Function at 0x14000e900
Capabilities:
Delete registry key
Delete registry value
Persist via windows service
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push r12
push r13
sub rsp, 0x30
movzx esi, dl
mov rbp, rcx
mov edx, 0x20006
add rcx, 2
call fcn.14000e630
mov rbx, rax
test rax, rax
jne 0x14000e937
lea eax, [rbx + 1]
jmp 0x14000f1bf
lea r8, [rbp + 0x1842a]
lea rdx, [0x140023680]
mov rcx, rax
call fcn.14000df70
test eax, eax
je 0x14000e978
lea rdx, str.SYSTEMCurrentControlSetServices_sParameters
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 2
jmp 0x14000f1bf
lea r8, [rbp + 0x28428]
lea rdx, str.AppParameters
mov rcx, rbx
call fcn.14000df70
test eax, eax
je 0x14000e9b9
lea rdx, str.SYSTEMCurrentControlSetServices_sParameters
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 3
jmp 0x14000f1bf
lea r8, [rbp + 0x30426]
lea rdx, str.AppDirectory
mov rcx, rbx
call fcn.14000df70
test eax, eax
je 0x14000e9fa
lea rdx, str.SYSTEMCurrentControlSetServices_sParameters
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 4
jmp 0x14000f1bf
mov r8d, dword [rbp + 0x4043c]
cmp r8d, 0x20
je 0x14000ea18
lea rdx, str.AppPriority
mov rcx, rbx
call fcn.14000df80
jmp 0x14000ea2d
test sil, sil
je 0x14000ea2d
lea rdx, str.AppPriority
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rbp + 0x40418]
mov qword [rsp + 0x58], rdi
mov r13d, 1
test rcx, rcx
je 0x14000eafe
lea rdx, [rsp + 0x50]
call fcn.14000fa70
test eax, eax
jne 0x14000eade
mov rdx, qword [rsp + 0x50]
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rdx
mov r9d, r13d
xor r8d, r8d
repne scasw ax, word [rdi]
not rcx
lea eax, [rcx + rcx]
mov rcx, rbx
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
lea rdx, str.AppAffinity
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14000eade
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140006fa0
lea r8, str.AppAffinity
xor edi, edi
mov edx, 0xc00003fb
movzx ecx, r13w
mov r9, rax
mov qword [rsp + 0x20], rdi
call fcn.140007160
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rsp + 0x50]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea eax, [rdi + 5]
jmp 0x14000f1ba
cmp qword [rsp + 0x50], 0
je 0x14000eb13
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rsp + 0x50]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x14000eb13
test sil, sil
je 0x14000eb13
lea rdx, str.AppAffinity
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov r8d, dword [rbp + 0x704b8]
not r8d
test r8d, r8d
je 0x14000eb33
lea rdx, str.AppStopMethodSkip
mov rcx, rbx
call fcn.14000df80
jmp 0x14000eb48
test sil, sil
je 0x14000eb48
lea rdx, str.AppStopMethodSkip
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [rbp + 0x704ac]
cmp eax, 4
jae 0x14000eb6e
mov rdx, rax
lea rax, section..data
lea rcx, [rbp + 2]
mov rdx, qword [rax + rdx*8]
movzx r8d, sil
call fcn.14000d960
mov r8d, dword [rbp + 0x704b0]
test r8d, r8d
je 0x14000eb8b
lea rdx, str.AppRestartDelay
mov rcx, rbx
call fcn.14000df80
jmp 0x14000eba0
test sil, sil
je 0x14000eba0
lea rdx, str.AppRestartDelay
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov r8d, dword [rbp + 0x704b4]
cmp r8d, 0x5dc
je 0x14000ebc1
lea rdx, str.AppThrottle
mov rcx, rbx
call fcn.14000df80
jmp 0x14000ebd6
test sil, sil
je 0x14000ebd6
lea rdx, str.AppThrottle
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov r8d, dword [rbp + 0x704bc]
cmp r8d, 0x5dc
je 0x14000ebf7
lea rdx, str.AppStopMethodConsole
mov rcx, rbx
call fcn.14000df80
jmp 0x14000ec0c
test sil, sil
je 0x14000ec0c
lea rdx, str.AppStopMethodConsole
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov r8d, dword [rbp + 0x704c0]
cmp r8d, 0x5dc
je 0x14000ec2d
lea rdx, str.AppStopMethodWindow
mov rcx, rbx
call fcn.14000df80
jmp 0x14000ec42
test sil, sil
je 0x14000ec42
lea rdx, str.AppStopMethodWindow
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov r8d, dword [rbp + 0x704c4]
cmp r8d, 0x5dc
je 0x14000ec63
lea rdx, str.AppStopMethodThreads
mov rcx, rbx
call fcn.14000df80
jmp 0x14000ec78
test sil, sil
je 0x14000ec78
lea rdx, str.AppStopMethodThreads
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea r8, [rbp + 0x40444]
movzx eax, word [r8]
test ax, ax
jne 0x14000ec91
test sil, sil
je 0x14000ed7f
test ax, ax
je 0x14000eca7
lea rdx, str.AppStdin
mov rcx, rbx
call fcn.14000df70
jmp 0x14000ecbc
test sil, sil
je 0x14000ecbc
lea rdx, str.AppStdin
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov r9d, dword [rbp + 0x50444]
cmp r9d, 2
je 0x14000ece1
lea r8, str.ShareMode
lea rdx, str.AppStdin
mov rcx, rbx
call fcn.14000aed0
jmp 0x14000ecfc
test sil, sil
je 0x14000ecfc
lea r8, str.ShareMode
lea rdx, str.AppStdin
mov rcx, rbx
call fcn.14000af70
mov r9d, dword [rbp + 0x50448]
cmp r9d, 3
je 0x14000ed21
lea r8, str.CreationDisposition
lea rdx, str.AppStdin
mov rcx, rbx
call fcn.14000aed0
jmp 0x14000ed3c
test sil, sil
je 0x14000ed3c
lea r8, str.CreationDisposition
lea rdx, str.AppStdin
mov rcx, rbx
call fcn.14000af70
mov r9d, dword [rbp + 0x5044c]
cmp r9d, 0x80
je 0x14000ed64
lea r8, str.FlagsAndAttributes
lea rdx, str.AppStdin
mov rcx, rbx
call fcn.14000aed0
jmp 0x14000ed7f
test sil, sil
je 0x14000ed7f
lea r8, str.FlagsAndAttributes
lea rdx, str.AppStdin
mov rcx, rbx
call fcn.14000af70
lea r8, [rbp + 0x50450]
movzx eax, word [r8]
test ax, ax
jne 0x14000ed98
test sil, sil
je 0x14000ee86
test ax, ax
je 0x14000edae
lea rdx, str.AppStdout
mov rcx, rbx
call fcn.14000df70
jmp 0x14000edc3
test sil, sil
je 0x14000edc3
lea rdx, str.AppStdout
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov r9d, dword [rbp + 0x60450]
cmp r9d, 3
je 0x14000ede8
lea r8, str.ShareMode
lea rdx, str.AppStdout
mov rcx, rbx
call fcn.14000aed0
jmp 0x14000ee03
test sil, sil
je 0x14000ee03
lea r8, str.ShareMode
lea rdx, str.AppStdout
mov rcx, rbx
call fcn.14000af70
mov r9d, dword [rbp + 0x60454]
cmp r9d, 4
je 0x14000ee28
lea r8, str.CreationDisposition
lea rdx, str.AppStdout
mov rcx, rbx
call fcn.14000aed0
jmp 0x14000ee43
test sil, sil
je 0x14000ee43
lea r8, str.CreationDisposition
lea rdx, str.AppStdout
mov rcx, rbx
call fcn.14000af70
mov r9d, dword [rbp + 0x60458]
cmp r9d, 0x80
je 0x14000ee6b
lea r8, str.FlagsAndAttributes
lea rdx, str.AppStdout
mov rcx, rbx
call fcn.14000aed0
jmp 0x14000ee86
test sil, sil
je 0x14000ee86
lea r8, str.FlagsAndAttributes
lea rdx, str.AppStdout
mov rcx, rbx
call fcn.14000af70
lea r8, [rbp + 0x60474]
movzx eax, word [r8]
test ax, ax
jne 0x14000ee9f
test sil, sil
je 0x14000ef8d
test ax, ax
je 0x14000eeb5
lea rdx, str.AppStderr
mov rcx, rbx
call fcn.14000df70
jmp 0x14000eeca
test sil, sil
je 0x14000eeca
lea rdx, str.AppStderr
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov r9d, dword [rbp + 0x70474]
cmp r9d, 3
je 0x14000eeef
lea r8, str.ShareMode
lea rdx, str.AppStderr
mov rcx, rbx
call fcn.14000aed0
jmp 0x14000ef0a
test sil, sil
je 0x14000ef0a
lea r8, str.ShareMode
lea rdx, str.AppStderr
mov rcx, rbx
call fcn.14000af70
mov r9d, dword [rbp + 0x70478]
cmp r9d, 4
je 0x14000ef2f
lea r8, str.CreationDisposition
lea rdx, str.AppStderr
mov rcx, rbx
call fcn.14000aed0
jmp 0x14000ef4a
test sil, sil
je 0x14000ef4a
lea r8, str.CreationDisposition
lea rdx, str.AppStderr
mov rcx, rbx
call fcn.14000af70
mov r9d, dword [rbp + 0x7047c]
cmp r9d, 0x80
je 0x14000ef72
lea r8, str.FlagsAndAttributes
lea rdx, str.AppStderr
mov rcx, rbx
call fcn.14000aed0
jmp 0x14000ef8d
test sil, sil
je 0x14000ef8d
lea r8, str.FlagsAndAttributes
lea rdx, str.AppStderr
mov rcx, rbx
call fcn.14000af70
cmp byte [rbp + 0x70494], 0
je 0x14000efaa
lea rdx, str.AppRotateFiles
mov r8d, r13d
mov rcx, rbx
call fcn.14000df80
jmp 0x14000efbf
test sil, sil
je 0x14000efbf
lea rdx, str.AppRotateFiles
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp dword [rbp + 0x70498], 0
je 0x14000efdc
lea rdx, str.AppRotateOnline
mov r8d, r13d
mov rcx, rbx
call fcn.14000df80
jmp 0x14000eff1
test sil, sil
je 0x14000eff1
lea rdx, str.AppRotateOnline
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov r8d, dword [rbp + 0x704a0]
test r8d, r8d
je 0x14000f00e
lea rdx, str.AppRotateSeconds
mov rcx, rbx
call fcn.14000df80
jmp 0x14000f023
test sil, sil
je 0x14000f023
lea rdx, str.AppRotateSeconds
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov r8d, dword [rbp + 0x704a4]
test r8d, r8d
je 0x14000f040
lea rdx, str.AppRotateBytes
mov rcx, rbx
call fcn.14000df80
jmp 0x14000f055
test sil, sil
je 0x14000f055
lea rdx, str.AppRotateBytes
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov r8d, dword [rbp + 0x704a8]
test r8d, r8d
je 0x14000f072
lea rdx, str.AppRotateBytesHigh
mov rcx, rbx
call fcn.14000df80
jmp 0x14000f087
test sil, sil
je 0x14000f087
lea rdx, str.AppRotateBytesHigh
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp dword [rbp + 0x40440], 0
je 0x14000f0a4
lea rdx, str.AppNoConsole
mov r8d, r13d
mov rcx, rbx
call fcn.14000df80
jmp 0x14000f0b9
test sil, sil
je 0x14000f0b9
lea rdx, str.AppNoConsole
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rbp + 0x40410]
xor edi, edi
test rcx, rcx
je 0x14000f11f
mov eax, dword [rbp + 0x4042c]
lea r9d, [rdi + 7]
lea rdx, str.AppEnvironment
add eax, eax
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14000f134
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140006fa0
lea r8, str.AppEnvironment
mov edx, 0xc00003fb
movzx ecx, r13w
mov r9, rax
mov qword [rsp + 0x20], rdi
call fcn.140007160
jmp 0x14000f134
test sil, sil
je 0x14000f134
lea rdx, str.AppEnvironment
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rbp + 0x40430]
test rcx, rcx
je 0x14000f19a
mov eax, dword [rbp + 0x40438]
lea rdx, str.AppEnvironmentExtra
mov r9d, 7
add eax, eax
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14000f1af
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140006fa0
lea r8, str.AppEnvironmentExtra
mov edx, 0xc00003fb
movzx ecx, r13w
mov r9, rax
mov qword [rsp + 0x20], rdi
call fcn.140007160
jmp 0x14000f1af
test sil, sil
je 0x14000f1af
lea rdx, str.AppEnvironmentExtra
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r13
pop r12
pop rsi
ret