Function at 0x2d9e3ccf80
Capabilities:
Delete registry key
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x890]
sub rsp, 0x990
mov rax, qword [0x2d9e415008]
xor rax, rsp
mov qword [rbp + 0x880], rax
mov edi, edx
mov dword [rsp + 0x58], 0x104
xor edx, edx
lea rcx, [rbp + 0x460]
mov r8d, 0x104
xor esi, esi
call fcn.2d9e3e3840
lea rax, [rsp + 0x50]
mov qword [rsp + 0x50], rsi
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [0x2d9e409ad0]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea r14d, [rsi + 1]
test eax, eax
jne 0x2d9e3cd049
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x68]
lea rax, [rbp + 0x460]
xor r8d, r8d
lea rdx, [0x2d9e409ab8]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x50]
mov ebx, esi
test eax, eax
cmove ebx, r14d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x2d9e3cd060
mov r8d, dword [rsp + 0x58]
lea rcx, [rbp + 0x460]
xor edx, edx
call fcn.2d9e3e3840
mov dword [rsp + 0x58], esi
lea rcx, [rbp + 0x460]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r8d, edi
mov dword [rsp + 0x60], 0x20
lea rdx, [0x2d9e409b50]
mov dword [rsp + 0x58], eax
lea rcx, [rbp + 0x1e0]
mov dword [rsp + 0x5c], 2
mov dword [rsp + 0x64], esi
call qword [sym.imp.USER32.dll_wsprintfW]
lea r9, [0x2d9e409b40]
mov r8d, 0xa
lea rdx, [rbp + 0x250]
lea rcx, [rbp + 0x1e0]
call fcn.2d9e3c9b50
mov eax, dword [rsp + 0x58]
mov edx, 0x61
movzx ecx, dx
test eax, eax
je 0x2d9e3cd0f3
dec eax
mov ecx, eax
movzx ecx, word [rbp + rax*2 + 0x460]
lea eax, [rcx - 0x61]
cmp ax, 0x19
ja 0x2d9e3cd0f0
cmp cx, 0x7a
jne 0x2d9e3cd0eb
mov ecx, edx
jmp 0x2d9e3cd0f3
inc cx
jmp 0x2d9e3cd0f3
movzx ecx, dx
movzx r8d, cx
lea rdx, [0x2d9e409b78]
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_wsprintfW]
lea r8, [rsp + 0x70]
lea rdx, [0x2d9e4093f0]
lea rcx, [rbp - 0x20]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rax, [rsp + 0x50]
mov r9d, 0x20119
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rbp - 0x20]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x2d9e3cd163
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rbp - 0x20]
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea rdx, [rbp - 0x20]
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], 0xf013f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], esi
mov qword [rsp + 0x50], rsi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x2d9e3cd7b6
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x5c]
mov dword [rsp + 0x28], 4
lea rdx, [0x2d9e409b68]
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
mov ebx, esi
test eax, eax
cmove ebx, r14d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x2d9e3cd7b6
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea rdx, [rbp - 0x20]
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], 0xf013f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], esi
mov qword [rsp + 0x50], rsi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x2d9e3cd7b6
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x28], 4
lea rdx, [0x2d9e409bb8]
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
mov ebx, esi
test eax, eax
cmove ebx, r14d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x2d9e3cd7b6
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea rdx, [rbp - 0x20]
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], 0xf013f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], esi
mov qword [rsp + 0x50], rsi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x2d9e3cd7b6
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x64]
mov dword [rsp + 0x28], 4
lea rdx, [0x2d9e409b98]
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
mov ebx, esi
test eax, eax
cmove ebx, r14d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x2d9e3cd7b6
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea rdx, [rbp - 0x20]
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], 0xf013f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], esi
mov qword [rsp + 0x50], rsi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x2d9e3cd7b6
or rdi, 0xffffffffffffffff
lea rcx, [rsp + 0x70]
mov rax, rdi
nop word [rax + rax]
cmp word [rcx + rax*2 + 2], si
lea rax, [rax + 1]
jne 0x2d9e3cd360
mov rcx, qword [rsp + 0x50]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
lea rdx, [0x2d9e409be0]
lea rax, [rsp + 0x70]
mov r9d, r14d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
mov ebx, esi
test eax, eax
cmove ebx, r14d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x2d9e3cd7b6
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea rdx, [rbp - 0x20]
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], 0xf013f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], esi
mov qword [rsp + 0x50], rsi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x2d9e3cd7b6
mov rcx, qword [rsp + 0x50]
lea rax, [0x2d9e409bc8]
mov dword [rsp + 0x28], 0x18
lea rdx, [0x2d9e409c10]
mov r9d, r14d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
mov ebx, esi
test eax, eax
cmove ebx, r14d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x2d9e3cd7b6
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea rdx, [rbp - 0x20]
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], 0xf013f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], esi
mov qword [rsp + 0x50], rsi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x2d9e3cd7b6
lea rcx, [rsp + 0x70]
mov rax, rdi
nop word [rax + rax]
cmp word [rcx + rax*2 + 2], si
lea rax, [rax + 1]
jne 0x2d9e3cd490
mov rcx, qword [rsp + 0x50]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
lea rdx, [0x2d9e409bf8]
lea rax, [rsp + 0x70]
mov r9d, r14d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
mov ebx, esi
test eax, eax
cmove ebx, r14d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x2d9e3cd7b6
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea rdx, [rbp - 0x20]
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], 0xf013f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], esi
mov qword [rsp + 0x50], rsi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x2d9e3cd7b6
mov rcx, qword [rsp + 0x50]
lea rax, [0x2d9e409c40]
mov dword [rsp + 0x28], 0x60
lea rdx, [0x2d9e409c28]
mov r9d, 2
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
mov ebx, esi
test eax, eax
cmove ebx, r14d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x2d9e3cd7b6
lea r8, [rsp + 0x70]
lea rdx, [0x2d9e409390]
lea rcx, [rbp - 0x20]
call qword [sym.imp.USER32.dll_wsprintfW]
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea rdx, [rbp - 0x20]
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], 0xf013f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], esi
mov qword [rsp + 0x50], rsi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x2d9e3cd7b6
lea rcx, [rbp + 0x250]
mov rax, rdi
cmp word [rcx + rax*2 + 2], si
lea rax, [rax + 1]
jne 0x2d9e3cd5d5
mov rcx, qword [rsp + 0x50]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
lea rdx, [0x2d9e409440]
lea rax, [rbp + 0x250]
mov r9d, 2
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
mov ebx, esi
test eax, eax
cmove ebx, r14d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x2d9e3cd7b6
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea rdx, [0x2d9e409ad0]
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], esi
mov qword [rsp + 0x50], rsi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x2d9e3cd7b6
lea rax, [rsp + 0x70]
nop dword [rax]
cmp word [rax + rdi*2 + 2], si
lea rdi, [rdi + 1]
jne 0x2d9e3cd680
mov rcx, qword [rsp + 0x50]
lea eax, [rdi*2 + 2]
mov dword [rsp + 0x28], eax
lea rdx, [0x2d9e409ab8]
lea rax, [rsp + 0x70]
mov r9d, 7
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
mov ebx, esi
test eax, eax
cmove ebx, r14d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x2d9e3cd7b6
lea rcx, [rbp + 0x250]
call fcn.2d9e3cce70
test eax, eax
je 0x2d9e3cd7b6
mov edx, 0x5c
lea rcx, [rbp + 0x250]
call fcn.2d9e3e3224
mov qword [rsp + 0x40], rsi
lea rdx, [0x2d9e409cc0]
xor r9d, r9d
mov qword [rsp + 0x50], rsi
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov word [rax + 2], si
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x2d9e3cd77c
mov rcx, qword [rsp + 0x50]
lea rax, [rbp + 0x250]
mov dword [rsp + 0x28], 4
lea rdx, [rbp + 0x250]
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x58], esi
je 0x2d9e3cd7b1
lea r8, [rbp + 0x460]
lea rdx, [0x2d9e4093f0]
lea rcx, [rbp + 0x670]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rbp + 0x670]
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov eax, r14d
jmp 0x2d9e3cd7b8
xor eax, eax
mov rcx, qword [rbp + 0x880]
xor rcx, rsp
call fcn.2d9e3da7d0
lea r11, [rsp + 0x990]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret