Function at 0x1000522b4
Capabilities:
Delete registry value
Persist via windows service
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], r8
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x130
mov qword [rsp + 0x88], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov r14, r9
mov rsi, r8
mov r15d, edx
mov r12, rcx
xor ebp, ebp
lea rcx, [rsp + 0x50]
call fcn.10003df74
nop
lea rcx, [rsp + 0x48]
call fcn.10001e06c
nop
lea rcx, [rsp + 0xf8]
call fcn.100018ee8
nop
lea edi, [rbp + 1]
mov dword [rsp + 0x38], edi
lea rcx, [rsp + 0x98]
call fcn.100018ee8
nop
and dword [r14], ebp
lea rcx, [rsp + 0x48]
call fcn.10001e65c
mov r13, qword [rsi]
test r13, r13
je 0x10005259b
mov r12d, dword [rsp + 0x180]
xor edi, edi
cmp ebp, edi
jne 0x10005262d
lea rcx, [rsp + 0x30]
call fcn.10001e06c
nop
mov eax, edi
cmp r13, rdi
setne al
cmp eax, edi
je 0x100052590
mov rdx, r13
mov r13, qword [r13]
add rdx, 0x10
lea rcx, [rsp + 0x30]
call fcn.10001e1c8
xor r11d, r11d
lea rdi, [0x100010648]
mov rbx, qword [rsp + 0x30]
mov rsi, rbx
lea ecx, [r11 + 0x15]
repe cmpsw word [rsi], word [rdi]
je 0x1000523a5
sbb r11d, r11d
sbb r11d, 0xffffffff
xor edi, edi
cmp r11d, edi
jne 0x1000523c6
lea rdx, [0x1000119e0]
lea ecx, [rdi + 2]
call fcn.100037e18
mov ebp, edi
mov dword [rsp + 0x38], edi
jmp 0x1000524e6
lea rax, [rsp + 0x40]
mov qword [rsp + 0x188], rax
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.10001e09c
nop
mov r8d, 3
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.10003e014
cmp eax, 0xb7
je 0x100052404
mov ebp, edi
jmp 0x1000524e6
lea rax, [rsp + 0x48]
cmp rax, rdi
jne 0x10005241b
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x100052433
lea r8, [rsp + 0x48]
mov edx, 2
lea rcx, [rsp + 0x50]
call fcn.10003e3c8
cmp eax, edi
jne 0x10005243a
mov ebp, edi
jmp 0x1000524e6
mov r12d, 0x57
mov dword [rsp + 0x188], edi
cmp r15d, 5
je 0x1000524c2
cmp r15d, 9
jne 0x1000524e4
lea rcx, [rsp + 0x98]
call fcn.10001eed4
lea rdx, [rsp + 0x98]
cmp rdx, rdi
jne 0x10005247c
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x100052497
lea r8, [rsp + 0x98]
mov edx, 8
lea rcx, [rsp + 0x50]
call fcn.10003e708
cmp eax, edi
jne 0x10005249b
mov ebp, edi
jmp 0x1000524e6
lea r9, [rsp + 0x188]
lea r8, [rsp + 0x98]
mov rdx, qword [rsp + 0x170]
lea rcx, [rsp + 0x48]
call fcn.10004df34
mov r12d, eax
jmp 0x1000524df
lea r8, [rsp + 0x188]
mov rdx, qword [rsp + 0x170]
lea rcx, [rsp + 0x48]
call fcn.10004db58
mov r12d, eax
cmp r12d, edi
je 0x100052545
mov ebp, edi
mov rax, qword [rsp + 0x170]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x48]
mov r8d, r12d
lea rdx, [0x100011b50]
mov ecx, 3
call fcn.100037e18
xor r11d, r11d
lea rdi, [0x100010648]
mov rsi, rbx
lea ecx, [r11 + 0x15]
repe cmpsw word [rsi], word [rdi]
je 0x10005252c
sbb r11d, r11d
sbb r11d, 0xffffffff
xor edi, edi
cmp r11d, edi
je 0x100052556
mov rdx, rbx
lea rcx, [rsp + 0xf8]
call fcn.10001ee9c
jmp 0x100052556
mov ebp, 1
cmp dword [rsp + 0x188], edi
je 0x100052556
mov dword [r14], ebp
cmp dword [rsp + 0x78], edi
je 0x100052567
lea rcx, [rsp + 0x50]
call fcn.10003e29c
nop
lea rcx, [rsp + 0x30]
call fcn.10001f3ec
cmp r13, rdi
jne 0x10005234b
cmp ebp, edi
jne 0x100052637
mov edi, dword [rsp + 0x38]
mov r12, qword [rsp + 0x170]
jmp 0x10005259b
mov ecx, 0x80004005
call fcn.10001f28c
nop
mov r8, qword [r12]
lea rdx, [0x100011be0]
mov ecx, 1
call fcn.100037e18
test edi, edi
je 0x1000529eb
lea rdx, [0x100011c60]
mov ecx, 1
call fcn.100037e18
xor edi, edi
mov dword [rsp + 0x188], edi
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov rdx, r12
lea rcx, [rsp + 0x40]
call fcn.10001e09c
nop
lea r8, [rsp + 0x188]
mov rdx, rax
mov ecx, r15d
call fcn.100051f98
cmp eax, edi
je 0x10005261a
mov r8d, eax
lea rdx, [0x100013710]
lea ecx, [rdi + 3]
call fcn.100037e18
mov ebp, edi
jmp 0x1000529f0
mov ebp, 1
cmp dword [rsp + 0x188], edi
je 0x10005263f
mov dword [r14], ebp
jmp 0x10005263f
mov r12, qword [rsp + 0x170]
jmp 0x10005263f
mov r12, qword [rsp + 0x170]
cmp qword [rsp + 0x108], rdi
je 0x1000529f0
lea rcx, [rsp + 0x30]
call fcn.10001e06c
nop
mov rbx, qword [rsp + 0xf8]
cmp rbx, rdi
je 0x100052810
mov r13, qword [rsp + 0x180]
mov r14d, 3
lea rcx, [rsp + 0x180]
call fcn.10001e06c
nop
mov eax, edi
cmp rbx, rdi
setne al
cmp eax, edi
je 0x100052805
mov rdx, rbx
mov rbx, qword [rbx]
add rdx, 0x10
lea rcx, [rsp + 0x180]
call fcn.10001e1c8
lea rdx, [rsp + 0x180]
mov rcx, r13
call fcn.10003de90
lea rcx, [rsp + 0xc8]
call fcn.100018ee8
nop
lea rax, [rsp + 0x40]
mov qword [rsp + 0x90], rax
lea rdx, [rsp + 0x180]
lea rcx, [rsp + 0x40]
call fcn.10001e09c
nop
mov r8d, r14d
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.10003e014
lea rdx, [rsp + 0xc8]
cmp rdx, rdi
jne 0x100052714
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x10005272b
lea r8, [rsp + 0xc8]
mov edx, 0xa
lea rcx, [rsp + 0x50]
call fcn.10003e708
cmp dword [rsp + 0x78], edi
je 0x10005273b
lea rcx, [rsp + 0x50]
call fcn.10003e29c
mov rsi, qword [rsp + 0xc8]
cmp rsi, rdi
je 0x1000527d5
lea rcx, [rsp + 0x38]
call fcn.10001e06c
nop
mov eax, edi
cmp rsi, rdi
setne al
cmp eax, edi
je 0x1000527fa
mov rdx, rsi
mov rsi, qword [rsi]
add rdx, 0x10
lea rcx, [rsp + 0x38]
call fcn.10001e1c8
mov rdx, qword [rsp + 0x38]
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x30]
call fcn.10001ed3c
cmp rsi, rdi
jne 0x100052798
cmp rbx, rdi
je 0x1000527c2
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [0x100011d3c]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [0x100011d3c]
lea rcx, [rsp + 0x30]
call fcn.10001ed3c
xor edi, edi
lea rcx, [rsp + 0x38]
call fcn.10001f3ec
cmp rsi, rdi
jne 0x10005274c
lea rcx, [rsp + 0xc8]
call fcn.10001a784
nop
lea rcx, [rsp + 0x180]
call fcn.10001f3ec
cmp rbx, rdi
je 0x10005281e
jmp 0x100052677
mov ecx, 0x80004005
call fcn.10001f28c
nop
mov ecx, 0x80004005
call fcn.10001f28c
nop
mov r13, qword [rsp + 0x180]
mov r14d, 3
mov r8, qword [rsp + 0x30]
cmp dword [r8 - 0x10], edi
jle 0x100052838
lea rdx, [0x100011d50]
mov ecx, r14d
call fcn.100037e18
mov qword [rsp + 0x188], rdi
lea rcx, [rsp + 0x40]
call fcn.10001e06c
nop
lea rcx, [rsp + 0x38]
call fcn.10001e06c
nop
lea rdx, [0x1000124e0]
lea rcx, [rsp + 0x180]
call fcn.10001e134
nop
lea r8, [rsp + 0x40]
mov rdx, r12
lea rcx, [rsp + 0x180]
call fcn.10002f9d0
nop
lea rcx, [rsp + 0x180]
call fcn.10001f3ec
lea rdx, [0x100012410]
lea rcx, [rsp + 0x180]
call fcn.10001e134
nop
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x180]
lea rcx, [rsp + 0x40]
call fcn.10002f9d0
nop
lea rcx, [rsp + 0x180]
call fcn.10001f3ec
lea rdx, [rsp + 0x188]
mov qword [rsp + 0x20], rdx
mov r9d, 0x2001f
xor r8d, r8d
mov rdx, qword [rsp + 0x38]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x1000529b2
cmp qword [r13 + 0x10], rdi
je 0x100052978
lea rdx, [rsp + 0x180]
mov rcx, r13
call fcn.100031ad4
mov rdi, rax
test rax, rax
je 0x100052965
mov eax, dword [rsp + 0x180]
add eax, eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
mov r9d, 7
xor r8d, r8d
lea rdx, [0x100010678]
mov rcx, qword [rsp + 0x188]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x10005295b
xor ebp, ebp
lea rdx, [0x100011ed0]
mov ecx, r14d
call fcn.100037e18
mov rcx, rdi
call fcn.10005cbc0
jmp 0x1000529a2
xor ebp, ebp
lea rdx, [0x100011ed0]
mov ecx, r14d
call fcn.100037e18
jmp 0x1000529a2
lea rdx, [0x100010678]
mov rcx, qword [rsp + 0x188]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, edi
je 0x1000529a2
mov ebp, edi
lea rdx, [0x100011ed0]
mov ecx, r14d
call fcn.100037e18
mov rcx, qword [rsp + 0x188]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1000529c9
cmp eax, 2
je 0x1000529c9
mov ebp, edi
lea rdx, [0x100011ed0]
mov ecx, r14d
call fcn.100037e18
nop
lea rcx, [rsp + 0x38]
call fcn.10001f3ec
nop
lea rcx, [rsp + 0x40]
call fcn.10001f3ec
nop
lea rcx, [rsp + 0x30]
call fcn.10001f3ec
jmp 0x1000529f0
mov ebp, 1
lea rcx, [rsp + 0x98]
call fcn.10001a784
nop
lea rcx, [rsp + 0xf8]
call fcn.10001a784
nop
lea rcx, [rsp + 0x48]
call fcn.10001f3ec
nop
lea rcx, [rsp + 0x50]
call fcn.10003dfc8
nop
mov rcx, r12
call fcn.10001f3ec
mov eax, ebp
mov rbx, qword [rsp + 0x178]
add rsp, 0x130
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret