Function at 0x1400d6774
Capabilities:
Persist via windows service
Set registry value

Disassembly:
jmp 0x140253da0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x2a8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x6e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x2c8]
mov rax, qword [0x14031bec0]
xor rax, rbp
mov qword [rbp + 0x268], rax
lea rcx, [0x14033b4b6]
call fcn.1400d83bc
nop
lea rdx, str.SystemCurrentControlSetServices_
lea rcx, [rbp + 0x28]
call fcn.1400d5ea0
nop
mov rdx, qword [rbp + 0x298]
lea rcx, [rbp + 0x28]
call fcn.1400d4f0f
nop
lea rcx, [rbp + 0x28]
call fcn.1400d466d
lea r8, [rbp + 8]
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov dword [rbp + 0x64], eax
cmp dword [rbp + 0x64], 0
je 0x140253e53
mov byte [rbp + 0x1a4], 0
lea rcx, [rbp + 0x28]
call fcn.1400d4ce9
movzx eax, byte [rbp + 0x1a4]
jmp 0x140254027
mov byte [rbp + 0x84], 1
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x84]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Type
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [rbp + 0x64], eax
cmp dword [rbp + 0x64], 0
je 0x140253ead
mov byte [rbp + 0x1c4], 0
lea rcx, [rbp + 0x28]
call fcn.1400d4ce9
movzx eax, byte [rbp + 0x1c4]
jmp 0x140254027
mov byte [rbp + 0xa4], 3
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0xa4]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.ErrorControl
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [rbp + 0x64], eax
cmp dword [rbp + 0x64], 0
je 0x140253f07
mov byte [rbp + 0x1e4], 0
lea rcx, [rbp + 0x28]
call fcn.1400d4ce9
movzx eax, byte [rbp + 0x1e4]
jmp 0x140254027
mov byte [rbp + 0xc4], 3
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0xc4]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Start
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [rbp + 0x64], eax
cmp dword [rbp + 0x64], 0
je 0x140253f61
mov byte [rbp + 0x204], 0
lea rcx, [rbp + 0x28]
call fcn.1400d4ce9
movzx eax, byte [rbp + 0x204]
jmp 0x140254027
mov rcx, qword [rbp + 0x290]
call fcn.1400d7093
mov dword [rbp + 0x254], eax
mov rcx, qword [rbp + 0x290]
call fcn.1400d466d
mov qword [rbp + 0x258], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x260], rax
mov eax, dword [rbp + 0x254]
mov dword [rsp + 0x28], eax
mov rax, qword [rbp + 0x258]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.ImagePath
mov rcx, qword [rbp + 0x260]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [rbp + 0x64], eax
cmp dword [rbp + 0x64], 0
je 0x140253fe6
mov byte [rbp + 0x224], 0
lea rcx, [rbp + 0x28]
call fcn.1400d4ce9
movzx eax, byte [rbp + 0x224]
jmp 0x140254027
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x140254000
mov dword [rbp + 0x254], 1
jmp 0x14025400a
mov dword [rbp + 0x254], 0
movzx eax, byte [rbp + 0x254]
mov byte [rbp + 0x244], al
lea rcx, [rbp + 0x28]
call fcn.1400d4ce9
movzx eax, byte [rbp + 0x244]
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x1402e7bd0]
call fcn.1400d77cd
mov rax, rdi
mov rcx, qword [rbp + 0x268]
xor rcx, rbp
call fcn.1400d60b7
lea rsp, [rbp + 0x278]
pop rdi
pop rbp
ret