
mov eax, dword [rbp + 0x74]
test eax, eax
je 0x18005d437
movzx eax, byte [rbp + 0x58]
test eax, eax
jne 0x18005d424
lea rax, [0x180105038]
mov rcx, rax
call fcn.180064a90
mov eax, dword [rbp + 0x74]
mov rdx, qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, eax
call rdx
jmp 0x18005d944
mov rax, qword [rbp + 0x38]
mov rdx, qword [rbp + 0x678]
mov ecx, 0
mov ebx, 0
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0xf003f
mov qword [rsp + 0x30], 0
lea rsi, [rbp + 0x48]
mov qword [rsp + 0x38], rsi
lea rsi, [rbp + 0x14]
mov qword [rsp + 0x40], rsi
mov rsi, qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [rbp + 0x168], ecx
mov rcx, rax
mov eax, dword [rbp + 0x168]
mov r8d, eax
mov r9, rbx
call rsi
mov dword [rbp + 0x7c], eax
mov byte [rbp + 0x58], 1
mov eax, dword [rbp + 0x7c]
mov dword [rbp + 0x74], eax
movzx eax, byte [rbp + 0x58]
test eax, eax
jne 0x18005d4b9
lea rax, [0x180105038]
mov rcx, rax
call fcn.180064a90
mov eax, dword [rbp + 0x74]
test eax, eax
je 0x18005d4ea
movzx eax, byte [rbp + 0x58]
test eax, eax
jne 0x18005d4d7
lea rax, [0x180105038]
mov rcx, rax
call fcn.180064a90
mov eax, dword [rbp + 0x74]
mov rdx, qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, eax
call rdx
jmp 0x18005d944
mov byte [rbp + 0x59], 1
mov dword [rbp + 8], 1
mov byte [rbp + 0x59], 1
mov rax, qword [rbp + 0x48]
lea rdx, [0x180105073]
mov ecx, 0
mov ebx, 4
lea rsi, [rbp + 8]
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x28], 4
mov rsi, qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [rbp + 0x170], ecx
mov rcx, rax
mov eax, dword [rbp + 0x170]
mov r8d, eax
mov r9d, ebx
call rsi
mov dword [rbp + 0x88], eax
mov byte [rbp + 0x58], 1
mov eax, dword [rbp + 0x88]
mov dword [rbp + 0x74], eax
movzx eax, byte [rbp + 0x58]
test eax, eax
jne 0x18005d567
lea rax, [0x180105038]
mov rcx, rax
call fcn.180064a90
mov eax, dword [rbp + 0x74]
test eax, eax
je 0x18005d598
movzx eax, byte [rbp + 0x58]
test eax, eax
jne 0x18005d585
lea rax, [0x180105038]
mov rcx, rax
call fcn.180064a90
mov eax, dword [rbp + 0x74]
mov rdx, qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, eax
call rdx
jmp 0x18005d944
mov byte [rbp + 0x59], 1
mov dword [rbp + 8], 0
mov byte [rbp + 0x59], 1
mov rax, qword [rbp + 0x48]
lea rdx, [0x180105078]
mov ecx, 0
mov ebx, 4
lea rsi, [rbp + 8]
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x28], 4
mov rsi, qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [rbp + 0x178], ecx
mov rcx, rax
mov eax, dword [rbp + 0x178]
mov r8d, eax
mov r9d, ebx
call rsi
mov dword [rbp + 0x98], eax
mov byte [rbp + 0x58], 1
mov eax, dword [rbp + 0x98]
mov dword [rbp + 0x74], eax
movzx eax, byte [rbp + 0x58]
test eax, eax
jne 0x18005d615
lea rax, [0x180105038]
mov rcx, rax
call fcn.180064a90
mov eax, dword [rbp + 0x74]
test eax, eax
je 0x18005d646
movzx eax, byte [rbp + 0x58]
test eax, eax
jne 0x18005d633
lea rax, [0x180105038]
mov rcx, rax
call fcn.180064a90
mov eax, dword [rbp + 0x74]
mov rdx, qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, eax
call rdx
jmp 0x18005d944
mov byte [rbp + 0x59], 1
mov dword [rbp + 8], 3
mov byte [rbp + 0x59], 1
mov rax, qword [rbp + 0x48]
lea rdx, [0x180105085]
mov ecx, 0
mov ebx, 4
lea rsi, [rbp + 8]
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x28], 4
mov rsi, qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [rbp + 0x180], ecx
mov rcx, rax
mov eax, dword [rbp + 0x180]
mov r8d, eax
mov r9d, ebx
call rsi
mov dword [rbp + 0x9c], eax
mov byte [rbp + 0x58], 1
mov eax, dword [rbp + 0x9c]
mov dword [rbp + 0x74], eax
movzx eax, byte [rbp + 0x58]
test eax, eax
jne 0x18005d6c3
lea rax, [0x180105038]
mov rcx, rax
call fcn.180064a90
mov eax, dword [rbp + 0x74]
test eax, eax
je 0x18005d6f4
movzx eax, byte [rbp + 0x58]
test eax, eax
jne 0x18005d6e1
lea rax, [0x180105038]
mov rcx, rax
call fcn.180064a90
mov eax, dword [rbp + 0x74]
mov rdx, qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, eax
call rdx
jmp 0x18005d944
mov rax, qword [rbp + 0x48]
lea rdx, [0x18010508b]
mov rcx, qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov qword [rbp + 0x188], rcx
mov rcx, rax
mov rax, qword [rbp + 0x188]
