Function at 0x10005e83c
Capabilities:
Delete registry key
Persist via windows service
Set registry value

Disassembly:
mov dword [rsp + 0x20], r9d
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa8
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov rbx, r8
mov r12, rdx
mov r13, rcx
mov esi, 1
mov ebp, esi
xor edi, edi
mov r15, qword [rsp + 0x118]
mov dword [r15], edi
mov qword [rsp + 0x58], rdi
mov r14d, edi
lea rcx, [rsp + 0x60]
call fcn.10001fee0
nop
lea rcx, [rsp + 0x50]
call fcn.10001fee0
nop
lea rdx, [0x100012840]
lea rcx, [rsp + 0x118]
call fcn.10001ff98
nop
lea r8, [rsp + 0x60]
mov rdx, r12
lea rcx, [rsp + 0x118]
call fcn.1000327cc
nop
lea rcx, [rsp + 0x118]
call fcn.10001fba0
lea rdx, [0x100012770]
lea rcx, [rsp + 0x118]
call fcn.10001ff98
nop
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x118]
lea rcx, [rsp + 0x60]
call fcn.1000327cc
nop
lea rcx, [rsp + 0x118]
call fcn.10001fba0
mov qword [rsp + 0x40], rdi
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x50]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, edi
je 0x10005e960
mov r9, qword [r12]
mov r8d, eax
lea rdx, [0x100011610]
lea ecx, [rsi + 2]
call fcn.10003c3c0
mov ebp, edi
jmp 0x10005e9b7
cmp rbx, rdi
jne 0x10005e96a
mov r14d, esi
jmp 0x10005e9b7
mov eax, dword [rsp + 0x108]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 7
xor r8d, r8d
lea rdx, [0x1000107a0]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, edi
je 0x10005e9b5
mov r9, qword [r12]
mov r8d, eax
lea rdx, [0x1000117c0]
mov ecx, 3
call fcn.10003c3c0
mov ebp, edi
jmp 0x10005e9b7
mov ebp, esi
mov rcx, qword [rsp + 0x58]
cmp rcx, rdi
je 0x10005e9c7
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp r14d, edi
je 0x10005e9de
mov rdx, qword [rsp + 0x50]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp dword [rsp + 0x110], edi
je 0x10005ebb9
lea rcx, [rsp + 0x70]
call fcn.100019218
nop
lea rcx, [rsp + 0x118]
call fcn.10001fee0
nop
lea rax, [rsp + 0x118]
cmp rax, rdi
jne 0x10005ea1e
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x10005ea37
lea r8, [rsp + 0x118]
mov edx, 2
mov rcx, r13
call fcn.1000454bc
cmp eax, edi
jne 0x10005ea67
lea rdx, [0x10000ca00]
mov ecx, 3
call fcn.10003c3c0
mov esi, edi
lea rcx, [rsp + 0x118]
call fcn.10001fba0
nop
lea rcx, [rsp + 0x70]
call fcn.10001f53c
jmp 0x10005ebb9
lea rdx, [rsp + 0x110]
mov rcx, r13
call fcn.10004545c
cmp eax, edi
jne 0x10005eab3
mov r8, qword [rsp + 0x118]
lea rdx, [0x100012390]
mov ecx, 3
call fcn.10003c3c0
mov esi, edi
lea rcx, [rsp + 0x118]
call fcn.10001fba0
nop
lea rcx, [rsp + 0x70]
call fcn.10001f53c
jmp 0x10005ebb9
mov r9d, dword [rsp + 0x110]
mov rbx, qword [rsp + 0x118]
mov r8, rbx
lea rdx, [0x100011b20]
mov ecx, esi
call fcn.10003c3c0
cmp dword [rsp + 0x110], 5
je 0x10005eb5a
cmp dword [rsp + 0x110], 9
jne 0x10005eb71
lea rax, [rsp + 0x70]
cmp rax, rdi
jne 0x10005eb03
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x10005eb19
lea r8, [rsp + 0x70]
mov edx, 8
mov rcx, r13
call fcn.10004584c
cmp eax, edi
jne 0x10005eb38
mov esi, edi
lea rcx, [rsp + 0x118]
call fcn.10001fba0
nop
lea rcx, [rsp + 0x70]
call fcn.10001f53c
jmp 0x10005ebb9
mov r9, r15
lea r8, [rsp + 0x70]
mov rdx, r12
lea rcx, [rsp + 0x118]
call fcn.100058dd8
mov rbx, qword [rsp + 0x118]
jmp 0x10005eb6d
mov r8, r15
mov rdx, r12
lea rcx, [rsp + 0x118]
call fcn.100058794
cmp eax, edi
je 0x10005eba1
mov r8, rbx
lea rdx, [0x100012400]
mov ecx, 3
call fcn.10003c3c0
mov esi, edi
lea rcx, [rsp + 0x118]
call fcn.10001fba0
nop
lea rcx, [rsp + 0x70]
call fcn.10001f53c
jmp 0x10005ebb9
lea rcx, [rsp + 0x118]
call fcn.10001fba0
nop
lea rcx, [rsp + 0x70]
call fcn.10001f53c
cmp ebp, edi
je 0x10005ebc1
cmp esi, edi
jne 0x10005ebc6
mov edi, 0x643
lea rcx, [rsp + 0x50]
call fcn.10001fba0
nop
lea rcx, [rsp + 0x60]
call fcn.10001fba0
mov eax, edi
add rsp, 0xa8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret