Function at 0x1400242d0
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x40]
sub rsp, 0x140
mov rax, qword [0x140073058]
xor rax, rsp
mov qword [rbp + 0x30], rax
movzx ebx, cl
mov ecx, 0x55f0
call fcn.14000fbc0
test al, al
jne 0x140024308
mov al, 1
jmp 0x1400245f6
lea rax, [rsp + 0x50]
mov qword [rsp + 0x150], rdi
xor edi, edi
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
mov qword [rsp + 0x50], rdi
xor r8d, r8d
mov qword [rsp + 0x58], rdi
lea rdx, str.SYSTEMCurrentControlSetServicesLITSSVCNotification
mov dword [rsp + 0x60], edi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400243b1
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
lea rdx, str.QUIET
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400243b1
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x58]
lea rax, [rsp + 0x60]
xor r8d, r8d
lea rdx, str.QUIET
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400243b1
cmp dword [rsp + 0x60], 1
je 0x1400243f0
lea rcx, [0x140075ed0]
call qword [sym.imp.KERNEL32.dll_OOBEComplete]
mov ecx, dword [0x140075ed0]
test eax, eax
je 0x1400243cc
test ecx, ecx
jne 0x140024407
test bl, bl
je 0x1400243f7
lea r8, [0x140075ec8]
xor edx, edx
lea rcx, [0x1400247a0]
call qword [sym.imp.KERNEL32.dll_RegisterWaitUntilOOBECompleted]
test eax, eax
jne 0x1400243f0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov bl, 1
jmp 0x1400245db
test eax, eax
je 0x1400245d9
test ecx, ecx
je 0x1400245d9
lea rax, [rsp + 0x50]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMCurrentControlSetServicesLITSSVCNotification
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400245d4
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
lea rdx, str.OOBE
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400245d4
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x58]
lea rax, [rbp - 0x50]
xor r8d, r8d
lea rdx, str.OOBE
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400245d4
lea rax, [rsp + 0x64]
mov dword [rsp + 0x64], edi
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x6c]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x68]
lea rax, [rsp + 0x74]
mov qword [rsp + 0x28], rax
lea rdx, str._04d__02d__02d__02d:_02d:_02d
lea rax, [rsp + 0x70]
lea rcx, [rbp - 0x50]
mov qword [rsp + 0x20], rax
call fcn.1400251a0
mov eax, dword [rsp + 0x68]
lea rcx, [rbp - 0x78]
add eax, 0xfffff894
mov qword [rbp - 0x60], rdi
mov dword [rbp - 0x64], eax
mov eax, dword [rsp + 0x6c]
dec eax
mov dword [rbp - 0x58], edi
mov dword [rbp - 0x68], eax
mov eax, dword [rsp + 0x70]
mov dword [rbp - 0x6c], eax
mov eax, dword [rsp + 0x74]
mov dword [rbp - 0x70], eax
mov eax, dword [rsp + 0x78]
mov dword [rbp - 0x74], eax
mov eax, dword [rsp + 0x64]
mov dword [rbp - 0x78], eax
call fcn.14003c628
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400245d9
xor ecx, ecx
call fcn.14003c630
mov rdx, rbx
mov rcx, rax
call fcn.14003c6a0
xorps xmm1, xmm1
ucomisd xmm0, xmm1
jp 0x140024551
je 0x1400245d9
comisd xmm0, xmmword [0x140068dd8]
jb 0x1400245d9
mov qword [rsp + 0x40], rdi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea rdx, str.SYSTEMCurrentControlSetServicesLITSSVCNotification
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], 0x20006
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], edi
mov dword [rbp - 0x80], 1
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400243f0
mov rcx, qword [rsp + 0x50]
lea rax, [rbp - 0x80]
mov dword [rsp + 0x28], 4
lea rdx, str.QUIET
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov bl, 1
jmp 0x1400245db
call fcn.140024620
xor bl, bl
mov rcx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x150]
test rcx, rcx
je 0x1400245f3
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, bl
mov rcx, qword [rbp + 0x30]
xor rcx, rsp
call fcn.14002a740
mov rbx, qword [rsp + 0x158]
add rsp, 0x140
pop rbp
ret