Function at 0x14001c2a0
Capabilities:
Create thread
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xf0
mov rax, qword [0x140073058]
xor rax, rsp
mov qword [rbp + 0x47], rax
xor r9d, r9d
mov rbx, rcx
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov qword [rbx + 0xb0], rax
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov qword [rbx + 0xb8], rax
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov qword [rbx + 0xc0], rax
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov qword [0x140075e38], rax
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rcx, qword [rbx + 0xb0]
mov qword [rbp + 0x1f], rcx
mov rcx, qword [rbx + 0xb8]
mov qword [rbp + 0x27], rcx
mov rcx, qword [rbx + 0xc0]
mov qword [rbp + 0x2f], rcx
mov rcx, qword [0x140075e38]
mov qword [0x140075e30], rax
mov qword [rbp + 0x3f], rax
lea rax, [rbp + 0x1f]
mov qword [rbp + 0x37], rcx
cmp qword [rax], 0
je 0x14001caab
add rax, 8
lea rcx, [rbp + 0x47]
cmp rax, rcx
jne 0x14001c374
lea rax, [rbp - 0x49]
mov qword [rsp + 0x108], rsi
mov qword [rsp + 0x110], rdi
lea rdx, str.SYSTEMCurrentControlSetServicesIBMPMSVCParameters2Type10Notification
xor edi, edi
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rbp - 0x19], rdi
mov rcx, 0xffffffff80000002
mov qword [rbp - 0x11], rdi
mov qword [rbp - 0x29], rdi
lea r9d, [rdi + 0x11]
mov qword [rbp - 0x21], rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001ca62
lea rax, [rbp - 0x41]
xor r8d, r8d
lea r9d, [rdi + 0x11]
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMCurrentControlSetServicesIBMPMSVCParameters2Type20Notification
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001ca62
lea rax, [rbp - 0x19]
mov dword [rbp - 9], edi
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetServicesIBMPMSVCParameters2Type10Notification
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001c518
mov rcx, qword [rbp - 0x19]
lea rax, [rbp - 0xd]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x11]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
lea rdx, str.Type13
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001c518
mov rcx, qword [rbp - 0x19]
lea rax, [rbp - 0xd]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x11]
lea rax, [rbp - 5]
xor r8d, r8d
lea rdx, str.Type13
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001c518
lea rax, [rbp - 0x29]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMCurrentControlSetServicesIBMPMSVCParameters2Type20Notification
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001c518
mov rcx, qword [rbp - 0x29]
lea rax, [rbp - 0x1d]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x21]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
lea rdx, str.Type22
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001c518
mov rcx, qword [rbp - 0x29]
lea rax, [rbp - 0x1d]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x21]
lea rax, [rbp - 9]
xor r8d, r8d
lea rdx, str.Type22
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14001c525
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
call fcn.1400356bc
mov r9, qword [rbp + 0x27]
xor edx, edx
mov rcx, qword [rbp - 0x49]
mov dword [rsp + 0x20], 1
lea r8d, [rdx + 4]
call qword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
test eax, eax
jne 0x14001ca62
lea rsi, [0x140075ed4]
mov r9, qword [rbp + 0x2f]
xor edx, edx
mov rcx, qword [rbp - 0x41]
mov dword [rsp + 0x20], 1
lea r8d, [rdx + 4]
call qword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
test eax, eax
jne 0x14001ca62
mov r9d, 0xffffffff
lea rdx, [rbp + 0x1f]
xor r8d, r8d
lea ecx, [rax + 5]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
test eax, eax
je 0x14001ca9f
sub eax, 1
je 0x14001c86a
sub eax, 1
je 0x14001c6ce
sub eax, 1
je 0x14001c60e
cmp eax, 1
jne 0x14001ca68
xor edx, edx
mov rcx, rbx
call fcn.14001c110
mov rcx, qword [0x140075ec0]
test rcx, rcx
je 0x14001c5ce
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [0x140075e70]
test rcx, rcx
je 0x14001c5f9
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [0x140075e70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x140075e70], rdi
mov rcx, qword [rbp + 0x3f]
mov dword [0x140075ed4], edi
call qword [sym.imp.KERNEL32.dll_ResetEvent]
jmp 0x14001ca3e
lea rax, [rbp - 1]
mov dword [rbp - 0x39], edi
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rbp - 1], rdi
lea rdx, str.SYSTEMCurrentControlSetServicesLITSSVCICAMT
mov qword [rbp + 7], rdi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001c6ac
mov rcx, qword [rbp - 1]
lea rax, [rbp + 0xb]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 7]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
lea rdx, str.CurrentSetting
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001c6ac
mov rcx, qword [rbp - 1]
lea rax, [rbp + 0xb]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 7]
lea rax, [rbp - 0x39]
xor r8d, r8d
lea rdx, str.CurrentSetting
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001c6ac
cmp dword [rbp - 0x39], 1
je 0x14001c6ac
lea edx, [rax + 1]
mov rcx, rbx
call fcn.14001c110
mov rcx, qword [rbp + 0x37]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, qword [rbp - 1]
test rcx, rcx
je 0x14001ca3e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14001ca3e
lea rax, [rbp - 0x29]
mov dword [rbp - 0x39], edi
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetServicesIBMPMSVCParameters2Type20Notification
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001ca38
mov rcx, qword [rbp - 0x29]
lea rax, [rbp - 0x1d]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x21]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
lea rdx, str.Type22
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001ca38
mov rcx, qword [rbp - 0x29]
lea rax, [rbp - 0x1d]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x21]
lea rax, [rbp - 0x39]
xor r8d, r8d
lea rdx, str.Type22
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001ca38
mov edx, dword [rbp - 9]
mov eax, edx
mov ecx, dword [rbp - 0x39]
shr eax, 0x17
shr ecx, 0x17
xor cl, al
test cl, 1
je 0x14001c803
cmp qword [0x140075ec0], rdi
jne 0x14001c855
cmp dword [0x140075ed4], edi
jne 0x14001c855
lea rcx, [rbp - 0x31]
mov dword [rbp - 0x31], edi
call fcn.1400241f0
test eax, eax
je 0x14001c7ab
cmp dword [rbp - 0x31], 2
jae 0x14001c855
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x140075ec0], rax
test rax, rax
je 0x14001c855
mov qword [rsp + 0x28], rsi
lea r8, [0x1400240b0]
xor r9d, r9d
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call fcn.1400355e8
mov rcx, qword [rbp + 0x2f]
mov qword [0x140075e70], rax
mov eax, dword [rbp - 0x39]
mov dword [rbp - 9], eax
call qword [sym.imp.KERNEL32.dll_ResetEvent]
jmp 0x14001ca3e
mov eax, dword [rbp - 0x39]
shr eax, 0x18
shr edx, 0x18
xor al, dl
test al, 1
je 0x14001c855
mov rcx, qword [0x140075ec0]
test rcx, rcx
je 0x14001c824
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [0x140075e70]
test rcx, rcx
je 0x14001c84f
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [0x140075e70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x140075e70], rdi
mov dword [0x140075ed4], edi
mov eax, dword [rbp - 0x39]
mov rcx, qword [rbp + 0x2f]
mov dword [rbp - 9], eax
call qword [sym.imp.KERNEL32.dll_ResetEvent]
jmp 0x14001ca3e
lea rax, [rbp - 0x19]
mov dword [rbp - 0x39], edi
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetServicesIBMPMSVCParameters2Type10Notification
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001ca38
mov rcx, qword [rbp - 0x19]
lea rax, [rbp - 0xd]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x11]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
lea rdx, str.Type13
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001ca38
mov rcx, qword [rbp - 0x19]
lea rax, [rbp - 0xd]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x11]
lea rax, [rbp - 0x39]
xor r8d, r8d
lea rdx, str.Type13
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001ca38
mov ecx, dword [rbp - 0x39]
mov eax, dword [rbp - 5]
shr ecx, 0x19
shr eax, 0x19
xor cl, al
test cl, 1
je 0x14001ca15
movzx ecx, byte [rbx + 0x54]
lea rdx, str.SYSTEMCurrentControlSetServicesLITSSVCICAMT
test cl, cl
mov qword [rsp + 0x40], rdi
mov qword [rbp + 0xf], rdi
sete al
mov qword [rbp + 0x17], rdi
mov byte [rbx + 0x54], al
neg cl
mov rcx, 0xffffffff80000002
sbb eax, eax
xor r9d, r9d
add eax, 2
xor r8d, r8d
mov dword [rbp - 0x31], eax
lea rax, [rbp + 0xf]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14001ca27
mov rcx, qword [rbp + 0xf]
lea rax, [rbp - 0x31]
mov dword [rsp + 0x28], 4
lea rdx, str.CurrentSetting
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14001ca27
mov rcx, rbx
call fcn.14001bea0
mov rcx, qword [0x140075db0]
test rcx, rcx
je 0x14001c9be
call qword [sym.imp.KERNEL32.dll_SetEvent]
cmp dword [rbx + 0x50], edi
jne 0x14001ca06
mov rcx, qword [0x140075ec0]
test rcx, rcx
je 0x14001c9d5
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [0x140075e70]
test rcx, rcx
je 0x14001ca00
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [0x140075e70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x140075e70], rdi
mov dword [0x140075ed4], edi
mov rcx, qword [rbp + 0xf]
test rcx, rcx
je 0x14001ca15
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rbp - 0x39]
mov rcx, qword [rbp + 0x27]
mov dword [rbp - 5], eax
call qword [sym.imp.KERNEL32.dll_ResetEvent]
jmp 0x14001ca3e
mov rcx, qword [rbp + 0xf]
test rcx, rcx
je 0x14001ca3e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14001ca3e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9, qword [rbp + 0x27]
xor edx, edx
mov rcx, qword [rbp - 0x49]
mov dword [rsp + 0x20], 1
lea r8d, [rdx + 4]
call qword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
test eax, eax
je 0x14001c550
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
call fcn.1400356bc
mov rcx, qword [rbp - 0x29]
mov rdi, qword [rsp + 0x110]
mov rsi, qword [rsp + 0x108]
test rcx, rcx
je 0x14001ca8e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x14001cab2
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14001cab2
mov rcx, qword [rbp + 0x1f]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
jmp 0x14001ca68
xor ecx, ecx
call fcn.1400356bc
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.14002a740
mov rbx, qword [rsp + 0x118]
add rsp, 0xf0
pop rbp
ret