Function at 0x1400098a0
Capabilities:
Persist via windows service
Set registry value

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
mov qword [rbp - 9], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x20], rsi
mov rbx, rcx
mov qword [rbp + 0x77], 0
lea rcx, [rbp + 0x17]
call fcn.140005570
nop
lea rdx, [rbp + 0x17]
mov rcx, qword [0x14005d6c0]
call fcn.14000d260
test eax, eax
jne 0x140009910
mov edx, 0x999
lea rcx, str.MTR_GetCfgPathFromMRC_FAILED____u__
call fcn.140008040
nop
lea rcx, [rbp + 0x17]
call fcn.140005690
mov eax, 0x10000005
jmp 0x140009c94
lea rcx, [rbp + 0x17]
call fcn.140005920
mov rcx, rax
call fcn.14000cff0
mov rsi, rax
test rax, rax
jne 0x14000995b
lea rcx, [rbp + 0x17]
call fcn.140005920
mov rdx, rax
mov r8d, 0x9a3
lea rcx, str.LogicalToDevicePathEx_of__s_FAILED____u__
call fcn.140008040
nop
lea rcx, [rbp + 0x17]
call fcn.140005690
mov eax, 0x10000006
jmp 0x140009c94
lea rcx, [rbp + 0x17]
call fcn.140005690
lea rcx, [rbp + 0x2f]
call fcn.140005570
nop
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
lea edx, [rcx + rcx + 0x44]
lea rcx, [rbp + 0x2f]
call fcn.140005a30
test eax, eax
jne 0x1400099c9
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
lea edx, [rcx + 0x22]
add rdx, rdx
mov r8d, 0x9b1
lea rcx, str.SetSize_of__u_FAILED____u__
call fcn.140008040
nop
lea rcx, [rbp + 0x2f]
call fcn.140005690
mov eax, 8
jmp 0x140009c94
lea rcx, [rbp + 0x2f]
call fcn.140005920
mov r12, rax
lea rdx, str.SYSTEMCurrentControlSetServices_
sub rax, rdx
nop
movzx ecx, word [rdx]
mov word [rax + rdx], cx
add rdx, 2
test cx, cx
jne 0x1400099e0
mov rdi, r12
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
xor ecx, ecx
nop
movzx eax, word [rbx + rcx]
mov word [rdi + rcx - 2], ax
add rcx, 2
test ax, ax
jne 0x140009a00
lea rax, [rbp + 0x77]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
mov rdx, r12
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140009a92
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x77]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, r12
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ebx, eax
test eax, eax
je 0x140009a92
mov edx, eax
lea rcx, str.FAILED_to_open_RegKey___error__x__
call fcn.140008040
jmp 0x140009c5b
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
lea eax, [rcx + rcx]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
mov r9d, 1
xor r8d, r8d
lea rdx, str.InstallPath
mov rcx, qword [rbp + 0x77]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
test eax, eax
je 0x140009ae0
mov edx, eax
lea rcx, str.FAILED_to_set_RegKey_value___error__x__
call fcn.140008040
jmp 0x140009c5b
mov rdx, rsi
lea rcx, str.RegKey_set_to__s
call fcn.140008040
mov dword [rsp + 0x28], 0xe
lea rax, str.avfwim
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.IMName
mov rcx, qword [rbp + 0x77]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
test eax, eax
je 0x140009b36
mov edx, eax
lea rcx, str.FAILED_to_set_RegKey_value___error__x__
call fcn.140008040
jmp 0x140009c5b
lea rcx, [rbp - 1]
call fcn.140005570
nop
call fcn.14000de00
mov rdx, rax
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx + rcx]
lea rcx, [rbp - 1]
call fcn.140005b00
lea rcx, [rbp - 1]
call fcn.140005920
test rax, rax
jne 0x140009b8c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Path_FindWindowsDirectory_FAILED___error__x__
call fcn.140008040
nop
jmp 0x140009c52
lea rcx, [rbp - 1]
call fcn.140005930
lea edx, [rax + 8]
lea rcx, [rbp - 1]
call fcn.1400056b0
lea rcx, [rbp - 1]
call fcn.140005920
mov rdi, rax
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
not rcx
lea rbx, [rcx + rcx]
lea rcx, [rbp - 1]
call fcn.140005920
mov rdi, rax
lea rcx, [rbp - 1]
call fcn.140005920
mov r8, rbx
mov rdx, rdi
lea rcx, [rax + 8]
call fcn.14001cd80
lea rcx, [rbp - 1]
call fcn.140005920
mov rcx, qword [0x14004db30]
mov qword [rax], rcx
lea rcx, [rbp - 1]
call fcn.140005920
mov rdi, rax
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
not rcx
lea edi, [rcx + rcx]
lea rcx, [rbp - 1]
call fcn.140005920
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.WinDir
mov rcx, qword [rbp + 0x77]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
test eax, eax
je 0x140009c52
mov edx, eax
lea rcx, str.FAILED_to_set_RegKey_value___error__x__
call fcn.140008040
nop
jmp 0x140009c52
lea rcx, [rbp - 1]
call fcn.140005690
mov r8d, ebx
lea rdx, str.ConfigureRegs
lea rcx, str._ws_SUCCESS___error_code__x__
call fcn.140008040
mov rcx, qword [rbp + 0x77]
test rcx, rcx
je 0x140009c80
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rsi
call fcn.14001ccf0
nop
lea rcx, [rbp + 0x2f]
call fcn.140005690
mov eax, ebx
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rbp
ret