Function at 0x140060b90
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
lea rcx, [rdx + 0xf0]
cmp qword [rcx + 0x18], 8
jb 0x140060ba1
mov rcx, qword [rcx]
movzx edx, r9b
jmp 0x140089270
mov byte [rsp + 0x10], dl
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x78
xor r13d, r13d
mov dword [rbp - 0x48], r13d
mov qword [rbp - 0x28], r13
mov dword [rbp - 0x20], r13d
mov qword [rbp - 0x18], r13
call fcn.140008180
mov rcx, rax
test rax, rax
je 0x14008970b
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x60], rax
lea rdx, [0x1400eff20]
lea r14, [r13 - 1]
cmp rdx, 0x10000
jae 0x1400892e0
movzx edx, dx
lea rcx, [rbp + 0x60]
call fcn.140006660
jmp 0x1400892fa
mov rax, r14
inc rax
cmp word [rdx + rax*2], 0
jne 0x1400892e3
mov r8d, eax
lea rcx, [rbp + 0x60]
call fcn.1400068f0
nop
mov rbx, qword [rbp + 0x60]
lea rax, [rbx - 0x18]
mov qword [rbp - 0x30], rax
mov rcx, qword [rbx - 0x18]
test rcx, rcx
je 0x14008931d
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x140089337
call fcn.140008180
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rax, rax
je 0x140089716
mov rax, qword [rcx]
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rbp - 0x38], rdi
mov eax, 1
mov dword [rbp - 0x48], eax
movsxd r12, dword [rbx - 0x10]
lea rdx, str.SystemCurrentControlSetServices
mov rsi, r14
nop dword [rax + rax]
inc rsi
cmp word [rdx + rsi*2], 0
jne 0x140089360
lea r15d, [r12 + rsi]
test r15d, r15d
js 0x140089700
mov ecx, eax
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, r15d
or eax, ecx
jge 0x14008939d
mov edx, r15d
lea rcx, [rbp - 0x38]
call fcn.140006870
mov rdi, qword [rbp - 0x38]
lea rdx, str.SystemCurrentControlSetServices
movsxd rax, esi
lea rsi, [rax + rax]
test rsi, rsi
je 0x1400893cb
test rdi, rdi
jne 0x1400893c0
call fcn.1400a31cc
mov dword [rax], 0x16
call fcn.1400a3060
jmp 0x1400893cb
mov r8, rsi
mov rcx, rdi
call fcn.14009d3c0
mov r8, r12
add r8, r8
lea rcx, [rsi + rdi]
je 0x140089407
test rcx, rcx
je 0x1400893f7
test rbx, rbx
je 0x1400893eb
mov rdx, rbx
call fcn.14009d3c0
jmp 0x140089407
xor edx, edx
call fcn.14009e880
test rbx, rbx
jne 0x140089407
call fcn.1400a31cc
mov dword [rax], 0x16
call fcn.1400a3060
cmp r15d, dword [rdi - 0xc]
jg 0x140089700
mov dword [rdi - 0x10], r15d
movsxd rax, r15d
mov word [rdi + rax*2], r13w
mov rcx, qword [rdi - 0x18]
test rcx, rcx
je 0x140089434
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x14008944e
call fcn.140008180
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rax, rax
je 0x140089721
mov rax, qword [rcx]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x40], rbx
mov r12d, 3
mov dword [rbp - 0x48], r12d
mov rax, qword [rbp + 0x48]
test rax, rax
jne 0x140089473
xor esi, esi
jmp 0x140089480
mov rsi, r14
inc rsi
cmp word [rax + rsi*2], 0
jne 0x140089476
mov eax, dword [rdi - 0x10]
mov dword [rbp + 0x58], eax
lea r15d, [rsi + rax]
test r15d, r15d
js 0x1400896f5
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, r15d
or eax, ecx
jge 0x1400894b5
mov edx, r15d
lea rcx, [rbp - 0x40]
call fcn.140006870
mov rbx, qword [rbp - 0x40]
movsxd rax, dword [rbp + 0x58]
lea r8, [rax + rax]
mov qword [rbp + 0x58], r8
test r8, r8
je 0x1400894e8
test rbx, rbx
jne 0x1400894dd
call fcn.1400a31cc
mov dword [rax], 0x16
call fcn.1400a3060
jmp 0x1400894e8
mov rdx, rdi
mov rcx, rbx
call fcn.14009d3c0
movsxd r8, esi
add r8, r8
mov rcx, qword [rbp + 0x58]
lea rcx, [rcx + rbx]
je 0x140089522
test rcx, rcx
je 0x140089512
mov rdx, qword [rbp + 0x48]
test rdx, rdx
je 0x14008950d
call fcn.14009d3c0
jmp 0x140089522
call fcn.14009e880
call fcn.1400a31cc
mov dword [rax], 0x16
call fcn.1400a3060
cmp r15d, dword [rbx - 0xc]
jg 0x1400896f5
mov dword [rbx - 0x10], r15d
movsxd rax, r15d
xor esi, esi
mov word [rbx + rax*2], si
mov qword [rbp + 0x58], rsi
lea rax, [rbp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140089571
mov dword [rbp - 0x20], esi
mov rax, qword [rbp + 0x58]
mov qword [rbp - 0x28], rax
mov dword [rbp - 0x20], esi
mov eax, r12d
and eax, 0xfffffffd
mov dword [rbp - 0x48], eax
lea rdx, [rbx - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140089594
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
and dword [rbp - 0x48], 0xfffffffe
mov eax, r14d
lock xadd dword [rdi - 8], eax
sub eax, 1
jg 0x1400895b4
mov rcx, qword [rdi - 0x18]
mov rax, qword [rcx]
lea rdx, [rdi - 0x18]
call qword [rax + VariantCopy]
nop
mov rdx, qword [rbp - 0x30]
lock xadd dword [rdx + 0x10], r14d
sub r14d, 1
jg 0x1400895cd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov rbx, qword [rbp - 0x28]
test rbx, rbx
jne 0x1400895de
xor dil, dil
jmp 0x1400896cb
lea r9, [rbp - 0x38]
xor r8d, r8d
mov rcx, rbx
cmp byte [rbp + 0x50], r8b
je 0x14008963a
mov dword [rbp - 0x40], 4
lea rax, [rbp - 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x58]
mov qword [rsp + 0x20], rax
lea rdx, [0x14011a51a]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14008962c
cmp dword [rbp - 0x38], 4
jne 0x14008962c
mov r12d, dword [rbp + 0x58]
mov dword [rbp - 0x38], r12d
lea rax, [rbp - 0x38]
jmp 0x14008969f
mov dword [rbp + 0x58], r12d
mov dword [rbp - 0x38], r12d
lea rax, [rbp - 0x38]
jmp 0x14008969f
mov dword [rbp + 0x60], r12d
mov dword [rbp + 0x58], 4
lea rax, [rbp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x60]
mov qword [rsp + 0x20], rax
lea rdx, str.Start
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [rbp + 0x60]
mov dword [rbp + 0x58], eax
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, [0x14011a51a]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rbp + 0x58], 4
lea rax, [rbp + 0x58]
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Start
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete dil
test rbx, rbx
je 0x1400896dd
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x28], rsi
mov dword [rbp - 0x20], esi
movzx eax, dil
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 0x80070057
call fcn.140007f00
nop
mov ecx, 0x80070057
call fcn.140007f00
nop
mov ecx, 0x80004005
call fcn.140007f00
nop
mov ecx, 0x80004005
call fcn.140007f00
nop
mov ecx, 0x80004005
call fcn.140007f00
int3