Function at 0x140029cc0
Capabilities:
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov r11, rsp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0xf0
mov qword [rsp + 0xb0], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
mov rax, qword [0x140087990]
xor rax, rsp
mov qword [rsp + 0xe8], rax
mov rbx, rdx
mov qword [r11 - 0x38], rdx
mov rsi, 0xffffffff80000002
mov dword [rsp + 0x58], 0x3e8
mov dword [rsp + 0x5c], 1
lea rbp, str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorerRun
call fcn.14000baa0
test al, al
jne 0x140029d34
lea rbp, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov rsi, 0xffffffff80000001
xor r13d, r13d
mov qword [rsp + 0x40], r13
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x140029de2
lea rbp, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov rsi, 0xffffffff80000001
mov qword [rsp + 0x40], r13
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x140029de2
cmp qword [rbx + 0x20], 8
jb 0x140029dc7
mov rcx, qword [rbx + 8]
call fcn.140044814
mov qword [rbx + 0x20], 7
mov qword [rbx + 0x18], r13
mov word [rbx + 8], r13w
mov eax, 2
jmp 0x14002a254
mov qword [rsp + 0xd8], 7
mov qword [rsp + 0xd0], r13
mov word [rsp + 0xc0], r13w
mov r8, rbx
lea rdx, [0x140074a8c]
lea rcx, [rsp + 0x88]
call fcn.14003e020
nop
lea r8, str.___minimized
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.14003dc60
nop
or r14, 0xffffffffffffffff
mov r9, r14
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0xb8]
call fcn.140039eb0
nop
cmp qword [rsp + 0x80], 8
jb 0x140029e5c
mov rcx, qword [rsp + 0x68]
call fcn.140044814
mov qword [rsp + 0x80], 7
mov qword [rsp + 0x78], r13
mov word [rsp + 0x68], r13w
cmp qword [rsp + 0xa8], 8
jb 0x140029e8b
mov rcx, qword [rsp + 0x90]
call fcn.140044814
lea r12, [rsp + 0xc0]
cmp qword [rsp + 0xd8], 8
cmovae r12, qword [rsp + 0xc0]
xor eax, eax
mov rcx, r14
mov rdi, r12
repne scasw ax, word [rdi]
not rcx
dec rcx
add ecx, ecx
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], r12
lea r9d, [rax + 1]
xor r8d, r8d
lea rdx, [0x140074ea0]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14002a1f9
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x14002a19c
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002a13c
mov eax, 2
mul qword [rsp + 0xd0]
cmovo rax, r14
mov rcx, rax
call fcn.1400432bc
mov rsi, rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x5c]
xor r8d, r8d
lea rdx, [0x140074ea0]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14002a0f5
mov qword [rsp + 0x80], 7
mov qword [rsp + 0x78], r13
mov word [rsp + 0x68], r13w
xor eax, eax
mov rcx, r14
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, rsi
lea rcx, [rsp + 0x60]
call fcn.14003b810
nop
mov qword [rsp + 0xa8], 7
mov qword [rsp + 0xa0], r13
mov word [rsp + 0x90], r13w
xor eax, eax
mov rcx, r14
mov rdi, r12
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, r12
lea rcx, [rsp + 0x88]
call fcn.14003b810
nop
lea r9, [rsp + 0x68]
cmp qword [rsp + 0x80], 8
cmovae r9, qword [rsp + 0x68]
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r8, qword [rsp + 0xa0]
xor edx, edx
lea rcx, [rsp + 0x88]
call fcn.14003e890
test eax, eax
setne dil
cmp qword [rsp + 0xa8], 8
jb 0x14002a033
mov rcx, qword [rsp + 0x90]
call fcn.140044814
mov qword [rsp + 0xa8], 7
mov qword [rsp + 0xa0], r13
mov word [rsp + 0x90], r13w
cmp qword [rsp + 0x80], 8
jb 0x14002a065
mov rcx, qword [rsp + 0x68]
call fcn.140044814
test dil, dil
je 0x14002a0b1
cmp qword [rsp + 0xd8], 8
jb 0x14002a082
mov rcx, qword [rsp + 0xc0]
call fcn.140044814
mov qword [rsp + 0xd8], 7
mov qword [rsp + 0xd0], r13
mov word [rsp + 0xc0], r13w
mov rcx, rbx
call fcn.140039010
mov eax, 2
jmp 0x14002a254
cmp qword [rsp + 0xd8], 8
jb 0x14002a0c9
mov rcx, qword [rsp + 0xc0]
call fcn.140044814
mov qword [rsp + 0xd8], 7
mov qword [rsp + 0xd0], r13
mov word [rsp + 0xc0], r13w
mov rcx, rbx
call fcn.140039010
xor eax, eax
jmp 0x14002a254
cmp qword [rsp + 0xd8], 8
jb 0x14002a10d
mov rcx, qword [rsp + 0xc0]
call fcn.140044814
mov qword [rsp + 0xd8], 7
mov qword [rsp + 0xd0], r13
mov word [rsp + 0xc0], r13w
mov rcx, rbx
call fcn.140039010
mov eax, 2
jmp 0x14002a254
cmp qword [rsp + 0xd8], 8
jb 0x14002a154
mov rcx, qword [rsp + 0xc0]
call fcn.140044814
mov qword [rsp + 0xd8], 7
mov qword [rsp + 0xd0], r13
mov word [rsp + 0xc0], r13w
cmp qword [rbx + 0x20], 8
jb 0x14002a181
mov rcx, qword [rbx + 8]
call fcn.140044814
mov qword [rbx + 0x20], 7
mov qword [rbx + 0x18], r13
mov word [rbx + 8], r13w
mov eax, 2
jmp 0x14002a254
cmp qword [rsp + 0xd8], 8
jb 0x14002a1b4
mov rcx, qword [rsp + 0xc0]
call fcn.140044814
mov qword [rsp + 0xd8], 7
mov qword [rsp + 0xd0], r13
mov word [rsp + 0xc0], r13w
cmp qword [rbx + 0x20], 8
jb 0x14002a1e1
mov rcx, qword [rbx + 8]
call fcn.140044814
mov qword [rbx + 0x20], 7
mov qword [rbx + 0x18], r13
mov word [rbx + 8], r13w
mov eax, 2
jmp 0x14002a254
cmp qword [rsp + 0xd8], 8
jb 0x14002a211
mov rcx, qword [rsp + 0xc0]
call fcn.140044814
mov qword [rsp + 0xd8], 7
mov qword [rsp + 0xd0], r13
mov word [rsp + 0xc0], r13w
cmp qword [rbx + 0x20], 8
jb 0x14002a23e
mov rcx, qword [rbx + 8]
call fcn.140044814
mov qword [rbx + 0x20], 7
mov qword [rbx + 0x18], r13
mov word [rbx + 8], r13w
mov eax, 2
mov rcx, qword [rsp + 0xe8]
xor rcx, rsp
call fcn.140044830
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret