Function at 0x14001d5f0
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push rbp
push rbx
push rdi
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140073058]
xor rax, rsp
mov qword [rbp - 8], rax
cmp dword [rcx + 4], 5
mov rbx, rcx
movzx edi, dl
jl 0x14001d61c
mov al, 1
jmp 0x14001d882
lea rax, [rbp - 0x20]
mov qword [rsp + 0xa0], rsi
xor esi, esi
mov qword [rsp + 0x28], rax
xor r9d, r9d
mov dword [rsp + 0x20], esi
xor r8d, r8d
lea edx, [rsi + 3]
call fcn.1400191f0
test al, al
je 0x14001d878
mov edx, dword [rbp - 0x20]
mov rcx, rbx
call fcn.140019310
test dil, dil
je 0x14001d669
xor edx, edx
lea r8d, [rsi + 0xf]
call fcn.14001b840
jmp 0x14001d71e
lea rax, [rbp - 0x18]
mov qword [rbp - 0x18], rsi
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rbp - 0x10], rsi
lea rdx, str.SYSTEMCurrentControlSetServicesLITSSVCICMMC
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001d869
mov rcx, qword [rbp - 0x18]
lea rax, [rbp - 0xc]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x10]
xor r8d, r8d
mov qword [rsp + 0x20], rsi
lea rdx, str.CurrentSetting
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001d869
mov rcx, qword [rbp - 0x18]
lea rax, [rbp - 0xc]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x10]
lea rax, [rbp - 0x20]
xor r8d, r8d
lea rdx, str.CurrentSetting
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001d869
cmp dword [rbp - 0x20], esi
jne 0x14001d70f
lea r8d, [rax + 2]
mov dl, 1
call fcn.14001b840
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x14001d71e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [rbx], sil
je 0x14001d7ba
mov qword [rsp + 0x40], rsi
lea rax, [rbp - 0x18]
mov qword [rsp + 0x38], rax
lea rdx, str.SYSTEMCurrentControlSetServicesLITSSVCICCQL
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], 0x20006
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], esi
mov qword [rbp - 0x18], rsi
mov qword [rbp - 0x10], rsi
mov dword [rbp - 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x14001d773
xor bl, bl
jmp 0x14001d7a3
mov rcx, qword [rbp - 0x18]
lea rax, [rbp - 0x20]
mov dword [rsp + 0x28], 4
lea rdx, str.CurrentSetting
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete bl
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x14001d7b2
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, bl
jmp 0x14001d87a
cmp byte [rbx + 9], sil
je 0x14001d7d0
movzx edx, dil
call fcn.140019630
mov al, 1
jmp 0x14001d87a
cmp byte [rbx + 0xa], sil
je 0x14001d878
mov qword [rsp + 0x40], rsi
lea rax, [rbp - 0x18]
mov qword [rsp + 0x38], rax
lea rdx, str.SYSTEMCurrentControlSetServicesLITSSVCICTIO
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], 0x20006
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], esi
mov qword [rbp - 0x18], rsi
mov qword [rbp - 0x10], rsi
mov dword [rbp - 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14001d856
mov rcx, qword [rbp - 0x18]
lea rax, [rbp - 0x20]
mov dword [rsp + 0x28], 4
lea rdx, str.CurrentSetting
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14001d856
call fcn.140019d30
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x14001d865
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x14001d87a
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x14001d878
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14002a740
add rsp, 0x70
pop rdi
pop rbx
pop rbp
ret