Function at 0x10004a5e0
Capabilities:
Delete registry value
Persist via windows service
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], r8
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x130
mov qword [rsp + 0x88], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov r14, r9
mov rsi, r8
mov r15d, edx
mov r12, rcx
xor ebp, ebp
lea rcx, [rsp + 0x50]
call fcn.10003cdb4
nop
lea rcx, [rsp + 0x48]
call fcn.100020360
nop
lea rcx, [rsp + 0xf8]
call fcn.1000193b8
nop
lea edi, [rbp + 1]
mov dword [rsp + 0x38], edi
lea rcx, [rsp + 0x98]
call fcn.1000193b8
nop
and dword [r14], ebp
lea rcx, [rsp + 0x48]
call fcn.1000202e8
mov r13, qword [rsi]
test r13, r13
je 0x10004a8c7
mov r12d, dword [rsp + 0x180]
xor edi, edi
cmp ebp, edi
jne 0x10004a959
lea rcx, [rsp + 0x30]
call fcn.100020360
nop
mov eax, edi
cmp r13, rdi
setne al
cmp eax, edi
je 0x10004a8bc
mov rdx, r13
mov r13, qword [r13]
add rdx, 0x10
lea rcx, [rsp + 0x30]
call fcn.10001f050
xor r11d, r11d
lea rdi, [0x10000e568]
mov rbx, qword [rsp + 0x30]
mov rsi, rbx
lea ecx, [r11 + 0x15]
repe cmpsw word [rsi], word [rdi]
je 0x10004a6d1
sbb r11d, r11d
sbb r11d, 0xffffffff
xor edi, edi
cmp r11d, edi
jne 0x10004a6f2
lea rdx, [0x10000f900]
lea ecx, [rdi + 2]
call fcn.100054fd8
mov ebp, edi
mov dword [rsp + 0x38], edi
jmp 0x10004a812
lea rax, [rsp + 0x40]
mov qword [rsp + 0x188], rax
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.100020390
nop
mov r8d, 3
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.10003cf1c
cmp eax, 0xb7
je 0x10004a730
mov ebp, edi
jmp 0x10004a812
lea rax, [rsp + 0x48]
cmp rax, rdi
jne 0x10004a747
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x10004a75f
lea r8, [rsp + 0x48]
mov edx, 2
lea rcx, [rsp + 0x50]
call fcn.10003d2d8
cmp eax, edi
jne 0x10004a766
mov ebp, edi
jmp 0x10004a812
mov r12d, 0x57
mov dword [rsp + 0x188], edi
cmp r15d, 5
je 0x10004a7ee
cmp r15d, 9
jne 0x10004a810
lea rcx, [rsp + 0x98]
call fcn.10001f918
lea rdx, [rsp + 0x98]
cmp rdx, rdi
jne 0x10004a7a8
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x10004a7c3
lea r8, [rsp + 0x98]
mov edx, 8
lea rcx, [rsp + 0x50]
call fcn.10003d658
cmp eax, edi
jne 0x10004a7c7
mov ebp, edi
jmp 0x10004a812
lea r9, [rsp + 0x188]
lea r8, [rsp + 0x98]
mov rdx, qword [rsp + 0x170]
lea rcx, [rsp + 0x48]
call fcn.100045480
mov r12d, eax
jmp 0x10004a80b
lea r8, [rsp + 0x188]
mov rdx, qword [rsp + 0x170]
lea rcx, [rsp + 0x48]
call fcn.100044dfc
mov r12d, eax
cmp r12d, edi
je 0x10004a871
mov ebp, edi
mov rax, qword [rsp + 0x170]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x48]
mov r8d, r12d
lea rdx, [0x10000fa70]
mov ecx, 3
call fcn.100054fd8
xor r11d, r11d
lea rdi, [0x10000e568]
mov rsi, rbx
lea ecx, [r11 + 0x15]
repe cmpsw word [rsi], word [rdi]
je 0x10004a858
sbb r11d, r11d
sbb r11d, 0xffffffff
xor edi, edi
cmp r11d, edi
je 0x10004a882
mov rdx, rbx
lea rcx, [rsp + 0xf8]
call fcn.10001f8e0
jmp 0x10004a882
mov ebp, 1
cmp dword [rsp + 0x188], edi
je 0x10004a882
mov dword [r14], ebp
cmp dword [rsp + 0x78], edi
je 0x10004a893
lea rcx, [rsp + 0x50]
call fcn.10003d1ac
nop
lea rcx, [rsp + 0x30]
call fcn.10002006c
cmp r13, rdi
jne 0x10004a677
cmp ebp, edi
jne 0x10004a963
mov edi, dword [rsp + 0x38]
mov r12, qword [rsp + 0x170]
jmp 0x10004a8c7
mov ecx, 0x80004005
call fcn.1000201f8
nop
mov r8, qword [r12]
lea rdx, [0x10000fb00]
mov ecx, 1
call fcn.100054fd8
test edi, edi
je 0x10004ad17
lea rdx, [0x10000fb80]
mov ecx, 1
call fcn.100054fd8
xor edi, edi
mov dword [rsp + 0x188], edi
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov rdx, r12
lea rcx, [rsp + 0x40]
call fcn.100020390
nop
lea r8, [rsp + 0x188]
mov rdx, rax
mov ecx, r15d
call fcn.10004a1dc
cmp eax, edi
je 0x10004a946
mov r8d, eax
lea rdx, [0x100011650]
lea ecx, [rdi + 3]
call fcn.100054fd8
mov ebp, edi
jmp 0x10004ad1c
mov ebp, 1
cmp dword [rsp + 0x188], edi
je 0x10004a96b
mov dword [r14], ebp
jmp 0x10004a96b
mov r12, qword [rsp + 0x170]
jmp 0x10004a96b
mov r12, qword [rsp + 0x170]
cmp qword [rsp + 0x108], rdi
je 0x10004ad1c
lea rcx, [rsp + 0x30]
call fcn.100020360
nop
mov rbx, qword [rsp + 0xf8]
cmp rbx, rdi
je 0x10004ab3c
mov r13, qword [rsp + 0x180]
mov r14d, 3
lea rcx, [rsp + 0x180]
call fcn.100020360
nop
mov eax, edi
cmp rbx, rdi
setne al
cmp eax, edi
je 0x10004ab31
mov rdx, rbx
mov rbx, qword [rbx]
add rdx, 0x10
lea rcx, [rsp + 0x180]
call fcn.10001f050
lea rdx, [rsp + 0x180]
mov rcx, r13
call fcn.10003ccb4
lea rcx, [rsp + 0xc8]
call fcn.1000193b8
nop
lea rax, [rsp + 0x40]
mov qword [rsp + 0x90], rax
lea rdx, [rsp + 0x180]
lea rcx, [rsp + 0x40]
call fcn.100020390
nop
mov r8d, r14d
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.10003cf1c
lea rdx, [rsp + 0xc8]
cmp rdx, rdi
jne 0x10004aa40
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x10004aa57
lea r8, [rsp + 0xc8]
mov edx, 0xa
lea rcx, [rsp + 0x50]
call fcn.10003d658
cmp dword [rsp + 0x78], edi
je 0x10004aa67
lea rcx, [rsp + 0x50]
call fcn.10003d1ac
mov rsi, qword [rsp + 0xc8]
cmp rsi, rdi
je 0x10004ab01
lea rcx, [rsp + 0x38]
call fcn.100020360
nop
mov eax, edi
cmp rsi, rdi
setne al
cmp eax, edi
je 0x10004ab26
mov rdx, rsi
mov rsi, qword [rsi]
add rdx, 0x10
lea rcx, [rsp + 0x38]
call fcn.10001f050
mov rdx, qword [rsp + 0x38]
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x30]
call fcn.10001fec8
cmp rsi, rdi
jne 0x10004aac4
cmp rbx, rdi
je 0x10004aaee
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [0x10000fc5c]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [0x10000fc5c]
lea rcx, [rsp + 0x30]
call fcn.10001fec8
xor edi, edi
lea rcx, [rsp + 0x38]
call fcn.10002006c
cmp rsi, rdi
jne 0x10004aa78
lea rcx, [rsp + 0xc8]
call fcn.10001f994
nop
lea rcx, [rsp + 0x180]
call fcn.10002006c
cmp rbx, rdi
je 0x10004ab4a
jmp 0x10004a9a3
mov ecx, 0x80004005
call fcn.1000201f8
nop
mov ecx, 0x80004005
call fcn.1000201f8
nop
mov r13, qword [rsp + 0x180]
mov r14d, 3
mov r8, qword [rsp + 0x30]
cmp dword [r8 - 0x10], edi
jle 0x10004ab64
lea rdx, [0x10000fc70]
mov ecx, r14d
call fcn.100054fd8
mov qword [rsp + 0x188], rdi
lea rcx, [rsp + 0x40]
call fcn.100020360
nop
lea rcx, [rsp + 0x38]
call fcn.100020360
nop
lea rdx, [0x100010400]
lea rcx, [rsp + 0x180]
call fcn.100020428
nop
lea r8, [rsp + 0x40]
mov rdx, r12
lea rcx, [rsp + 0x180]
call fcn.100032a84
nop
lea rcx, [rsp + 0x180]
call fcn.10002006c
lea rdx, [0x100010330]
lea rcx, [rsp + 0x180]
call fcn.100020428
nop
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x180]
lea rcx, [rsp + 0x40]
call fcn.100032a84
nop
lea rcx, [rsp + 0x180]
call fcn.10002006c
lea rdx, [rsp + 0x188]
mov qword [rsp + 0x20], rdx
mov r9d, 0x2001f
xor r8d, r8d
mov rdx, qword [rsp + 0x38]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x10004acde
cmp qword [r13 + 0x10], rdi
je 0x10004aca4
lea rdx, [rsp + 0x180]
mov rcx, r13
call fcn.100035004
mov rdi, rax
test rax, rax
je 0x10004ac91
mov eax, dword [rsp + 0x180]
add eax, eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
mov r9d, 7
xor r8d, r8d
lea rdx, [0x10000e598]
mov rcx, qword [rsp + 0x188]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x10004ac87
xor ebp, ebp
lea rdx, [0x10000fdf0]
mov ecx, r14d
call fcn.100054fd8
mov rcx, rdi
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
jmp 0x10004acce
xor ebp, ebp
lea rdx, [0x10000fdf0]
mov ecx, r14d
call fcn.100054fd8
jmp 0x10004acce
lea rdx, [0x10000e598]
mov rcx, qword [rsp + 0x188]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, edi
je 0x10004acce
mov ebp, edi
lea rdx, [0x10000fdf0]
mov ecx, r14d
call fcn.100054fd8
mov rcx, qword [rsp + 0x188]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10004acf5
cmp eax, 2
je 0x10004acf5
mov ebp, edi
lea rdx, [0x10000fdf0]
mov ecx, r14d
call fcn.100054fd8
nop
lea rcx, [rsp + 0x38]
call fcn.10002006c
nop
lea rcx, [rsp + 0x40]
call fcn.10002006c
nop
lea rcx, [rsp + 0x30]
call fcn.10002006c
jmp 0x10004ad1c
mov ebp, 1
lea rcx, [rsp + 0x98]
call fcn.10001f994
nop
lea rcx, [rsp + 0xf8]
call fcn.10001f994
nop
lea rcx, [rsp + 0x48]
call fcn.10002006c
nop
lea rcx, [rsp + 0x50]
call fcn.10003ce68
nop
mov rcx, r12
call fcn.10002006c
mov eax, ebp
mov rbx, qword [rsp + 0x178]
add rsp, 0x130
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret