Function at 0x24af0
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x620
xor eax, eax
xor ebx, ebx
lea rcx, [rsp + 0x202]
xor edx, edx
mov r8d, 0x206
mov dword [rsp + 0x650], 1
mov word [rsp + 0x50], bx
mov qword [rsp + 0x52], rax
mov dword [rsp + 0x5a], eax
mov word [rsp + 0x5e], ax
mov word [rsp + 0x40], bx
mov qword [rsp + 0x42], rax
mov dword [rsp + 0x4a], eax
mov word [rsp + 0x4e], ax
mov word [rsp + 0x200], bx
call fcn.0002b7b0
lea rcx, [rsp + 0x412]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x410], bx
call fcn.0002b7b0
cmp dword [0x0002f224], 5
lea rbp, [0x0002f0a0]
mov esi, 0x104
mov r9, rbp
lea rcx, [rsp + 0x200]
mov rdx, rsi
lea r8, [0x00011ea0]
jbe 0x24b9e
lea r8, [0x00011f00]
call fcn.00023ef0
lea r8, [0x00011f60]
lea rcx, [rsp + 0x410]
mov r9, rbp
mov rdx, rsi
call fcn.00023ef0
lea rdx, [rsp + 0x410]
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rdx, [0x000118e0]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbp
lea rdx, [rsp + 0x40]
mov r9, rbp
repne scasw ax, word [rdi]
mov r8d, 1
not rcx
lea eax, [rcx + rcx]
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x20], eax
call fcn.0001bb40
lea rdx, [0x00011928]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
xor eax, eax
lea rcx, [0x0002f2a8]
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xc8], rax
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0xd8], rax
lea rax, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xa8], rbx
mov dword [rsp + 0x658], ebx
mov dword [rsp + 0xb0], 0x30
mov qword [rsp + 0xb8], rbx
mov dword [rsp + 0xc8], 0x240
mov qword [rsp + 0xd0], rbx
mov qword [rsp + 0xd8], rbx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
mov rdx, qword [0x0002f2c0]
test rdx, rdx
je 0x24cc6
mov eax, ebx
xchg dword [rdx], eax
mov dword [0x0002f2c8], eax
lea rax, [rsp + 0x658]
lea r8, [rsp + 0xb0]
lea rcx, [rsp + 0xa8]
mov qword [rsp + 0x30], rax
xor r9d, r9d
mov edx, 0xf003f
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ntoskrnl.exe_ZwCreateKey]
mov rdx, qword [0x0002f2c0]
mov edi, eax
test rdx, rdx
je 0x24d10
mov ecx, dword [0x0002f2c8]
xchg dword [rdx], ecx
lea rcx, [0x0002f2a8]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_KeSetEvent]
test edi, edi
js 0x24dc2
mov rdi, qword [rsp + 0xa8]
lea rcx, [0x0002f2a8]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
mov rdx, qword [0x0002f2c0]
test rdx, rdx
je 0x24d62
mov eax, ebx
xchg dword [rdx], eax
mov dword [0x0002f2c8], eax
lea rax, [rsp + 0x650]
lea rdx, [rsp + 0x40]
mov r9d, 4
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov rdx, qword [0x0002f2c0]
test rdx, rdx
je 0x24da2
mov eax, dword [0x0002f2c8]
xchg dword [rdx], eax
lea rcx, [0x0002f2a8]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_KeSetEvent]
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
lea rdx, [0x00011910]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
xor eax, eax
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x1a8], rax
mov qword [rsp + 0x1b0], rax
mov qword [rsp + 0x1b8], rax
mov qword [rsp + 0x1c0], rax
mov qword [rsp + 0x1c8], rax
lea rdi, [rsp + 0x200]
repne scasw ax, word [rdi]
lea rax, [rsp + 0x50]
xor r9d, r9d
not rcx
xor r8d, r8d
xor edx, edx
lea r12d, [rcx + rcx]
lea rcx, [0x0002f2a8]
mov qword [rsp + 0x90], rbx
mov dword [rsp + 0x660], ebx
mov dword [rsp + 0x1a0], 0x30
mov qword [rsp + 0x1a8], rbx
mov dword [rsp + 0x1b8], 0x240
mov qword [rsp + 0x1b0], rax
mov qword [rsp + 0x1c0], rbx
mov qword [rsp + 0x1c8], rbx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
mov rdx, qword [0x0002f2c0]
test rdx, rdx
je 0x24e8e
mov eax, ebx
xchg dword [rdx], eax
mov dword [0x0002f2c8], eax
lea rax, [rsp + 0x660]
