Function at 0x7ff7c00e2ea0
Capabilities:
Delete registry key
Persist via windows service
Set registry value

Disassembly:
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x220]
sub rsp, 0x320
mov rax, qword [0x7ff7c01ca008]
xor rax, rsp
mov qword [rbp + 0x210], rax
lea rax, [0x7ff7c017a910]
mov qword ds:[rsp + 0x40], 0
mov qword [rbp - 0x48], rax
lea r8, [rbp]
lea rax, [0x7ff7c01798a0]
mov dword [rbp - 0x60], 1
mov qword [rbp - 0x28], rax
lea rcx, [rbp - 0x60]
lea rax, [0x7ff7c0189540]
mov qword [rbp - 0x50], 0x44
mov qword [rbp - 8], rax
mov rdi, rdx
lea rax, [rsp + 0x60]
mov dword [rbp - 0x40], 1
mov r9d, 0x208
mov qword [rsp + 0x20], rax
mov edx, 3
mov qword [rbp - 0x30], 0x1e
mov dword [rbp - 0x20], 1
mov qword [rbp - 0x10], 0x16
call sym.ProcessHacker.exe_PhFormatToBuffer
test al, al
jne 0x7ff7c00e2f53
mov eax, 0xc0000001
jmp 0x7ff7c00e3130
mov rcx, qword ds:[rsp + 0x60]
add rcx, 0xfffffffffffffffe
mov qword [rsp + 0x330], rbx
mov word [rsp + 0x48], cx
lea eax, [rcx + 2]
mov word [rsp + 0x4a], ax
lea rax, [rbp]
mov qword [rsp + 0x50], rax
cmp rcx, 0xfffe
jbe 0x7ff7c00e2f93
mov ebx, 0xc0000106
jmp 0x7ff7c00e3126
xor r8d, r8d
lea rax, [rsp + 0x68]
lea r9, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x48]
lea rcx, [r8 - 3]
call fcn.7ff7c00e0390
mov ebx, eax
test eax, eax
js 0x7ff7c00e3126
lea rax, [rsp + 0x58]
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x70]
mov dword [rsp + 0x28], 0
lea rcx, [rsp + 0x40]
mov edx, 0x30006
mov qword [rsp + 0x20], 0
call qword [sym.imp.ntdll.dll_NtCreateKey]
mov rcx, qword [rsp + 0x68]
mov ebx, eax
test rcx, rcx
je 0x7ff7c00e3006
nop dword [rax]
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
js 0x7ff7c00e3126
lea rbx, [0x7ff7c0189558]
mov rcx, rbx
call sym.ProcessHacker.exe_PhCountStringZ
add rax, rax
mov qword [rsp + 0x50], rbx
mov word [rsp + 0x48], ax
lea ecx, [rax + 2]
mov word [rsp + 0x4a], cx
cmp rax, 0xfffe
jbe 0x7ff7c00e3045
mov ebx, 0xc0000106
jmp 0x7ff7c00e3104
mov rcx, qword [rsp + 0x40]
lea rdx, [rsp + 0x48]
mov dword [rsp + 0x28], 4
mov r9d, 4
xor r8d, r8d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ntdll.dll_NtSetValueKey]
mov ebx, eax
test eax, eax
js 0x7ff7c00e3104
cmp byte [rdi + 4], 0
je 0x7ff7c00e3116
lea rcx, [rsp + 0x78]
mov dword [rsp + 0x70], 3
mov dword [rsp + 0x74], 1
call fcn.7ff7c0114e50
test eax, eax
js 0x7ff7c00e3116
lea rbx, [0x7ff7c0189578]
mov rcx, rbx
call sym.ProcessHacker.exe_PhCountStringZ
add rax, rax
mov qword [rsp + 0x50], rbx
mov word [rsp + 0x48], ax
lea ecx, [rax + 2]
mov word [rsp + 0x4a], cx
cmp rax, 0xfffe
jbe 0x7ff7c00e30d0
mov ebx, 0xc0000106
jmp 0x7ff7c00e3104
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x70]
mov dword [rsp + 0x28], 0x2c
lea rdx, [rsp + 0x48]
mov r9d, 3
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ntdll.dll_NtSetValueKey]
mov ebx, eax
nop dword [rax]
test eax, eax
jns 0x7ff7c00e3116
cmp dword [rsp + 0x58], 1
jne 0x7ff7c00e3116
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntdll.dll_NtDeleteKey]
mov rcx, qword ds:[rsp + 0x40]
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, ebx
mov rbx, qword [rsp + 0x330]
mov rcx, qword [rbp + 0x210]
xor rcx, rsp
call fcn.7ff7c0121390
mov rdi, qword [rsp + 0x340]
add rsp, 0x320
pop rbp
ret