Function at 0x1400029e0
Capabilities:
Create process on windows
Delete registry key
Get common file path
Get installed programs
Get program files directory
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x18b0]
mov eax, 0x19b0
call fcn.140007470
sub rsp, rax
mov rax, qword [0x14006b008]
xor rax, rsp
mov qword [rbp + 0x18a0], rax
xor r12d, r12d
mov qword [rsp + 0x58], rcx
mov r14, rcx
mov qword [rsp + 0x70], r12
lea rcx, [rbp + 0x1070]
mov qword [rsp + 0x60], r12
xor edx, edx
mov r8d, 0x208
mov r13d, r12d
mov r15d, r12d
mov esi, r12d
call fcn.140008710
xor edx, edx
lea rcx, [rbp + 0x620]
mov r8d, 0x208
call fcn.140008710
xor edx, edx
lea rcx, [rbp + 0x410]
mov r8d, 0x208
call fcn.140008710
xor edx, edx
lea rcx, [rbp + 0xa40]
mov r8d, 0x208
call fcn.140008710
xor edx, edx
lea rcx, [rbp + 0x830]
mov r8d, 0x208
call fcn.140008710
xor edx, edx
lea rcx, [rbp + 0xc50]
mov r8d, 0x208
call fcn.140008710
xor edx, edx
lea rcx, [rbp + 0xe60]
mov r8d, 0x208
call fcn.140008710
mov ebx, 0x104
lea rcx, [rbp + 0x830]
mov edx, ebx
call fcn.140001c10
test eax, eax
je 0x1400033ff
lea r8, [rbp + 0x830]
mov edx, ebx
lea rax, [rbp + 0x620]
sub r8, rax
lea rcx, [rbp + 0x620]
nop dword [rax + rax]
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140002b23
movzx eax, word [r8 + rcx]
test ax, ax
je 0x140002b23
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140002b00
test rdx, rdx
lea rax, [rcx - 2]
cmovne rax, rcx
mov word [rax], r12w
je 0x1400033ff
xor edx, edx
lea rcx, [rbp + 0x620]
lea r8d, [rdx + 0x5c]
call qword [sym.imp.SHLWAPI.dll_StrRChrW]
test rax, rax
je 0x1400033ff
mov word [rax], r12w
lea r8, [rbp + 0x620]
lea rax, [rbp + 0x410]
mov rdx, rbx
sub r8, rax
lea rcx, [rbp + 0x410]
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140002b96
movzx eax, word [r8 + rcx]
test ax, ax
je 0x140002b96
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140002b73
test rdx, rdx
lea rax, [rcx - 2]
cmovne rax, rcx
mov word [rax], r12w
je 0x1400033ff
mov rcx, rbx
lea rax, [rbp + 0x410]
cmp word [rax], si
je 0x140002bc4
add rax, 2
sub rcx, 1
jne 0x140002bb5
mov rax, rbx
mov r8, r12
sub rax, rcx
test rcx, rcx
cmovne r8, rax
je 0x1400033ff
mov rdx, rbx
lea rcx, [rbp + 0x410]
lea rcx, [rcx + r8*2]
sub rdx, r8
je 0x140002c22
lea rax, [r8 + 0x7ffffefa]
add rax, rdx
lea r9, [0x140054900]
sub r9, rcx
test rax, rax
je 0x140002c22
movzx r8d, word [r9 + rcx]
test r8w, r8w
je 0x140002c22
mov word [rcx], r8w
dec rax
add rcx, 2
sub rdx, 1
jne 0x140002c01
test rdx, rdx
lea rax, [rcx - 2]
cmovne rax, rcx
mov word [rax], r12w
je 0x1400033ff
lea rdx, [rbp + 0x410]
lea rcx, [rbp + 0x1070]
call qword [sym.imp.SHLWAPI.dll_PathCanonicalizeW]
test eax, eax
je 0x1400033ff
xor r9d, r9d
lea rax, [rbp + 0xa40]
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea edx, [r9 + 0x26]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x1400033ff
lea rdx, [0x140054918]
lea rcx, [rbp + 0xa40]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x1400033ff
lea rax, [rsp + 0x68]
mov qword [rsp + 0x19e8], rdi
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rsp + 0x68], r12
lea rdx, [0x140054940]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rsp + 0x50], r12d
test eax, eax
jne 0x140002db4
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rdx, [0x1400549a8]
xor r9d, r9d
mov qword [rsp + 0x20], r12
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140002db4
mov edx, dword [rsp + 0x50]
lea ecx, [rax + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x70], rax
mov r15, rax
test rax, rax
je 0x140002db4
mov edx, dword [rsp + 0x50]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x60], rax
mov rsi, rax
test rax, rax
je 0x140002db4
mov r13d, dword [rsp + 0x50]
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x68]
lea rdx, str.AppsComponents
mov qword [rsp + 0x28], rax
xor r9d, r9d
shr r13d, 1
xor r8d, r8d
inc r13d
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140002db4
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rdx, str.AppsVersion
lea rax, [rbp + 0xe60]
mov dword [rsp + 0x50], 0x208
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140002dbc
lea edi, [rax + 1]
jmp 0x140002dbf
mov dword [rsp + 0x50], 0x208
mov edi, r12d
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140002dcf
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x14000338e
xor edx, edx
mov dword [rbp - 0x80], MsiRecordGetStringA
lea rcx, [rbp - 0x78]
lea r8d, [rdx + 0x68]
call fcn.140008710
xor edx, edx
lea rcx, [rbp + 0x200]
mov r8d, 0x208
call fcn.140008710
xor edx, edx
lea rcx, [rbp + 0x1490]
mov r8d, 0x410
call fcn.140008710
lea rax, [rbp + 0x200]
mov dword [rbp - 0x7c], 0x140
mov qword [rbp - 0x68], rax
xor r9d, r9d
lea rax, [rbp + 0x1490]
mov qword [rbp - 0x78], r14
mov qword [rbp - 0x60], rax
xor r8d, r8d
lea rax, [rbp + 0x200]
mov qword [rbp - 0x70], r12
lea edx, [r9 + 0x25]
mov qword [rsp + 0x20], rax
xor ecx, ecx
mov dword [rbp - 0x50], 1
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x14000338b
mov rcx, rbx
lea rax, [rbp + 0x200]
cmp word [rax], r12w
je 0x140002e81
add rax, 2
sub rcx, 1
jne 0x140002e71
mov rax, rbx
mov r8, r12
sub rax, rcx
test rcx, rcx
cmovne r8, rax
je 0x14000338b
mov rdx, rbx
lea rcx, [rbp + 0x200]
lea rcx, [rcx + r8*2]
sub rdx, r8
je 0x140002ee1
lea rax, [r8 + 0x7ffffefa]
add rax, rdx
lea r9, [0x1400546b4]
sub r9, rcx
nop
test rax, rax
je 0x140002ee1
movzx r8d, word [r9 + rcx]
test r8w, r8w
je 0x140002ee1
mov word [rcx], r8w
dec rax
add rcx, 2
sub rdx, 1
jne 0x140002ec0
test rdx, rdx
lea rax, [rcx - 2]
cmovne rax, rcx
mov word [rax], r12w
je 0x14000338b
mov rcx, rbx
lea rax, [rbp + 0x200]
cmp word [rax], r12w
je 0x140002f10
add rax, 2
sub rcx, 1
jne 0x140002f00
mov rax, rbx
mov r8, r12
sub rax, rcx
test rcx, rcx
cmovne r8, rax
je 0x14000338b
mov rdx, rbx
lea rcx, [rbp + 0x200]
lea rcx, [rcx + r8*2]
sub rdx, r8
je 0x140002f71
lea rax, [r8 + 0x7ffffefa]
add rax, rdx
lea r9, [0x140054a00]
sub r9, rcx
nop dword [rax]
test rax, rax
je 0x140002f71
movzx r8d, word [r9 + rcx]
test r8w, r8w
je 0x140002f71
mov word [rcx], r8w
dec rax
add rcx, 2
sub rdx, 1
jne 0x140002f50
test rdx, rdx
lea rax, [rcx - 2]
cmovne rax, rcx
mov word [rax], r12w
je 0x14000338b
xor edx, edx
lea rcx, [rbp - 0x10]
mov r8d, 0x208
call fcn.140008710
xor edx, edx
lea rcx, [rbp + 0x1280]
mov r8d, 0x208
call fcn.140008710
movzx eax, word [r15]
mov rdi, r15
mov r14, rsi
mov r12d, 2
xor esi, esi
mov r15d, r12d
cmp si, ax
cmovne r15d, esi
test ax, ax
je 0x14000311e
mov rcx, rdi
call sub.msi.dll_MsiRecordGetStringA
cmp eax, 5
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0x1070]
mov rdx, rbx
lea r8, [0x140054a18]
sete sil
lea rcx, [rbp - 0x10]
call fcn.140004810
test eax, eax
js 0x14000302f
lea r9, [0x140054a30]
mov qword [rsp + 0x20], rdi
lea r8, [0x140054a98]
mov rdx, rbx
lea rcx, [rbp + 0x1280]
call fcn.140004810
test eax, eax
js 0x14000302f
mov eax, 1
jmp 0x140003031
xor eax, eax
test esi, esi
je 0x140003046
test eax, eax
je 0x14000311b
lea r8, str._fvomus___s___q
jmp 0x140003055
test eax, eax
je 0x14000311b
lea r8, [0x140054ac8]
lea r9, [rbp - 0x10]
mov edx, 0x208
lea rcx, [rbp + 0x1490]
call fcn.140004810
test eax, eax
js 0x14000311b
lea rcx, [rbp - 0x80]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x14000311b
mov edx, r13d
mov r8, rdi
mov rcx, r14
call fcn.140004790
test eax, eax
js 0x14000311b
mov rcx, qword [rbp - 0x18]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbp + 0x1280]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, 0xffffffff
