Function at 0x100002ca0
Capabilities:
Delete registry value
Persist via windows service
Set registry value
Shutdown system

Disassembly:
mov r11, rsp
sub rsp, 0x1d8
mov rax, qword [0x10000a348]
mov qword [rsp + 0x180], rax
mov rax, qword [sym.imp.msvcrt.dll___argc]
mov qword [r11 - 8], rbx
mov qword [r11 - 0x18], rsi
xor esi, esi
mov qword [r11 - 0x20], rdi
mov qword [r11 - 0x30], r13
mov dword [rsp + 0x60], esi
cmp dword [rax], 2
mov qword [r11 - 0x38], r14
mov r14, rsi
lea edi, [rsi + 1]
mov r13d, esi
jl 0x100002e16
mov rax, qword [sym.imp.msvcrt.dll___wargv]
lea rdx, [0x1000014a8]
mov rcx, qword [rax]
mov rcx, qword [rcx + 8]
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jne 0x100002e16
lea rax, [rsp + 0x58]
lea r9, [0x100001438]
lea rdx, [0x100001440]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x100002d8c
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x60]
lea r9d, [rsi + 3]
lea rdx, [0x10000143c]
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, edi
nop
lea rdx, [rsp + 0x80]
mov r8d, 0xa
mov ecx, ebx
call qword [sym.imp.msvcrt.dll__itow]
lea r11, [rsp + 0x58]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], r11
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
lea r9, [0x100001438]
lea rdx, [0x100001440]
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x100002e0b
mov rcx, qword [rsp + 0x50]
lea rdx, [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc ebx
cmp ebx, 0x20
jl 0x100002d90
mov rax, qword [sym.imp.msvcrt.dll___wargv]
mov dx, 0x5c
mov qword [rsp + 0x1b0], r12
mov rcx, qword [rax]
mov rcx, qword [rcx]
call qword [sym.imp.msvcrt.dll_wcsrchr]
test rax, rax
jne 0x100002e49
mov r9, qword [sym.imp.msvcrt.dll___wargv]
mov rax, qword [r9]
mov r12, qword [rax]
jmp 0x100002e5c
mov rcx, rax
call qword [sym.imp.USER32.dll_CharNextW]
mov r9, qword [sym.imp.msvcrt.dll___wargv]
mov r12, rax
mov rcx, qword [sym.imp.msvcrt.dll___argc]
mov r8d, dword [rcx]
cmp r8d, edi
jle 0x100002eca
mov rdx, qword [r9]
add rdx, 8
mov rax, qword [rdx]
movzx ecx, word [rax]
cmp cx, 0x2d
je 0x100002e84
cmp cx, 0x2f
jne 0x100002eca
movzx ecx, word [rax + 2]
cmp cx, 0x6d
je 0x100002eae
cmp cx, 0x4d
je 0x100002eae
cmp cx, 0x72
je 0x100002ea0
cmp cx, 0x52
jne 0x100002eca
cmp word [rax + 4], si
jne 0x100002eca
mov r13d, 1
jmp 0x100002ebf
cmp word [rax + 4], 0x3a
jne 0x100002eca
cmp word [rax + 6], si
je 0x100002eca
lea r14, [rax + 6]
inc edi
add rdx, 8
cmp r8d, edi
jg 0x100002e72
sub r8d, edi
cmp r8d, 1
jge 0x100002ef5
mov rcx, qword [sym.imp.msvcrt.dll__iob]
mov r8, r12
mov edx, 0xea60
add rcx, 0x60
call fcn.1000018e0
mov eax, 3
jmp 0x100002f93
mov rax, qword [r9]
movsxd rcx, edi
mov qword [rsp + 0x1c8], rbp
mov rbp, qword [rax + rcx*8]
movzx eax, word [rbp]
cmp ax, 0x2d
je 0x100002f17
cmp ax, 0x2f
jne 0x100002f23
mov rcx, rbp
call qword [sym.imp.USER32.dll_CharNextW]
mov rbp, rax
inc edi
cmp qword [0x10000a100], rsi
mov qword [rsp + 0x198], r15
je 0x100002f66
lea r15, [0x10000a100]
mov rdx, r15
mov rbx, r15
mov rdx, qword [rdx]
mov rcx, rbp
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
je 0x100002fd8
add rbx, 0x18
inc esi
cmp qword [rbx], 0
mov rdx, rbx
jne 0x100002f43
mov rcx, qword [sym.imp.msvcrt.dll__iob]
mov r8, r12
mov edx, 0xea60
add rcx, 0x60
call fcn.1000018e0
mov eax, 3
mov r15, qword [rsp + 0x198]
mov rbp, qword [rsp + 0x1c8]
mov r14, qword [rsp + 0x1a0]
mov r13, qword [rsp + 0x1a8]
mov r12, qword [rsp + 0x1b0]
mov rdi, qword [rsp + 0x1b8]
mov rsi, qword [rsp + 0x1c0]
mov rbx, qword [rsp + 0x1d0]
mov rcx, qword [rsp + 0x180]
call fcn.1000079f0
add rsp, 0x1d8
ret
movsxd r8, edi
movsxd rax, esi
mov rdx, r14
lea rbx, [rax + rax*2]
mov rax, qword [sym.imp.msvcrt.dll___wargv]
mov rcx, qword [rax]
mov rax, qword [sym.imp.msvcrt.dll___argc]
lea r9, [rcx + r8*8]
mov r8d, dword [rax]
mov rcx, r12
sub r8d, edi
call qword [r15 + rbx*8 + 8]
test eax, eax
mov edi, eax
mov edx, eax
je 0x100003104
dec edx
je 0x100003063
cmp edx, 2
je 0x100003040
mov rcx, qword [sym.imp.msvcrt.dll__iob]
mov r9, qword [r15 + rbx*8]
mov r8, r12
add rcx, 0x60
mov edx, 0xea61
call fcn.1000018e0
mov eax, edi
jmp 0x100002f83
mov rcx, qword [sym.imp.msvcrt.dll__iob]
mov r9, qword [r15 + rbx*8]
mov r8, r12
add rcx, 0x60
mov edx, 0xea62
call fcn.1000018e0
mov eax, edi
jmp 0x100002f83
test r13d, r13d
je 0x100003104
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x58]
mov edx, 0x20
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1000030f4
lea r8, [rsp + 0x50]
lea rdx, [0x100001408]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x1000030ae
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1000030f4
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
lea r8, [rsp + 0x68]
mov qword [rsp + 0x6c], rax
xor eax, eax
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor edx, edx
mov dword [rsp + 0x68], 1
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x74], 2
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0x80010002
mov ecx, 2
call qword [sym.imp.USER32.dll_ExitWindowsEx]
mov eax, edi
jmp 0x100002f83