lea r8, [rsp + 0x1a0]
lea rcx, [rsp + 0x90]
mov qword [rsp + 0x30], rax
xor r9d, r9d
mov edx, 0xf003f
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ntoskrnl.exe_ZwCreateKey]
mov rdx, qword [0x0002f2c0]
mov edi, eax
test rdx, rdx
je 0x24ed8
mov ecx, dword [0x0002f2c8]
xchg dword [rdx], ecx
lea rcx, [0x0002f2a8]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_KeSetEvent]
test edi, edi
js 0x24f87
mov rdi, qword [rsp + 0x90]
lea rcx, [0x0002f2a8]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
mov rdx, qword [0x0002f2c0]
test rdx, rdx
je 0x24f2a
mov eax, ebx
xchg dword [rdx], eax
mov dword [0x0002f2c8], eax
lea rax, [rsp + 0x200]
lea rdx, [rsp + 0x40]
mov r9d, 2
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov rdx, qword [0x0002f2c0]
test rdx, rdx
je 0x24f67
mov eax, dword [0x0002f2c8]
xchg dword [rdx], eax
lea rcx, [0x0002f2a8]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_KeSetEvent]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
lea rdx, [0x00011fd0]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea r9, [0x00011fe8]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
mov r8d, 1
mov dword [rsp + 0x20], 0x1a
call fcn.0001bb40
lea rdx, [0x00011948]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
xor eax, eax
lea rcx, [0x0002f2a8]
mov qword [rsp + 0x148], rax
mov qword [rsp + 0x150], rax
mov qword [rsp + 0x158], rax
mov qword [rsp + 0x160], rax
mov qword [rsp + 0x168], rax
lea rax, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x150], rax
mov dword [rsp + 0x650], 2
mov qword [rsp + 0x80], rbx
mov dword [rsp + 0x668], ebx
mov dword [rsp + 0x140], 0x30
mov qword [rsp + 0x148], rbx
mov dword [rsp + 0x158], 0x240
mov qword [rsp + 0x160], rbx
mov qword [rsp + 0x168], rbx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
mov rdx, qword [0x0002f2c0]
test rdx, rdx
je 0x2507e
mov eax, ebx
xchg dword [rdx], eax
mov dword [0x0002f2c8], eax
lea rax, [rsp + 0x668]
lea r8, [rsp + 0x140]
lea rcx, [rsp + 0x80]
mov qword [rsp + 0x30], rax
xor r9d, r9d
mov edx, 0xf003f
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ntoskrnl.exe_ZwCreateKey]
mov rdx, qword [0x0002f2c0]
mov edi, eax
test rdx, rdx
je 0x250c8
mov ecx, dword [0x0002f2c8]
xchg dword [rdx], ecx
lea rcx, [0x0002f2a8]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_KeSetEvent]
test edi, edi
js 0x2517a
mov rdi, qword [rsp + 0x80]
lea rcx, [0x0002f2a8]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
mov rdx, qword [0x0002f2c0]
test rdx, rdx
je 0x2511a
mov eax, ebx
xchg dword [rdx], eax
mov dword [0x0002f2c8], eax
lea rax, [rsp + 0x650]
lea rdx, [rsp + 0x40]
mov r9d, 4
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov rdx, qword [0x0002f2c0]
test rdx, rdx
je 0x2515a
mov eax, dword [0x0002f2c8]
xchg dword [rdx], eax
lea rcx, [0x0002f2a8]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_KeSetEvent]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
lea rdx, [0x00011958]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
xor eax, eax
lea rcx, [0x0002f2a8]
mov qword [rsp + 0x1d8], rax
mov qword [rsp + 0x1e0], rax
mov qword [rsp + 0x1e8], rax
mov qword [rsp + 0x1f0], rax
mov qword [rsp + 0x1f8], rax
lea rax, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x1e0], rax
mov dword [rsp + 0x650], 0x120
mov qword [rsp + 0xa0], rbx
mov dword [rsp + 0x88], ebx
mov dword [rsp + 0x1d0], 0x30
mov qword [rsp + 0x1d8], rbx
mov dword [rsp + 0x1e8], 0x240
mov qword [rsp + 0x1f0], rbx
mov qword [rsp + 0x1f8], rbx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
mov rdx, qword [0x0002f2c0]
test rdx, rdx
je 0x2523b
mov eax, ebx
xchg dword [rdx], eax
mov dword [0x0002f2c8], eax
lea rax, [rsp + 0x88]
lea r8, [rsp + 0x1d0]
lea rcx, [rsp + 0xa0]
mov qword [rsp + 0x30], rax
xor r9d, r9d
mov edx, 0xf003f
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ntoskrnl.exe_ZwCreateKey]
mov rdx, qword [0x0002f2c0]
mov edi, eax
test rdx, rdx
je 0x25285
mov ecx, dword [0x0002f2c8]
xchg dword [rdx], ecx
lea rcx, [0x0002f2a8]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_KeSetEvent]
test edi, edi
js 0x25337
mov rdi, qword [rsp + 0xa0]
lea rcx, [0x0002f2a8]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
mov rdx, qword [0x0002f2c0]
test rdx, rdx
je 0x252d7
mov eax, ebx
xchg dword [rdx], eax
mov dword [0x0002f2c8], eax
lea rax, [rsp + 0x650]
lea rdx, [rsp + 0x40]
mov r9d, 4
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov rdx, qword [0x0002f2c0]
test rdx, rdx
je 0x25317
mov eax, dword [0x0002f2c8]
xchg dword [rdx], eax
lea rcx, [0x0002f2a8]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_KeSetEvent]
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
lea rdx, [0x00012000]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
xor eax, eax
lea rcx, [0x0002f2a8]
mov qword [rsp + 0xe8], rax
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0xf8], rax
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x108], rax
lea rax, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0xf0], rax
mov dword [rsp + 0x650], 1
mov qword [rsp + 0x70], rbx
mov dword [rsp + 0x98], ebx
mov dword [rsp + 0xe0], 0x30
mov qword [rsp + 0xe8], rbx
mov dword [rsp + 0xf8], 0x240
mov qword [rsp + 0x100], rbx
mov qword [rsp + 0x108], rbx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
mov rdx, qword [0x0002f2c0]
test rdx, rdx
je 0x253f5
mov eax, ebx
xchg dword [rdx], eax
mov dword [0x0002f2c8], eax
lea rax, [rsp + 0x98]
lea r8, [rsp + 0xe0]
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x30], rax
xor r9d, r9d
mov edx, 0xf003f
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ntoskrnl.exe_ZwCreateKey]
mov rdx, qword [0x0002f2c0]
mov edi, eax
test rdx, rdx
je 0x2543c
mov ecx, dword [0x0002f2c8]
xchg dword [rdx], ecx
lea rcx, [0x0002f2a8]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_KeSetEvent]
test edi, edi
js 0x254e8
mov rdi, qword [rsp + 0x70]
lea rcx, [0x0002f2a8]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
mov rdx, qword [0x0002f2c0]
test rdx, rdx
je 0x2548b
mov eax, ebx
xchg dword [rdx], eax
mov dword [0x0002f2c8], eax
lea rax, [rsp + 0x650]
lea rdx, [rsp + 0x40]
mov r9d, 4
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov rdx, qword [0x0002f2c0]
test rdx, rdx
je 0x254cb
mov eax, dword [0x0002f2c8]
xchg dword [rdx], eax
lea rcx, [0x0002f2a8]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_KeSetEvent]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
lea r8, [0x00012010]
lea rcx, [rsp + 0x410]
mov r9, rbp
mov rdx, rsi
call fcn.00023ef0
lea rdx, [rsp + 0x410]
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea r9, [0x0002efb0]
lea r8, [0x00012098]
lea rcx, [rsp + 0x200]
mov rdx, rsi
call fcn.00023ef0
lea rdx, [0x000120d0]
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
xor eax, eax
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x118], rax
mov qword [rsp + 0x120], rax
mov qword [rsp + 0x128], rax
mov qword [rsp + 0x130], rax
mov qword [rsp + 0x138], rax
lea rdi, [rsp + 0x200]
repne scasw ax, word [rdi]
lea rax, [rsp + 0x50]
xor r9d, r9d
not rcx
xor r8d, r8d
xor edx, edx
lea r12d, [rcx + rcx]
lea rcx, [0x0002f2a8]
mov qword [rsp + 0x78], rbx
mov dword [rsp + 0x68], ebx
mov dword [rsp + 0x110], 0x30
mov qword [rsp + 0x118], rbx
mov dword [rsp + 0x128], 0x240
mov qword [rsp + 0x120], rax
mov qword [rsp + 0x130], rbx
mov qword [rsp + 0x138], rbx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
mov rdx, qword [0x0002f2c0]
test rdx, rdx
je 0x255f9
mov eax, ebx
xchg dword [rdx], eax
mov dword [0x0002f2c8], eax
lea rax, [rsp + 0x68]
lea r8, [rsp + 0x110]
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x30], rax
xor r9d, r9d
mov edx, 0xf003f
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ntoskrnl.exe_ZwCreateKey]
mov rdx, qword [0x0002f2c0]
mov edi, eax
test rdx, rdx
je 0x2563d
mov ecx, dword [0x0002f2c8]
xchg dword [rdx], ecx
lea rcx, [0x0002f2a8]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_KeSetEvent]
test edi, edi
js 0x256e6
mov rdi, qword [rsp + 0x78]
lea rcx, [0x0002f2a8]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
mov rdx, qword [0x0002f2c0]
test rdx, rdx
je 0x2568c
mov eax, ebx
xchg dword [rdx], eax
mov dword [0x0002f2c8], eax
lea rax, [rsp + 0x200]
lea rdx, [rsp + 0x40]
mov r9d, 2
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov rdx, qword [0x0002f2c0]
test rdx, rdx
je 0x256c9
mov eax, dword [0x0002f2c8]
xchg dword [rdx], eax
lea rcx, [0x0002f2a8]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_KeSetEvent]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
lea rdx, [0x000120f0]
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
cmp dword [0x0002f224], 5
ja 0x25725
lea r8, [0x00012198]
lea rcx, [rsp + 0x410]
mov r9, rbp
mov rdx, rsi
call fcn.00023ef0
lea rdx, [rsp + 0x410]
jmp 0x25728
mov rdx, rbp
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x200]
xor edx, edx
mov r8d, 0x208
call fcn.0002b7b0
lea rax, [rsp + 0x200]
lea rcx, [rsp + 0x200]
sub rbp, rax
nop dword [rax + rax]
lea rax, [rsi + 0x7ffffefa]
test rax, rax
je 0x25784
movzx eax, word [rcx + rbp]
test ax, ax
je 0x25784
mov word [rcx], ax
add rcx, 2
sub rsi, 1
jne 0x25760
jmp 0x25789
test rsi, rsi
jne 0x2578d
sub rcx, 2
xor eax, eax
mov word [rcx], bx
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x178], rax
mov qword [rsp + 0x180], rax
mov qword [rsp + 0x188], rax
mov qword [rsp + 0x190], rax
mov qword [rsp + 0x198], rax
lea rdi, [rsp + 0x200]
repne scasw ax, word [rdi]
lea rax, [rsp + 0x50]
xor r9d, r9d
not rcx
xor r8d, r8d
xor edx, edx
lea esi, [rcx + rcx + 2]
lea rcx, [0x0002f2a8]
mov qword [rsp + 0x60], rbx
mov dword [rsp + 0x6c], ebx
mov dword [rsp + 0x170], 0x30
mov qword [rsp + 0x178], rbx
mov dword [rsp + 0x188], 0x240
mov qword [rsp + 0x180], rax
mov qword [rsp + 0x190], rbx
mov qword [rsp + 0x198], rbx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
mov rcx, qword [0x0002f2c0]
test rcx, rcx
je 0x25844
mov eax, ebx
xchg dword [rcx], eax
mov dword [0x0002f2c8], eax
lea rax, [rsp + 0x6c]
lea r8, [rsp + 0x170]
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x30], rax
xor r9d, r9d
mov edx, 0xf003f
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ntoskrnl.exe_ZwCreateKey]
mov rdx, qword [0x0002f2c0]
mov edi, eax
test rdx, rdx
je 0x25888
mov ecx, dword [0x0002f2c8]
xchg dword [rdx], ecx
lea rcx, [0x0002f2a8]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_KeSetEvent]
test edi, edi
js 0x2592e
mov rdi, qword [rsp + 0x60]
lea rcx, [0x0002f2a8]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
mov rdx, qword [0x0002f2c0]
test rdx, rdx
je 0x258d5
xchg dword [rdx], ebx
mov dword [0x0002f2c8], ebx
lea rax, [rsp + 0x200]
lea rdx, [rsp + 0x40]
mov r9d, 7
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov rdx, qword [0x0002f2c0]
test rdx, rdx
je 0x25911
mov eax, dword [0x0002f2c8]
xchg dword [rdx], eax
lea rcx, [0x0002f2a8]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_KeSetEvent]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
xor eax, eax
add rsp, 0x620
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret