Function at 0x1400087d0
Capabilities:
Persist via windows service
Set registry value

Disassembly:
sub rsp, 0x168
mov rax, qword [0x1400211b0]
xor rax, rsp
mov qword [rsp + 0x150], rax
lea rcx, [0x1400227e8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x1400228f8], 0
je 0x140008834
lea rcx, [0x1400227e8]
mov dword [0x1400228f4], 1
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x1400228f8]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.14000ad20
add rsp, 0x168
ret
mov eax, dword [0x1400210ec]
mov qword [rsp + 0x170], rbx
mov qword [rsp + 0x178], rsi
test al, 1
mov qword [rsp + 0x160], rdi
je 0x1400088ee
call fcn.140009ed0
cmp eax, 1
jne 0x1400088da
call fcn.14000a450
cmp eax, 1
jne 0x1400088da
mov eax, dword [0x140021138]
mov dword [0x1400228fc], 7
cmp eax, 7
jbe 0x140008896
add eax, 0xfffffff9
lea rdi, [0x14002279c]
mov ecx, eax
mov eax, 1
rep stosd dword [rdi], eax
mov edx, dword [0x14002112c]
xor ebx, ebx
lea rsi, [0x140022780]
mov eax, edx
mov ecx, ebx
shr eax, cl
test al, 1
jne 0x1400088b5
mov dword [rsi], 1
add ebx, 1
add rsi, 4
cmp ebx, 7
jb 0x1400088a5
mov dword [0x1400228f8], 1
mov dword [0x1400228f4], 1
jmp 0x140008aff
mov eax, dword [0x1400228f8]
test eax, eax
jne 0x140008ae2
mov eax, dword [0x1400210ec]
test al, 2
je 0x140008b5e
mov ecx, dword [0x1400228f0]
call fcn.140004360
cmp eax, 1
jne 0x140008adc
call fcn.140004400
test eax, eax
je 0x140008adc
xor eax, eax
lea r8, [rsp + 0x30]
xor edx, edx
mov qword [0x140022778], rax
mov ecx, 0x4e464741
mov dword [0x140022778], 0x8000
mov qword [0x140022768], rax
mov qword [0x140022770], rax
call fcn.140004100
xor ebx, ebx
test eax, eax
lea rsi, [0x140022780]
jne 0x140008a30
cmp dword [rsp + 0x30], ebx
je 0x140008a30
call fcn.140007e20
cmp eax, 0x100
jb 0x140008a1d
cmp eax, 0x101
jbe 0x1400089f0
cmp eax, 0x110
jne 0x140008a1d
mov edx, dword [rsp + 0x30]
mov r8d, edx
and edx, 0xfff
and r8d, 0xfffff000
shl edx, 0xc
mov dword [0x140022760], edx
mov dword [0x140022768], r8d
je 0x1400089b4
cmp edx, 0x8000
jbe 0x1400089bf
mov edx, 0x8000
mov dword [0x140022760], edx
mov eax, dword [0x140021138]
mov dword [0x140022778], edx
shr edx, 0xb
cmp edx, eax
mov dword [0x1400228fc], edx
jae 0x140008a89
sub eax, edx
lea rdi, [rsi + rdx*4]
mov ecx, eax
mov eax, 1
rep stosd dword [rdi], eax
jmp 0x140008a89
mov r8d, dword [rsp + 0x30]
mov edx, 0x10
mov dword [0x140022760], 0x8000
mov dword [0x140022778], 0x8000
mov dword [0x1400228fc], edx
mov dword [0x140022768], r8d
jmp 0x140008a89
mov dword [0x140022768], ebx
mov dword [0x140022778], ebx
xor eax, eax
jmp 0x140008bfa
cmp dword [0x1400227e4], 0x600
jae 0x140008a7a
mov eax, dword [0x140021138]
mov edx, 2
mov dword [0x140022764], 1
cmp eax, edx
mov dword [0x140022778], 0x1000
mov dword [0x1400228fc], edx
jbe 0x140008a80
add eax, 0xfffffffe
lea rdi, [0x140022788]
mov ecx, eax
mov eax, 1
rep stosd dword [rdi], eax
jmp 0x140008a80
mov edx, dword [0x1400228fc]
mov r8d, ebx
mov dword [0x140022768], ebx
cmp dword [0x140022764], ebx
jne 0x140008a96
test r8d, r8d
je 0x140008adc
test edx, edx
je 0x140008abb
mov edi, dword [0x14002112c]
mov eax, edi
mov ecx, ebx
shr eax, cl
test al, 1
jne 0x140008ab0
mov dword [rsi], 1
add ebx, 1
add rsi, 4
cmp ebx, edx
jb 0x140008aa0
mov dword [0x1400228f8], 2
mov dword [0x1400228f4], 1
call fcn.1400086a0
mov eax, dword [0x1400228f8]
jmp 0x140008ae2
mov eax, dword [0x1400228f8]
cmp eax, 2
jne 0x140008afa
lea r8, [rsp + 0x38]
xor edx, edx
mov ecx, 0x54494e49
call fcn.140004100
jmp 0x140008b10
cmp eax, 1
jne 0x140008b5e
lea r8, [rsp + 0x38]
xor edx, edx
mov ecx, 0x54494e49
call fcn.140009c70
cmp dword [0x1400228f8], 1
jne 0x140008b5e
lea r8, [rsp + 0x38]
xor edx, edx
mov ecx, 0x474f4457
call fcn.140009c70
test eax, eax
jne 0x140008b5e
mov r8d, dword [rsp + 0x38]
lea eax, [r8 - 1]
cmp eax, 0x12b
ja 0x140008b5e
mov rcx, qword [0x1400228e8]
imul r8d, r8d, 0x3e8
xor r9d, r9d
xor edx, edx
mov dword [0x140022900], r8d
call qword [sym.imp.USER32.dll_SetTimer]
lea rcx, [0x1400227e8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edx, dword [0x1400228f8]
lea r8, str.SYSTEMCurrentControlSetServices_
mov dword [rsp + 0x30], edx
lea rcx, [rsp + 0x50]
mov edx, 0x80
call fcn.14000ae60
lea r8, [0x1400210b8]
lea rcx, [rsp + 0x50]
mov edx, 0x80
call fcn.14000c2c0
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x50]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x140008bf4
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
lea rdx, str.CurrentServiceMode
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x1400228f8]
mov rsi, qword [rsp + 0x178]
mov rbx, qword [rsp + 0x170]
mov rdi, qword [rsp + 0x160]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.14000ad20
add rsp, 0x168
ret