Function at 0x10005de88
Capabilities:
Delete registry value
Persist via windows service
Set registry value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x138
mov qword [rsp + 0x88], 0xfffffffffffffffe
mov r14, r9
mov rsi, r8
mov r15d, edx
mov r12, rcx
xor ebp, ebp
lea rcx, [rsp + 0x50]
call fcn.100044f88
nop
lea rcx, [rsp + 0x48]
call fcn.10001fee0
nop
lea rcx, [rsp + 0xf8]
call fcn.100019218
nop
lea edi, [rbp + 1]
mov dword [rsp + 0x38], edi
lea rcx, [rsp + 0x98]
call fcn.100019218
nop
mov dword [r14], ebp
lea rcx, [rsp + 0x48]
call fcn.10001fe6c
mov r13, qword [rsi]
test r13, r13
je 0x10005e16b
mov r12d, dword [rsp + 0x190]
xor edi, edi
cmp ebp, edi
jne 0x10005e1fd
lea rcx, [rsp + 0x30]
call fcn.10001fee0
nop
mov eax, edi
cmp r13, rdi
setne al
cmp eax, edi
je 0x10005e160
mov rdx, r13
mov r13, qword [r13]
add rdx, 0x10
lea rcx, [rsp + 0x30]
call fcn.10001ecdc
xor r11d, r11d
lea rdi, [0x100010770]
mov rbx, qword [rsp + 0x30]
mov rsi, rbx
lea ecx, [r11 + 0x15]
repe cmpsw word [rsi], word [rdi]
je 0x10005df75
sbb r11d, r11d
sbb r11d, 0xffffffff
xor edi, edi
cmp r11d, edi
jne 0x10005df96
lea rdx, [0x100011d40]
lea ecx, [rdi + 2]
call fcn.10003c3c0
mov ebp, edi
mov dword [rsp + 0x38], edi
jmp 0x10005e0b6
lea rax, [rsp + 0x40]
mov qword [rsp + 0x198], rax
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.10001ff10
nop
mov r8d, 3
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.100045100
cmp eax, 0xb7
je 0x10005dfd4
mov ebp, edi
jmp 0x10005e0b6
lea rax, [rsp + 0x48]
cmp rax, rdi
jne 0x10005dfeb
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x10005e003
lea r8, [rsp + 0x48]
mov edx, 2
lea rcx, [rsp + 0x50]
call fcn.1000454bc
cmp eax, edi
jne 0x10005e00a
mov ebp, edi
jmp 0x10005e0b6
mov r12d, 0x57
mov dword [rsp + 0x198], edi
cmp r15d, 5
je 0x10005e092
cmp r15d, 9
jne 0x10005e0b4
lea rcx, [rsp + 0x98]
call fcn.10001f4c0
lea rdx, [rsp + 0x98]
cmp rdx, rdi
jne 0x10005e04c
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x10005e067
lea r8, [rsp + 0x98]
mov edx, 8
lea rcx, [rsp + 0x50]
call fcn.10004584c
cmp eax, edi
jne 0x10005e06b
mov ebp, edi
jmp 0x10005e0b6
lea r9, [rsp + 0x198]
lea r8, [rsp + 0x98]
mov rdx, qword [rsp + 0x180]
lea rcx, [rsp + 0x48]
call fcn.100058dd8
mov r12d, eax
jmp 0x10005e0af
lea r8, [rsp + 0x198]
mov rdx, qword [rsp + 0x180]
lea rcx, [rsp + 0x48]
call fcn.100058794
mov r12d, eax
cmp r12d, edi
je 0x10005e115
mov ebp, edi
mov rax, qword [rsp + 0x180]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x48]
mov r8d, r12d
lea rdx, [0x100011eb0]
mov ecx, 3
call fcn.10003c3c0
xor r11d, r11d
lea rdi, [0x100010770]
mov rsi, rbx
lea ecx, [r11 + 0x15]
repe cmpsw word [rsi], word [rdi]
je 0x10005e0fc
sbb r11d, r11d
sbb r11d, 0xffffffff
xor edi, edi
cmp r11d, edi
je 0x10005e126
mov rdx, rbx
lea rcx, [rsp + 0xf8]
call fcn.10001f488
jmp 0x10005e126
mov ebp, 1
cmp dword [rsp + 0x198], edi
je 0x10005e126
mov dword [r14], ebp
cmp dword [rsp + 0x78], edi
je 0x10005e137
lea rcx, [rsp + 0x50]
call fcn.100045390
nop
lea rcx, [rsp + 0x30]
call fcn.10001fba0
cmp r13, rdi
jne 0x10005df1b
cmp ebp, edi
jne 0x10005e207
mov edi, dword [rsp + 0x38]
mov r12, qword [rsp + 0x180]
jmp 0x10005e16b
mov ecx, 0x80004005
call fcn.10001fd10
nop
mov r8, qword [r12]
lea rdx, [0x100011f40]
mov ecx, 1
call fcn.10003c3c0
test edi, edi
je 0x10005e5bb
lea rdx, [0x100011fc0]
mov ecx, 1
call fcn.10003c3c0
xor edi, edi
mov dword [rsp + 0x198], edi
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov rdx, r12
lea rcx, [rsp + 0x40]
call fcn.10001ff10
nop
lea r8, [rsp + 0x198]
mov rdx, rax
mov ecx, r15d
call fcn.10005da84
cmp eax, edi
je 0x10005e1ea
mov r8d, eax
lea rdx, [0x100013a70]
lea ecx, [rdi + 3]
call fcn.10003c3c0
mov ebp, edi
jmp 0x10005e5c0
mov ebp, 1
cmp dword [rsp + 0x198], edi
je 0x10005e20f
mov dword [r14], ebp
jmp 0x10005e20f
mov r12, qword [rsp + 0x180]
jmp 0x10005e20f
mov r12, qword [rsp + 0x180]
cmp qword [rsp + 0x108], rdi
je 0x10005e5c0
lea rcx, [rsp + 0x30]
call fcn.10001fee0
nop
mov rbx, qword [rsp + 0xf8]
cmp rbx, rdi
je 0x10005e3e0
mov r13, qword [rsp + 0x190]
mov r14d, 3
lea rcx, [rsp + 0x190]
call fcn.10001fee0
nop
mov eax, edi
cmp rbx, rdi
setne al
cmp eax, edi
je 0x10005e3d5
mov rdx, rbx
mov rbx, qword [rbx]
add rdx, 0x10
lea rcx, [rsp + 0x190]
call fcn.10001ecdc
lea rdx, [rsp + 0x190]
mov rcx, r13
call fcn.100044e98
lea rcx, [rsp + 0xc8]
call fcn.100019218
nop
lea rax, [rsp + 0x40]
mov qword [rsp + 0x90], rax
lea rdx, [rsp + 0x190]
lea rcx, [rsp + 0x40]
call fcn.10001ff10
nop
mov r8d, r14d
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.100045100
lea rdx, [rsp + 0xc8]
cmp rdx, rdi
jne 0x10005e2e4
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x10005e2fb
lea r8, [rsp + 0xc8]
mov edx, 0xa
lea rcx, [rsp + 0x50]
call fcn.10004584c
cmp dword [rsp + 0x78], edi
je 0x10005e30b
lea rcx, [rsp + 0x50]
call fcn.100045390
mov rsi, qword [rsp + 0xc8]
cmp rsi, rdi
je 0x10005e3a5
lea rcx, [rsp + 0x38]
call fcn.10001fee0
nop
mov eax, edi
cmp rsi, rdi
setne al
cmp eax, edi
je 0x10005e3ca
mov rdx, rsi
mov rsi, qword [rsi]
add rdx, 0x10
lea rcx, [rsp + 0x38]
call fcn.10001ecdc
mov rdx, qword [rsp + 0x38]
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x30]
call fcn.10001fa30
cmp rsi, rdi
jne 0x10005e368
cmp rbx, rdi
je 0x10005e392
xor eax, eax
lea rcx, [rax - 1]
lea rdi, [0x10001209c]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [0x10001209c]
