Function at 0x140033e30
Capabilities:
Create service
Delete registry key
Manipulate safe mode programs
Modify service
Set registry value

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
mov eax, 0x26f0
call fcn.1401fe1f0
sub rsp, rax
mov qword [rsp + 0xf8], 0xfffffffffffffffe
mov rax, qword [0x140322b20]
xor rax, rsp
mov qword [rsp + 0x26e0], rax
mov dword [rsp + 0x74], 0
mov rcx, qword [rsp + 0x2700]
call fcn.140035f10
test eax, eax
je 0x1400344e1
mov eax, dword [0x1402573e4]
mov dword [rsp + 0x2d0], eax
lea rax, [rsp + 0x2d4]
mov rdi, rax
xor eax, eax
mov ecx, 0x40c
rep stosb byte [rdi], al
mov rcx, qword [rsp + 0x2708]
call fcn.14001bd90
mov rcx, rax
call fcn.140048030
mov rdx, rax
lea rcx, [rsp + 0x2d0]
call fcn.14001c230
lea rdx, str.___service
lea rcx, [rsp + 0x2d0]
call fcn.14001c230
mov qword [rsp + 0xa0], 0
lea rcx, [rsp + 0x240]
call fcn.14001f530
nop
cmp qword [rsp + 0x2740], 0
je 0x1400340d4
xor eax, eax
mov word [rsp + 0x2c0], ax
lea rax, [rsp + 0x2c2]
mov rdi, rax
xor eax, eax
mov ecx, 6
rep stosb byte [rdi], al
mov edx, 0x18
lea rcx, [rsp + 0x1a0]
call fcn.1400475d0
lea rcx, [rsp + 0x1a0]
call fcn.14001db50
nop
lea r9, [0x140257538]
mov r8, qword [rsp + 0x2740]
lea rdx, [rsp + 0x1a0]
lea rcx, [0x14032af98]
call fcn.14003a5f0
lea rcx, [rsp + 0x1a0]
call fcn.140050660
mov dword [rsp + 0x94], eax
mov dword [rsp + 0x70], 0
jmp 0x140033f99
mov eax, dword [rsp + 0x70]
inc eax
mov dword [rsp + 0x70], eax
mov eax, dword [rsp + 0x94]
cmp dword [rsp + 0x70], eax
jge 0x140034087
movsxd rax, dword [rsp + 0x70]
mov rdx, rax
lea rcx, [rsp + 0x1a0]
call fcn.140021910
mov rcx, rax
call fcn.14001bd90
mov rcx, rax
call fcn.140048800
movzx eax, al
test eax, eax
jne 0x140034082
movsxd rax, dword [rsp + 0x70]
mov rdx, rax
lea rcx, [rsp + 0x1a0]
call fcn.140021910
mov rcx, rax
call fcn.14001bd90
mov rcx, rax
call fcn.140031220
mov qword [rsp + 0xd0], rax
movsxd rcx, dword [rsp + 0x70]
mov rdx, rcx
lea rcx, [rsp + 0x1a0]
call fcn.140021910
mov rcx, rax
call fcn.14001bd90
mov rcx, rax
call fcn.140048030
mov qword [rsp + 0xa8], rax
lea rcx, [rsp + 0x240]
call fcn.14001bd90
mov rcx, qword [rsp + 0xd0]
mov r8, rcx
mov rcx, qword [rsp + 0xa8]
mov rdx, rcx
mov rcx, rax
call fcn.140047b80
lea rcx, [rsp + 0x240]
call fcn.14001bd90
mov r8d, 1
lea rdx, [rsp + 0x2c0]
mov rcx, rax
call fcn.140047b80
jmp 0x140033f8f
lea rcx, [rsp + 0x240]
call fcn.14001bd90
mov r8d, 2
lea rdx, [rsp + 0x2c0]
mov rcx, rax
call fcn.140047b80
lea rcx, [rsp + 0x240]
call fcn.14001bd90
mov rcx, rax
call fcn.140048030
mov qword [rsp + 0xa0], rax
lea rcx, [rsp + 0x1a0]
call fcn.14001fbc0
mov qword [rsp + 0x88], 0
mov qword [rsp + 0x78], 0
mov r8d, 0xf003f
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov qword [rsp + 0x88], rax
cmp qword [rsp + 0x88], 0
jne 0x140034168
mov eax, dword [rsp + 0x74]
mov dword [rsp + 0x9c], eax
lea rcx, [rsp + 0x240]
call fcn.140020590
nop
mov rcx, qword [rsp + 0x2708]
call fcn.140020590
nop
mov rcx, qword [rsp + 0x2710]
call fcn.140020590
nop
mov rcx, qword [rsp + 0x2718]
call fcn.140020590
nop
mov rcx, qword [rsp + 0x2720]
call fcn.140020590
mov eax, dword [rsp + 0x9c]
jmp 0x1400348b7
mov rcx, qword [rsp + 0x2718]
call fcn.14001bd90
mov rcx, rax
call fcn.140048800
movzx eax, al
test eax, eax
je 0x140034199
mov rdx, qword [rsp + 0x2710]
mov rcx, qword [rsp + 0x2718]
call fcn.1400211f0
mov rcx, qword [rsp + 0x2720]
call fcn.14001bd90
mov rcx, rax
call fcn.140048800
movzx eax, al
test eax, eax
je 0x1400341ca
mov rdx, qword [rsp + 0x2718]
mov rcx, qword [rsp + 0x2720]
call fcn.1400211f0
mov rcx, qword [rsp + 0x2710]
call fcn.14001bd90
mov rcx, rax
call fcn.140048030
mov r8d, 0xf01ff
mov rdx, rax
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov qword [rsp + 0x78], rax
cmp qword [rsp + 0x78], 0
jne 0x1400342bd
mov rcx, qword [rsp + 0x2718]
call fcn.14001bd90
mov rcx, rax
call fcn.140048030
mov qword [rsp + 0xd8], rax
mov rcx, qword [rsp + 0x2710]
call fcn.14001bd90
mov rcx, rax
call fcn.140048030
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x58], 0
mov rcx, qword [rsp + 0xa0]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], 0
mov rcx, qword [rsp + 0x2738]
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x2d0]
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], 1
mov ecx, dword [rsp + 0x2728]
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], 0x110
mov r9d, 0xf01ff
mov rcx, qword [rsp + 0xd8]
mov r8, rcx
mov rdx, rax
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov qword [rsp + 0x78], rax
cmp qword [rsp + 0x78], 0
je 0x1400344c3
mov dword [rsp + 0x188], 0
lea rax, [rsp + 0x6e0]
mov rdi, rax
xor eax, eax
mov ecx, 0x2000
rep stosb byte [rdi], al
lea r9, [rsp + 0x188]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
jne 0x1400344b8
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1400344b8
mov dword [rsp + 0x90], 0
mov qword [rsp + 0x80], 0
mov eax, dword [rsp + 0x188]
cmp rax, 0x2000
jbe 0x140034389
mov eax, dword [rsp + 0x188]
mov qword [rsp + 0xc0], rax
mov eax, 2
mov rcx, qword [rsp + 0xc0]
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.14006dfa0
mov qword [rsp + 0xc8], rax
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x80], rax
jmp 0x140034399
lea rax, [rsp + 0x6e0]
mov qword [rsp + 0x80], rax
cmp qword [rsp + 0x80], 0
je 0x140034486
lea r9, [rsp + 0x188]
mov r8d, dword [rsp + 0x188]
mov rdx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
test eax, eax
je 0x140034486
mov rcx, qword [rsp + 0x2718]
call fcn.14001bd90
mov rcx, rax
call fcn.140048030
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov rax, qword [rsp + 0x2738]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x2d0]
mov qword [rsp + 0x20], rax
mov r9d, 1
mov r8d, dword [rsp + 0x2728]
mov edx, 0x110
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov dword [rsp + 0x74], eax
mov rcx, qword [rsp + 0x2720]
call fcn.14001bd90
mov rcx, rax
call fcn.140048030
mov qword [rsp + 0x190], rax
lea r8, [rsp + 0x190]
mov edx, 1
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
cmp dword [rsp + 0x90], 0
je 0x1400344b8
cmp qword [rsp + 0x80], 0
je 0x1400344b8
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0xb0], rax
mov rcx, qword [rsp + 0xb0]
call fcn.14006dfa8
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
lea rcx, [rsp + 0x240]
call fcn.140020590
jmp 0x140034533
lea rax, [rsp + 0x100]
mov qword [rsp + 0xb8], rax
mov rax, qword [rsp + 0x2700]
add rax, 0x250
mov rdx, rax
mov rcx, qword [rsp + 0xb8]
call fcn.14001f4b0
mov qword [rsp + 0xe0], rax
xor r8d, r8d
mov rdx, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0x2700]
call fcn.140042470
mov dword [rsp + 0x74], eax
cmp dword [rsp + 0x74], 0
je 0x14003486e
mov qword [rsp + 0x180], 0
lea rcx, [rsp + 0x1c0]
call fcn.14001f530
nop
mov eax, dword [rsp + 0x2730]
and eax, 1
cmp eax, 1
jne 0x140034665
lea rdx, [0x140257cc0]
lea rcx, [rsp + 0x1c0]
call fcn.140021260
mov rdx, qword [rsp + 0x2710]
lea rcx, [rsp + 0x1c0]
call fcn.140022eb0
mov dword [rsp + 0x19c], 0
lea rcx, [rsp + 0x1c0]
call fcn.14001bd90
mov rcx, rax
call fcn.140048030
lea rcx, [rsp + 0x19c]
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x180]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140034663
mov rcx, qword [rsp + 0x2710]
call fcn.140047ff0
mov qword [rsp + 0xf0], rax
mov rcx, qword [rsp + 0x2710]
call fcn.14001bd90
mov rcx, rax
call fcn.140048030
mov rcx, qword [rsp + 0xf0]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x180]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x180]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400346dc
lea rdx, str.SYSTEMCurrentControlSetControlSafeBootMinimal
lea rcx, [rsp + 0x1c0]
call fcn.140021260
lea rcx, [rsp + 0x1c0]
call fcn.140021b20
lea rcx, [rsp + 0x180]
mov qword [rsp + 0x20], rcx
mov r9d, 2
xor r8d, r8d
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400346dc
mov rcx, qword [rsp + 0x2710]
call fcn.140021b20
mov rdx, rax
mov rcx, qword [rsp + 0x180]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rcx, qword [rsp + 0x180]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x2730]
and eax, 2
cmp eax, 2
jne 0x1400347e9
lea rdx, [0x1402581c0]
lea rcx, [rsp + 0x1c0]
call fcn.140021260
mov rdx, qword [rsp + 0x2710]
lea rcx, [rsp + 0x1c0]
call fcn.140022eb0
mov dword [rsp + 0x198], 0
lea rcx, [rsp + 0x1c0]
call fcn.14001bd90
mov rcx, rax
call fcn.140048030
lea rcx, [rsp + 0x198]
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x180]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400347e7
mov rcx, qword [rsp + 0x2710]
call fcn.140047ff0
mov qword [rsp + 0xe8], rax
mov rcx, qword [rsp + 0x2710]
call fcn.14001bd90
mov rcx, rax
call fcn.140048030
mov rcx, qword [rsp + 0xe8]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x180]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x180]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140034861
lea rdx, str.SYSTEMCurrentControlSetControlSafeBootNetwork
lea rcx, [rsp + 0x1c0]
call fcn.140021260
lea rcx, [rsp + 0x1c0]
call fcn.140021b20
lea rcx, [rsp + 0x180]
mov qword [rsp + 0x20], rcx
mov r9d, 2
xor r8d, r8d
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140034861
mov rcx, qword [rsp + 0x2710]
call fcn.140021b20
mov rdx, rax
mov rcx, qword [rsp + 0x180]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rcx, qword [rsp + 0x180]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rsp + 0x1c0]
call fcn.140020590
mov eax, dword [rsp + 0x74]
mov dword [rsp + 0x98], eax
mov rcx, qword [rsp + 0x2708]
call fcn.140020590
nop
mov rcx, qword [rsp + 0x2710]
call fcn.140020590
nop
mov rcx, qword [rsp + 0x2718]
call fcn.140020590
nop
mov rcx, qword [rsp + 0x2720]
call fcn.140020590
mov eax, dword [rsp + 0x98]
mov rcx, qword [rsp + 0x26e0]
xor rcx, rsp
call fcn.1401fe250
add rsp, 0x26f0
pop rdi
ret