Function at 0x14003ae30
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x590]
sub rsp, 0x690
mov rax, qword [0x14009e018]
xor rax, rsp
mov qword [rbp + 0x580], rax
mov ebx, 0x104
lea r10, str.SYSTEMCurrentControlSetServices_
lea rax, [rbp + 0x160]
mov r9d, ebx
sub r10, rax
lea r8, [rbp + 0x160]
mov rdi, rdx
mov rsi, rcx
lea rax, [r9 + 0x7ffffefa]
test rax, rax
je 0x14003aea8
movzx eax, word [r10 + r8]
test ax, ax
je 0x14003aea8
mov word [r8], ax
add r8, 2
sub r9, 1
jne 0x14003ae84
test r9, r9
lea rax, [r8 - 2]
mov rcx, rbx
cmovne rax, r8
xor r14d, r14d
mov word [rax], r14w
lea rax, [rbp + 0x160]
cmp word [rax], r14w
je 0x14003aed4
add rax, 2
sub rcx, 1
jne 0x14003aec4
test rcx, rcx
mov edx, 0x80070057
cmovne edx, r14d
je 0x14003aeea
mov rax, rbx
sub rax, rcx
jmp 0x14003aeed
mov rax, r14
test edx, edx
js 0x14003af43
mov rdx, rbx
lea rcx, [rbp + 0x160]
lea rcx, [rcx + rax*2]
sub rdx, rax
je 0x14003af34
add rax, 0x7ffffefb
mov r9, rdi
add rax, rdx
sub r9, rcx
test rax, rax
je 0x14003af34
movzx r8d, word [r9 + rcx]
test r8w, r8w
je 0x14003af34
mov word [rcx], r8w
dec rax
add rcx, 2
sub rdx, 1
jne 0x14003af13
test rdx, rdx
lea rax, [rcx - 2]
cmovne rax, rcx
mov word [rax], r14w
lea r8, [rsp + 0x40]
mov rcx, 0xffffffff80000002
lea rdx, [rbp + 0x160]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x14003b234
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x40]
lea rdx, str.DisplayName
add eax, eax
mov r9d, 1
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea r8, [0x1400873a8]
mov rdx, rbx
lea rax, [rsp + 0x50]
sub r8, rax
lea rcx, [rsp + 0x50]
nop word [rax + rax]
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x14003afd3
movzx eax, word [r8 + rcx]
test ax, ax
je 0x14003afd3
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14003afb0
lea rax, [rcx - 2]
test rdx, rdx
mov r8, rsi
cmovne rax, rcx
lea rcx, [rsp + 0x50]
mov word [rax], r14w
call fcn.14002a4e0
lea rdx, [0x140077d78]
lea rax, [rbp + 0x370]
sub rdx, rax
lea rcx, [rbp + 0x370]
nop word [rax + rax]
lea rax, [rbx + 0x7ffffefa]
test rax, rax
je 0x14003b032
movzx eax, word [rdx + rcx]
test ax, ax
je 0x14003b032
mov word [rcx], ax
add rcx, 2
sub rbx, 1
jne 0x14003b010
lea rax, [rcx - 2]
mov dword [rsp + 0x38], 0x208
test rbx, rbx
lea rdx, str.ImagePath
cmovne rax, rcx
mov rcx, qword [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov word [rax], r14w
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x370]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x370]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x14003b0c3
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x40]
lea rdx, str.ImagePath
add eax, eax
mov r9d, 2
mov dword [rsp + 0x28], eax
xor r8d, r8d
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rdx, str.ErrorControl
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 0xffffffff
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x34], 1
mov dword [rsp + 0x38], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [rsp + 0x34]
cmp dword [rsp + 0x30], eax
je 0x14003b13e
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x34]
mov dword [rsp + 0x28], 4
lea rdx, str.ErrorControl
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rdx, str.Start
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 0xffffffff
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x34], 3
mov dword [rsp + 0x38], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [rsp + 0x34]
cmp dword [rsp + 0x30], eax
je 0x14003b1b9
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x34]
mov dword [rsp + 0x28], 4
lea rdx, str.Start
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rdx, str.Type
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 0xffffffff
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x34], 1
mov dword [rsp + 0x38], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [rsp + 0x34]
cmp dword [rsp + 0x30], eax
je 0x14003b234
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x34]
mov dword [rsp + 0x28], 4
lea rdx, str.Type
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x580]
xor rcx, rsp
call fcn.140051aa0
lea r11, [rsp + 0x690]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret