Function at 0x1400077d0
Capabilities:
Persist via windows service
Set registry value

Disassembly:
sub rsp, 0x168
mov rax, qword [0x1400201b0]
xor rax, rsp
mov qword [rsp + 0x150], rax
lea rcx, [0x1400217e8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x1400218f8], 0
je 0x140007834
lea rcx, [0x1400217e8]
mov dword [0x1400218f4], 1
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x1400218f8]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140009d20
add rsp, 0x168
ret
mov eax, dword [0x1400200ec]
mov qword [rsp + 0x170], rbx
mov qword [rsp + 0x178], rsi
test al, 1
mov qword [rsp + 0x160], rdi
je 0x1400078ee
call fcn.140008ed0
cmp eax, 1
jne 0x1400078da
call fcn.140009450
cmp eax, 1
jne 0x1400078da
mov eax, dword [0x140020138]
mov dword [0x1400218fc], 7
cmp eax, 7
jbe 0x140007896
add eax, 0xfffffff9
lea rdi, [0x14002179c]
mov ecx, eax
mov eax, 1
rep stosd dword [rdi], eax
mov edx, dword [0x14002012c]
xor ebx, ebx
lea rsi, [0x140021780]
mov eax, edx
mov ecx, ebx
shr eax, cl
test al, 1
jne 0x1400078b5
mov dword [rsi], 1
add ebx, 1
add rsi, 4
cmp ebx, 7
jb 0x1400078a5
mov dword [0x1400218f8], 1
mov dword [0x1400218f4], 1
jmp 0x140007aff
mov eax, dword [0x1400218f8]
test eax, eax
jne 0x140007ae2
mov eax, dword [0x1400200ec]
test al, 2
je 0x140007b5e
mov ecx, dword [0x1400218f0]
call fcn.140003360
cmp eax, 1
jne 0x140007adc
call fcn.140003400
test eax, eax
je 0x140007adc
xor eax, eax
lea r8, [rsp + 0x30]
xor edx, edx
mov qword [0x140021778], rax
mov ecx, 0x4e464741
mov dword [0x140021778], 0x8000
mov qword [0x140021768], rax
mov qword [0x140021770], rax
call fcn.140003100
xor ebx, ebx
test eax, eax
lea rsi, [0x140021780]
jne 0x140007a30
cmp dword [rsp + 0x30], ebx
je 0x140007a30
call fcn.140006e20
cmp eax, 0x100
jb 0x140007a1d
cmp eax, 0x101
jbe 0x1400079f0
cmp eax, 0x110
jne 0x140007a1d
mov edx, dword [rsp + 0x30]
mov r8d, edx
and edx, 0xfff
and r8d, 0xfffff000
shl edx, 0xc
mov dword [0x140021760], edx
mov dword [0x140021768], r8d
je 0x1400079b4
cmp edx, 0x8000
jbe 0x1400079bf
mov edx, 0x8000
mov dword [0x140021760], edx
mov eax, dword [0x140020138]
mov dword [0x140021778], edx
shr edx, 0xb
cmp edx, eax
mov dword [0x1400218fc], edx
jae 0x140007a89
sub eax, edx
lea rdi, [rsi + rdx*4]
mov ecx, eax
mov eax, 1
rep stosd dword [rdi], eax
jmp 0x140007a89
mov r8d, dword [rsp + 0x30]
mov edx, 0x10
mov dword [0x140021760], 0x8000
mov dword [0x140021778], 0x8000
mov dword [0x1400218fc], edx
mov dword [0x140021768], r8d
jmp 0x140007a89
mov dword [0x140021768], ebx
mov dword [0x140021778], ebx
xor eax, eax
jmp 0x140007bfa
cmp dword [0x1400217e4], 0x600
jae 0x140007a7a
mov eax, dword [0x140020138]
mov edx, 2
mov dword [0x140021764], 1
cmp eax, edx
mov dword [0x140021778], 0x1000
mov dword [0x1400218fc], edx
jbe 0x140007a80
add eax, 0xfffffffe
lea rdi, [0x140021788]
mov ecx, eax
mov eax, 1
rep stosd dword [rdi], eax
jmp 0x140007a80
mov edx, dword [0x1400218fc]
mov r8d, ebx
mov dword [0x140021768], ebx
cmp dword [0x140021764], ebx
jne 0x140007a96
test r8d, r8d
je 0x140007adc
test edx, edx
je 0x140007abb
mov edi, dword [0x14002012c]
mov eax, edi
mov ecx, ebx
shr eax, cl
test al, 1
jne 0x140007ab0
mov dword [rsi], 1
add ebx, 1
add rsi, 4
cmp ebx, edx
jb 0x140007aa0
mov dword [0x1400218f8], 2
mov dword [0x1400218f4], 1
call fcn.1400076a0
mov eax, dword [0x1400218f8]
jmp 0x140007ae2
mov eax, dword [0x1400218f8]
cmp eax, 2
jne 0x140007afa
lea r8, [rsp + 0x38]
xor edx, edx
mov ecx, 0x54494e49
call fcn.140003100
jmp 0x140007b10
cmp eax, 1
jne 0x140007b5e
lea r8, [rsp + 0x38]
xor edx, edx
mov ecx, 0x54494e49
call fcn.140008c70
cmp dword [0x1400218f8], 1
jne 0x140007b5e
lea r8, [rsp + 0x38]
xor edx, edx
mov ecx, 0x474f4457
call fcn.140008c70
test eax, eax
jne 0x140007b5e
mov r8d, dword [rsp + 0x38]
lea eax, [r8 - 1]
cmp eax, 0x12b
ja 0x140007b5e
mov rcx, qword [0x1400218e8]
imul r8d, r8d, 0x3e8
xor r9d, r9d
xor edx, edx
mov dword [0x140021900], r8d
call qword [sym.imp.USER32.dll_SetTimer]
lea rcx, [0x1400217e8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edx, dword [0x1400218f8]
lea r8, str.SYSTEMCurrentControlSetServices_
mov dword [rsp + 0x30], edx
lea rcx, [rsp + 0x50]
mov edx, 0x80
call fcn.140009e60
lea r8, [0x1400200b8]
lea rcx, [rsp + 0x50]
mov edx, 0x80
call fcn.14000b2c0
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x50]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x140007bf4
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
lea rdx, str.CurrentServiceMode
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x1400218f8]
mov rsi, qword [rsp + 0x178]
mov rbx, qword [rsp + 0x170]
mov rdi, qword [rsp + 0x160]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140009d20
add rsp, 0x168
ret