Function at 0x1400247b0
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push rbp
lea rbp, [rsp - 0x40]
sub rsp, 0x140
mov rax, qword [0x140073058]
xor rax, rsp
mov qword [rbp + 0x30], rax
xor ecx, ecx
call fcn.1400242d0
test al, al
je 0x140024b00
lea rax, [rsp + 0x50]
mov qword [rsp + 0x150], rbx
mov qword [rsp + 0x158], rdi
lea rdx, str.SYSTEMCurrentControlSetServicesLITSSVCNotification
xor edi, edi
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
mov qword [rsp + 0x50], rdi
xor r8d, r8d
mov qword [rsp + 0x58], rdi
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x60], edi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140024893
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
lea rdx, str.F8Count
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140024893
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x58]
lea rax, [rsp + 0x60]
xor r8d, r8d
lea rdx, str.F8Count
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140024893
cmp dword [rsp + 0x60], 3
jb 0x140024906
xor bl, bl
jmp 0x140024add
mov qword [rsp + 0x40], rdi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea rdx, str.SYSTEMCurrentControlSetServicesLITSSVCNotification
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], 0x20006
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], edi
mov dword [rsp + 0x68], 1
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140024906
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x68]
mov dword [rsp + 0x28], 4
lea rdx, str.F8Count
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rax, [rsp + 0x50]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMCurrentControlSetServicesLITSSVCNotification
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140024ad6
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
lea rdx, [0x1400686e8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140024ad6
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x58]
lea rax, [rbp - 0x50]
xor r8d, r8d
lea rdx, [0x1400686e8]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140024ad6
lea rax, [rsp + 0x70]
mov dword [rsp + 0x70], edi
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x78]
lea rax, [rbp - 0x7c]
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x74]
lea rax, [rbp - 0x80]
mov qword [rsp + 0x28], rax
lea rdx, str._04d__02d__02d__02d:_02d:_02d
lea rax, [rsp + 0x7c]
lea rcx, [rbp - 0x50]
mov qword [rsp + 0x20], rax
call fcn.1400251a0
mov eax, dword [rsp + 0x74]
lea rcx, [rbp - 0x78]
add eax, 0xfffff894
mov qword [rbp - 0x60], rdi
mov dword [rbp - 0x64], eax
mov eax, dword [rsp + 0x78]
dec eax
mov dword [rbp - 0x58], edi
mov dword [rbp - 0x68], eax
mov eax, dword [rsp + 0x7c]
mov dword [rbp - 0x6c], eax
mov eax, dword [rbp - 0x80]
mov dword [rbp - 0x70], eax
mov eax, dword [rbp - 0x7c]
mov dword [rbp - 0x74], eax
mov eax, dword [rsp + 0x70]
mov dword [rbp - 0x78], eax
call fcn.14003c628
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x140024a2e
xor bl, bl
jmp 0x140024add
xor ecx, ecx
call fcn.14003c630
mov rdx, rbx
mov rcx, rax
call fcn.14003c6a0
xorps xmm1, xmm1
ucomisd xmm0, xmm1
jp 0x140024a4f
je 0x14002488c
comisd xmm0, xmmword [0x140068de0]
jb 0x14002488c
mov eax, dword [rsp + 0x60]
lea rdx, str.SYSTEMCurrentControlSetServicesLITSSVCNotification
inc eax
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x60], eax
xor r9d, r9d
mov dword [rsp + 0x68], eax
xor r8d, r8d
lea rax, [rsp + 0x50]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140024ad6
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x68]
mov dword [rsp + 0x28], 4
lea rdx, str.F8Count
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
call fcn.140024b20
mov bl, 1
mov rcx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x158]
test rcx, rcx
je 0x140024af5
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, bl
mov rbx, qword [rsp + 0x150]
mov rcx, qword [rbp + 0x30]
xor rcx, rsp
call fcn.14002a740
add rsp, 0x140
pop rbp
ret