call rax
mov dword [rbp + 0xa0], eax
lea rax, [rbp + 0x240]
mov rcx, rax
call fcn.1800622d0
mov qword [rbp + 0x138], rax
mov rax, qword [rbp + 0x48]
lea rdx, [0x180105024]
mov ecx, 0
mov ebx, 2
lea rsi, [rbp + 0x240]
mov qword [rsp + 0x20], rsi
mov esi, 1
add rsi, qword [rbp + 0x138]
imul rsi, rsi, 2
mov dword [rsp + 0x28], esi
mov rsi, qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rbp + 0x190], ecx
mov rcx, rax
mov eax, dword [rbp + 0x190]
mov r8d, eax
mov r9d, ebx
call rsi
mov dword [rbp + 0xa4], eax
mov byte [rbp + 0x58], 1
mov eax, dword [rbp + 0xa4]
mov dword [rbp + 0x74], eax
movzx eax, byte [rbp + 0x58]
test eax, eax
jne 0x18005d7b2
lea rax, [0x180105038]
mov rcx, rax
call fcn.180064a90
mov eax, dword [rbp + 0x74]
test eax, eax
je 0x18005d7e3
movzx eax, byte [rbp + 0x58]
test eax, eax
jne 0x18005d7d0
lea rax, [0x180105038]
mov rcx, rax
call fcn.180064a90
mov eax, dword [rbp + 0x74]
mov rdx, qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, eax
call rdx
jmp 0x18005d944
lea rax, [0x180105096]
mov edx, 1
mov rcx, rax
call fcn.180012ea6
mov byte [rbp + 0x5b], al
lea rax, [rbp + 0x550]
mov qword [rbp + 0x28], rax
lea rax, [rbp + 0x550]
mov rcx, rax
call fcn.1800622d0
mov qword [rbp + 0x140], rax
mov rax, qword [rbp + 0x140]
imul rax, rax, 2
mov word [rbp + 0x5c], ax
movzx eax, word [rbp + 0x5c]
mov word [rbp + 0x22], ax
movzx eax, word [rbp + 0x5c]
mov word [rbp + 0x20], ax
mov rax, qword [rbp + 0x130]
lea rdx, [rbp + 0x20]
mov rcx, rdx
call rax
mov dword [rbp + 0xa8], eax
mov byte [rbp + 0x5a], 1
mov eax, dword [rbp + 0xa8]
mov dword [rbp + 0xac], eax
movzx eax, byte [rbp + 0x5a]
test eax, eax
jne 0x18005d877
lea rax, [0x18010503c]
mov rcx, rax
call fcn.180064a90
mov eax, dword [rbp + 0xac]
test eax, eax
jl 0x18005d891
mov eax, reloc.OLEAUT32.dll_SetErrorInfo
mov rdx, qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, eax
call rdx
mov rax, qword [rbp + 0x118]
lea rdx, [rbp + 0x20]
mov rcx, rdx
call rax
mov dword [rbp + 0xb0], eax
mov byte [rbp + 0x5a], 1
mov eax, dword [rbp + 0xb0]
mov dword [rbp + 0xac], eax
movzx eax, byte [rbp + 0x5a]
test eax, eax
jne 0x18005d8ce
lea rax, [0x18010503c]
mov rcx, rax
call fcn.180064a90
mov eax, dword [rbp + 0xac]
test eax, eax
jge 0x18005d93d
movzx eax, byte [rbp + 0x5a]
test eax, eax
jne 0x18005d8ef
lea rax, [0x18010503c]
mov rcx, rax
call fcn.180064a90
mov eax, dword [rbp + 0xac]
cmp eax, 0xc000010e
je 0x18005d93d
movzx eax, byte [rbp + 0x5a]
test eax, eax
jne 0x18005d913
lea rax, [0x18010503c]
mov rcx, rax
call fcn.180064a90
mov eax, dword [rbp + 0xac]
mov rdx, qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov ecx, eax
call rdx
mov dword [rbp + 0xb4], eax
mov eax, dword [rbp + 0xb4]
mov rdx, qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, eax
call rdx
jmp 0x18005d944
mov dword [rbp + 0x60], 1
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov dword [rbp + 0x84], eax
mov byte [rbp + 0x58], 1
mov eax, dword [rbp + 0x84]
mov dword [rbp + 0x74], eax
mov rax, qword [rbp + 0x48]
test rax, rax
je 0x18005d9aa
mov rax, qword [rbp + 0x48]
mov rdx, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rax
call rdx
mov dword [rbp + 0x8c], eax
mov rax, qword [rbp + 0x38]
mov rdx, qword [rbp + 0x678]
mov rcx, qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov qword [rbp + 0x198], rcx
mov rcx, rax
mov rax, qword [rbp + 0x198]
call rax
mov dword [rbp + 0x90], eax
mov rax, qword [rbp + 0x38]
test rax, rax
je 0x18005d9c9
mov rax, qword [rbp + 0x38]
mov rdx, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rax
call rdx
mov dword [rbp + 0x94], eax
movzx eax, byte [rbp + 0x58]
test eax, eax
jne 0x18005d9e0
lea rax, [0x180105038]
mov rcx, rax
call fcn.180064a90
mov eax, dword [rbp + 0x74]
mov rdx, qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, eax
call rdx
mov eax, dword [rbp + 0x60]
mov dword [rbp + 0xc4], eax
lea rax, reloc.WS2_32.dll_htons
mov rdx, rax
mov rcx, rbp
call fcn.180061140
mov rax, qword [rbp + 0x658]
xor rax, rbp
mov rcx, rax
call fcn.1800612f0
mov eax, dword [rbp + 0xc4]
mov rbx, qword [rbp + 0x1a0]
mov rsi, qword [rbp + 0x1a8]
lea rsp, [rbp + 0x660]
pop rbp
ret