sub ecx, eax
add r13d, ecx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, r14
lea r15d, [r15 + rax*2]
add r15d, r12d
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
mov rcx, rdi
cdqe
lea r14, [r14 + rax*2]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cdqe
lea rdi, [rdi + rax*2]
movzx eax, word [rdi]
test ax, ax
je 0x14000311e
xor esi, esi
jmp 0x140002fd0
movzx eax, word [rdi]
xor r13d, r13d
cmp r13w, ax
mov edi, r13d
sete dil
jne 0x14000338e
xorps xmm0, xmm0
mov dword [rbp - 0x74], r13d
lea rcx, [rbp + 0x830]
mov dword [rbp - 0x4e], r13d
movdqu xmmword [rbp - 0x5e], xmm0
add r15d, r12d
mov word [rbp - 0x4a], r13w
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov rdi, qword [rsp + 0x58]
lea rcx, [rbp + 0x830]
mov qword [rbp - 0x70], rcx
lea r9, [rbp + 0xa40]
lea rcx, [rbp + 0xc50]
mov qword [rbp - 0x80], rdi
mov qword [rbp - 0x68], rcx
lea r8, [0x140054ae0]
mov ecx, 0x614
mov dword [rbp - 0x78], r12d
mov word [rbp - 0x60], cx
mov rdx, rbx
lea rcx, [rbp + 0xc50]
mov qword [rsp + 0x20], rax
call fcn.140004810
test eax, eax
js 0x140003386
lea rcx, [rbp - 0x80]
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
jne 0x140003386
lea r8, [rbp + 0xa40]
mov rcx, rdi
lea rdx, [rbp + 0x620]
call fcn.140002800
test eax, eax
je 0x140003386
lea rcx, [rbp + 0xc50]
mov qword [rsp + 0x58], r13
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rbp + 0xe60]
lea esi, [rax*2 + 2]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
xor edx, edx
lea rcx, [rbp - 0x10]
mov r8d, 0x208
lea edi, [rax*2 + 2]
call fcn.140008710
mov r14, qword [rsp + 0x60]
cmp word [r14], r13w
je 0x140003273
lea rdx, [rbp + 0xe60]
lea rax, [rbp - 0x10]
sub rdx, rax
lea rcx, [rbp - 0x10]
nop dword [rax + rax]
lea rax, [rbx + 0x7ffffefa]
test rax, rax
je 0x140003261
movzx eax, word [rdx + rcx]
test ax, ax
je 0x140003261
mov word [rcx], ax
add rcx, r12
sub rbx, 1
jne 0x140003240
test rbx, rbx
lea rax, [rcx - 2]
mov r12d, edi
cmovne rax, rcx
mov word [rax], r13w
mov qword [rsp + 0x40], r13
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
lea rdx, [0x140054af0]
mov qword [rsp + 0x30], r13
xor r9d, r9d
mov dword [rsp + 0x28], 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], r13d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140003371
mov rcx, qword [rsp + 0x58]
lea r9d, [rax + 7]
mov dword [rsp + 0x28], r15d
lea rdx, [0x140054b20]
xor r8d, r8d
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140003371
mov rcx, qword [rsp + 0x58]
lea rax, [rbp + 0xc50]
mov dword [rsp + 0x28], esi
lea rdx, str.Setup
mov r9d, 1
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140003371
mov rcx, qword [rsp + 0x58]
lea rax, [rbp - 0x10]
mov dword [rsp + 0x28], r12d
lea rdx, [0x140054b48]
mov r9d, 1
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140003371
mov rcx, qword [rsp + 0x58]
lea rax, [rbp + 0xe60]
mov dword [rsp + 0x28], edi
lea rdx, [0x140054b58]
mov r9d, 1
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, 1
test eax, eax
je 0x140003374
mov edi, r13d
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140003393
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140003393
mov edi, r13d
jmp 0x14000338e
mov edi, r12d
mov r14, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x1400033a3
call qword [sym.imp.KERNEL32.dll_LocalFree]
test r14, r14
je 0x1400033b1
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
test edi, edi
je 0x1400033c9
lea rdx, str.SystemCurrentControlSetServices_tphkloadFinalize
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
mov eax, edi
mov rdi, qword [rsp + 0x19e8]
mov rcx, qword [rbp + 0x18a0]
xor rcx, rsp
call fcn.1400074e0
lea r11, [rsp + 0x19b0]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov eax, r12d
jmp 0x1400033d3