lea rcx, [rsp + 0x30]
call fcn.10001fa30
xor edi, edi
lea rcx, [rsp + 0x38]
call fcn.10001fba0
cmp rsi, rdi
jne 0x10005e31c
lea rcx, [rsp + 0xc8]
call fcn.10001f53c
nop
lea rcx, [rsp + 0x190]
call fcn.10001fba0
cmp rbx, rdi
je 0x10005e3ee
jmp 0x10005e247
mov ecx, 0x80004005
call fcn.10001fd10
nop
mov ecx, 0x80004005
call fcn.10001fd10
nop
mov r13, qword [rsp + 0x190]
mov r14d, 3
mov r8, qword [rsp + 0x30]
cmp dword [r8 - 0x10], edi
jle 0x10005e408
lea rdx, [0x1000120b0]
mov ecx, r14d
call fcn.10003c3c0
mov qword [rsp + 0x198], rdi
lea rcx, [rsp + 0x40]
call fcn.10001fee0
nop
lea rcx, [rsp + 0x38]
call fcn.10001fee0
nop
lea rdx, [0x100012840]
lea rcx, [rsp + 0x190]
call fcn.10001ff98
nop
lea r8, [rsp + 0x40]
mov rdx, r12
lea rcx, [rsp + 0x190]
call fcn.1000327cc
nop
lea rcx, [rsp + 0x190]
call fcn.10001fba0
lea rdx, [0x100012770]
lea rcx, [rsp + 0x190]
call fcn.10001ff98
nop
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x190]
lea rcx, [rsp + 0x40]
call fcn.1000327cc
nop
lea rcx, [rsp + 0x190]
call fcn.10001fba0
lea rdx, [rsp + 0x198]
mov qword [rsp + 0x20], rdx
mov r9d, 0x2001f
xor r8d, r8d
mov rdx, qword [rsp + 0x38]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x10005e582
cmp qword [r13 + 0x10], rdi
je 0x10005e548
lea rdx, [rsp + 0x190]
mov rcx, r13
call fcn.100034e1c
mov rdi, rax
test rax, rax
je 0x10005e535
mov eax, dword [rsp + 0x190]
add eax, eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
mov r9d, 7
xor r8d, r8d
lea rdx, [0x1000107a0]
mov rcx, qword [rsp + 0x198]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x10005e52b
xor ebp, ebp
lea rdx, [0x100012230]
mov ecx, r14d
call fcn.10003c3c0
mov rcx, rdi
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
jmp 0x10005e572
xor ebp, ebp
lea rdx, [0x100012230]
mov ecx, r14d
call fcn.10003c3c0
jmp 0x10005e572
lea rdx, [0x1000107a0]
mov rcx, qword [rsp + 0x198]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp eax, edi
je 0x10005e572
mov ebp, edi
lea rdx, [0x100012230]
mov ecx, r14d
call fcn.10003c3c0
mov rcx, qword [rsp + 0x198]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10005e599
cmp eax, 2
je 0x10005e599
mov ebp, edi
lea rdx, [0x100012230]
mov ecx, r14d
call fcn.10003c3c0
nop
lea rcx, [rsp + 0x38]
call fcn.10001fba0
nop
lea rcx, [rsp + 0x40]
call fcn.10001fba0
nop
lea rcx, [rsp + 0x30]
call fcn.10001fba0
jmp 0x10005e5c0
mov ebp, 1
lea rcx, [rsp + 0x98]
call fcn.10001f53c
nop
lea rcx, [rsp + 0xf8]
call fcn.10001f53c
nop
lea rcx, [rsp + 0x48]
call fcn.10001fba0
nop
lea rcx, [rsp + 0x50]
call fcn.10004504c
nop
mov rcx, r12
call fcn.10001fba0
mov eax, ebp
add rsp, 0x138
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret