Function at 0x10000791c
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
xor esi, esi
xor ebp, ebp
xor r12d, r12d
mov r13d, r8d
mov r15, rdx
mov qword [rax - 0x48], rsi
mov dword [rax + 0x20], ebp
mov qword [rax - 0x40], r12
call qword [sym.imp.SETUPAPI.dll_SetupGetThreadLogToken]
lea rcx, [0x100002478]
mov r14, rax
call qword [sym.imp.API_MS_Win_Core_LibraryLoader_L1_1_0.dll_GetModuleHandleW]
lea rdx, [0x100002458]
mov rcx, rax
call qword [sym.imp.API_MS_Win_Core_LibraryLoader_L1_1_0.dll_GetProcAddress]
test rax, rax
jne 0x100007986
call qword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
mov edi, eax
jmp 0x100007c0b
call rax
mov rbx, rax
mov rdi, rax
test rax, rax
je 0x1000079af
mov rcx, qword [rdi + 0x10]
call fcn.100007700
test eax, eax
jne 0x1000079a7
mov dword [rdi + 0x18], 1
mov rdi, qword [rdi]
test rdi, rdi
jne 0x100007993
xor edi, edi
test r13b, 0x20
je 0x100007a9e
and qword [rsp + 0xa8], rsi
lea rax, [rsp + 0xa8]
lea rdx, [0x1000024a0]
mov r9d, 0x2001f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
mov edi, eax
test eax, eax
je 0x100007a86
lea r9, [0x100002508]
mov edx, 0x1000000
mov r8d, 1
mov rcx, r14
mov dword [rsp + 0x20], eax
call qword [sym.imp.SETUPAPI.dll_SetupWriteTextLog]
jmp 0x100007c0b
cmp dword [rbx + 0x18], esi
jne 0x100007a83
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.API_MS_Win_Core_Misc_L1_1_0.dll_lstrlenW]
mov rdx, qword [rbx + 8]
mov rcx, qword [rsp + 0xa8]
lea eax, [rax + rax + 2]
mov r9d, 1
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegSetValueExW]
mov r11, qword [rbx + 0x10]
mov rax, qword [rbx + 8]
mov qword [rsp + 0x28], r11
lea r9, [0x100002530]
mov edx, 0x1000000
mov r8d, 4
mov rcx, r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.SETUPAPI.dll_SetupWriteTextLog]
mov rbx, qword [rbx]
test rbx, rbx
jne 0x100007a1b
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
jmp 0x100007c0b
test rbx, rbx
je 0x100007c0b
mov r13d, 8
cmp dword [rbx + 0x18], r12d
jne 0x100007b2b
test ebp, ebp
jne 0x100007adf
mov rcx, qword [0x100019848]
mov r8, r13
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x100007ba3
and dword [rsp + 0xa8], r12d
mov qword [rsp + 0x40], rax
mov r8, qword [rbx + 8]
lea rdx, [rsp + 0xa8]
lea rcx, [rsp + 0x40]
call fcn.100010968
mov edi, eax
test eax, eax
jne 0x100007ba8
mov r8, qword [rbx + 0x10]
lea rdx, [rsp + 0xa8]
lea rcx, [rsp + 0x40]
call fcn.100010968
mov edi, eax
test eax, eax
jne 0x100007ba8
mov rsi, qword [rsp + 0x40]
mov ebp, dword [rsp + 0xa8]
mov rbx, qword [rbx]
test rbx, rbx
jne 0x100007aad
test rsi, rsi
je 0x100007c0b
lea r9, [rsp + 0xa8]
lea r8, [rsp + 0x48]
mov edx, ebp
mov rcx, rsi
call fcn.100010824
mov edi, eax
test eax, eax
jne 0x100007bb6
and dword [rsp + 0x30], r12d
mov eax, dword [rsp + 0xa8]
mov r12, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x90]
mov dword [rsp + 0x28], eax
lea r8, [0x100002230]
mov r9d, 0x2012
mov rdx, r15
mov qword [rsp + 0x20], r12
call qword [sym.imp.SETUPAPI.dll_SetupDiSetDevicePropertyW]
test eax, eax
jne 0x100007bbb
call qword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
mov edi, eax
jmp 0x100007bbb
mov edi, r13d
jmp 0x100007bbb
mov rsi, qword [rsp + 0x40]
mov ebp, dword [rsp + 0xa8]
jmp 0x100007bbb
mov r12, qword [rsp + 0x48]
test rsi, rsi
je 0x100007bf4
test ebp, ebp
je 0x100007be2
mov rbx, rsi
mov r8, qword [rbx]
mov rcx, qword [0x100019848]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rbx, r13
sub rbp, 1
jne 0x100007bc7
mov rcx, qword [0x100019848]
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
test r12, r12
je 0x100007c0b
mov rcx, qword [0x100019848]
mov r8, r12
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rcx, [0x100002478]
call qword [sym.imp.API_MS_Win_Core_LibraryLoader_L1_1_0.dll_GetModuleHandleW]
lea rdx, [0x100002550]
mov rcx, rax
call qword [sym.imp.API_MS_Win_Core_LibraryLoader_L1_1_0.dll_GetProcAddress]
test rax, rax
je 0x100007c2f
call rax
mov eax, edi
mov rbx, qword [rsp + 0x98]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret