Function at 0x14002a730
Capabilities:
Delete registry key
Set registry value

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x68
mov r15, rcx
lea rdx, str.dingtalk
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
xor r13d, r13d
mov qword [rsp + 0x40], r13
lea rax, [rbp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.dingtalk
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x14002a7d2
mov rdx, qword [r15]
sub rdx, 0x18
mov rdi, 0xffffffffffffffff
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x14002a7c1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov dword [rsp + 0x28], r13d
lea rax, [0x140241920]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.URL_Protocol
mov rcx, qword [rbp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov qword [rsp + 0x40], r13
lea rax, [rbp - 0x18]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Shell
mov rcx, qword [rbp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ebx, eax
mov rcx, qword [rbp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x18]
mov qword [rbp + 0x58], rcx
test ebx, ebx
jne 0x14002a7a0
mov qword [rsp + 0x40], r13
lea rax, [rbp - 0x18]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Open
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14002a7a0
mov rcx, qword [rbp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x18]
mov qword [rbp + 0x58], rcx
mov qword [rsp + 0x40], r13
lea rax, [rbp - 0x18]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Command
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14002a7a0
mov rcx, qword [rbp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, qword [rbp - 0x18]
mov qword [rbp + 0x58], rax
call fcn.140004b20
mov rcx, rax
test rax, rax
je 0x14002aaa1
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x60], rax
lea rdx, [0x140246434]
mov rdi, 0xffffffffffffffff
cmp rdx, 0x10000
jae 0x14002a92e
movzx edx, dx
lea rcx, [rbp + 0x60]
call fcn.1400054f0
jmp 0x14002a948
mov rax, rdi
inc rax
cmp word [rdx + rax*2], 0
jne 0x14002a931
mov r8d, eax
lea rcx, [rbp + 0x60]
call fcn.14000ac20
nop
mov r14, qword [r15]
movsxd rax, dword [r14 - 0x10]
mov r12, r14
mov rbx, qword [rbp + 0x60]
sub r12, rbx
sar r12, 1
mov esi, dword [rbx - 0x10]
mov dword [rbp + 0x50], esi
test eax, eax
js 0x14002aaac
test r14, r14
je 0x14002a97d
mov rdx, rax
mov rcx, r14
call fcn.1400ea46c
mov r13, rax
mov ecx, 0x7fffffff
sub ecx, r13d
cmp ecx, esi
jl 0x14002aaac
add esi, r13d
js 0x14002aaac
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, esi
or eax, ecx
jge 0x14002a9b6
mov edx, esi
lea rcx, [rbp + 0x60]
call fcn.140005800
mov rbx, qword [rbp + 0x60]
mov eax, dword [rbp + 0x50]
cmp r12, rax
ja 0x14002a9c2
lea r14, [rbx + r12*2]
lea rcx, [rbx + rax*2]
movsxd r8, r13d
add r8, r8
je 0x14002a9f9
test rcx, rcx
je 0x14002a9e9
test r14, r14
je 0x14002a9e2
mov rdx, r14
call fcn.1400d9910
jmp 0x14002a9f9
xor edx, edx
call fcn.1400d9fc0
call fcn.1400e8b0c
mov dword [rax], 0x16
call fcn.1400de95c
cmp esi, dword [rbx - 0xc]
jg 0x14002aaac
mov dword [rbx - 0x10], esi
movsxd rax, esi
xor ecx, ecx
mov word [rbx + rax*2], cx
lea rdx, [0x140247f90]
mov rax, rdi
nop dword [rax + rax]
inc rax
cmp word [rdx + rax*2], cx
jne 0x14002aa20
mov r8d, eax
lea rcx, [rbp + 0x60]
call fcn.14000c240
mov rbx, qword [rbp + 0x60]
mov edx, dword [rbx - 0x10]
lea esi, [rdx + rdx]
cmp dword [rbx - 8], 1
jle 0x14002aa52
lea rcx, [rbp + 0x60]
call fcn.140004a00
mov rbx, qword [rbp + 0x60]
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rdx, [rbx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14002aa95
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [r15]
sub rdx, 0x18
jmp 0x14002a7ae
mov ecx, 0x80004005
call fcn.1400049a0
nop
mov ecx, 0x80070057
call fcn.1400049a0
int3