Function at 0x18003b770
Capabilities:
Delete registry key
Persist via windows service
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x268]
sub rsp, 0x340
mov rax, qword [0x18008a480]
xor rax, rsp
mov qword [rbp + 0x230], rax
xor r15d, r15d
mov rdi, rdx
lea r12d, [r15 + 1]
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x58], r15
mov r14d, r15d
mov esi, r15d
mov qword [rsp + 0x68], r15
cmp ecx, r12d
jne 0x18004a76b
test rdx, rdx
je 0x18004a85f
xor edx, edx
mov rcx, rdi
mov dword [rsp + 0x50], r15d
call sym.DNSAPI.dll_DnsValidateName_W
mov ebx, eax
test eax, eax
jne 0x18004a6df
lea rcx, [rbp + 0x32]
mov ebx, 0x2e
mov r8, rdi
mov edx, 0x1fc
mov word [rbp + 0x30], bx
call fcn.18000d150
test eax, eax
js 0x18004a6f0
mov edi, 0x100
lea rcx, [rbp + 0x30]
mov eax, edi
cmp word [rcx], r15w
je 0x18003b82d
add rcx, 2
sub rax, r12
jne 0x18003b81e
test rax, rax
je 0x18004a6f0
sub rdi, rax
add rdi, rdi
mov rax, rdi
shr rax, 1
cmp rax, r12
jbe 0x18003b852
cmp word [rbp + rax*2 + 0x2e], bx
je 0x18004a6fb
mov rax, rdi
mov ecx, 0x200
shr rax, 1
add rax, rax
cmp rax, rcx
jae 0x18004a765
mov word [rbp + rax + 0x30], r15w
add rax, 2
cmp rax, rcx
jae 0x18004a75f
lea r9, [rbp - 0x80]
lea r8, [rsp + 0x68]
lea rcx, [rbp + 0x30]
mov r13d, 4
xor edx, edx
mov word [rbp + rax + 0x30], r15w
add rdi, r13
call sym.DNSAPI.dll_DnsGetPolicyTableInfo
mov rsi, qword [rsp + 0x68]
mov ebx, eax
cmp eax, 0x2564
je 0x18003babc
test eax, eax
je 0x18004a705
lea rcx, [rsp + 0x70]
call qword [sym.imp.RPCRT4.dll_UuidCreate]
test eax, eax
jne 0x18004a737
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x70]
call fcn.1800320c0
test eax, eax
je 0x18004a737
mov qword [rsp + 0x40], r15
lea rax, [rsp + 0x60]
lea rdx, [0x180035610]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], r12d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
mov ebx, eax
test eax, eax
jne 0x18003babc
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x40], r15
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
lea rdx, [rbp - 0x70]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], r12d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
mov ebx, eax
test eax, eax
jne 0x18003babc
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x18003bcf0]
mov r9d, r13d
xor r8d, r8d
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x50], r12d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov ebx, eax
test eax, eax
jne 0x18004a754
mov rcx, qword [rsp + 0x58]
lea rax, [rbp + 0x30]
lea rdx, [0x18003bcb8]
mov r9d, 7
xor r8d, r8d
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov ebx, eax
test eax, eax
jne 0x18004a754
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x18003bcc8]
mov r9d, r12d
xor r8d, r8d
mov dword [rsp + 0x28], 2
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x50], r15d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov ebx, eax
test eax, eax
jne 0x18004a754
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x18003bc88]
mov r9d, r13d
xor r8d, r8d
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x50], 2
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov ebx, eax
test eax, eax
jne 0x18004a754
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x18003bc98]
mov r9d, r13d
xor r8d, r8d
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x50], socket
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov ebx, eax
test eax, eax
jne 0x18004a754
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, [0x18003bf48]
mov r9d, r13d
xor r8d, r8d
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x50], r15d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov ebx, eax
test eax, eax
jne 0x18004a75d
xor edx, edx
xor ecx, ecx
call sym.DNSAPI.dll_DnsNotifyResolver
jmp 0x18003babc
test rsi, rsi
jne 0x18004a86a
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x18003bad5
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test r14d, r14d
jne 0x18004a879
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x18003baee
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rbp + 0x230]
xor rcx, rsp
call fcn.180001000
lea r11, [rsp + 0x340]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
cmp eax, 0x2554
je 0x18003b7f1
jmp 0x18003bac5
mov ebx, 0x7b
jmp 0x18003bac5
sub rdi, 2
jmp 0x18003b852
mov rbx, rsi
test rsi, rsi
je 0x18003b8b9
mov rdx, qword [rbx]
lea rcx, [rbp + 0x30]
call fcn.1800738b8
test eax, eax
jne 0x18004a727
test byte [rbx + 0x6c], 0x10
jne 0x18004a741
mov rbx, qword [rbx + 0x70]
test rbx, rbx
je 0x18003b8b9
jmp 0x18004a711
mov ebx, 8
jmp 0x18003babc
mov eax, dword [rbx + 0x68]
neg eax
sbb ebx, ebx
and ebx, 0x1392
jmp 0x18003babc
mov r14d, r12d
jmp 0x18003babc
jmp 0x18004a754
call fcn.18004d94c
int3
call fcn.18004d94c
int3
cmp ecx, 2
jne 0x18004a85f
lea rax, [rsp + 0x60]
lea rdx, [0x180035610]
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
je 0x18004a7a7
mov ebx, r15d
jmp 0x18003bac5
mov edi, r15d
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
lea r9, [rsp + 0x50]
lea r8, [rbp - 0x70]
mov edx, edi
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x50], 0x50
mov qword [rsp + 0x20], r15
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
mov ebx, eax
cmp eax, 0x103
je 0x18004a856
cmp eax, 0xea
je 0x18004a842
test eax, eax
jne 0x18003bac5
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x30], r15
lea r8, [0x18003bcf0]
lea rdx, [rbp - 0x70]
mov r9d, 0xffff
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
mov ebx, eax
test eax, eax
jne 0x18004a842
mov rcx, qword [rsp + 0x60]
lea rdx, [rbp - 0x70]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteKeyExW]
mov ebx, eax
test eax, eax
jne 0x18004a842
dec edi
add edi, r12d
cmp edi, 0x3e8
jb 0x18004a7aa
jmp 0x18003bab0
mov ebx, r15d
jmp 0x18003bab0
mov ebx, 0x57
jmp 0x18003babc
mov rcx, rsi
call sym.DNSAPI.dll_DnsFreePolicyConfig
nop
jmp 0x18003bac5
mov rcx, qword [rsp + 0x60]
lea rdx, [rbp - 0x70]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteKeyExW]
nop
jmp 0x18003bade