Function at 0x1401366c0
Capabilities:
Persist via windows service
Set registry value

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x220
mov qword [rsp + 0x1e0], 0xfffffffffffffffe
lea rdx, str.SYSTEMCurrentControlSetServicesEventLog_
lea rcx, [rsp + 0x60]
call fcn.14000ffd0
nop
mov rdx, qword [rsp + 0x230]
add rdx, 0x68
mov r9, qword [0x14019e5a0]
xor r8d, r8d
lea rcx, [rsp + 0x60]
call fcn.14002de50
xor eax, eax
mov rcx, 0xffffffffffffffff
lea rdi, [0x140185e4c]
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
mov qword [rsp + 0x128], rcx
mov r8, qword [rsp + 0x128]
lea rdx, [0x140185e4c]
lea rcx, [rsp + 0x60]
call fcn.14002d980
mov rdx, qword [rsp + 0x230]
add rdx, 0x18
mov r9, qword [0x14019e5a0]
xor r8d, r8d
lea rcx, [rsp + 0x60]
call fcn.14002de50
lea rax, [rsp + 0x130]
mov qword [rsp + 0x138], rax
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x88]
call fcn.1400010c0
nop
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x60]
call fcn.140043d00
cmp qword [rsp + 0xa8], 8
jb 0x1401367b7
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x1e8], rax
jmp 0x1401367c7
lea rax, [rsp + 0x90]
mov qword [rsp + 0x1e8], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x1e8]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
je 0x140136844
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x88]
call fcn.1400010c0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x60]
call fcn.140011d00
jmp 0x140136ad8
cmp dword [rsp + 0xb0], 1
jne 0x140136aaa
lea rax, [rsp + 0x140]
mov qword [rsp + 0x148], rax
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0xb8]
call fcn.1400010c0
nop
cmp qword [rsp + 0xd0], 0
jne 0x14013688d
mov dword [rsp + 0x1f0], 1
jmp 0x140136898
mov dword [rsp + 0x1f0], 0
movzx eax, byte [rsp + 0x1f0]
test eax, eax
je 0x140136902
lea rdx, str.PocoMsg.dll
lea rcx, [rsp + 0xe8]
call fcn.140136af0
mov qword [rsp + 0x1f8], rax
mov rax, qword [rsp + 0x1f8]
mov qword [rsp + 0x150], rax
mov r9, qword [0x14019e5a0]
xor r8d, r8d
mov rdx, qword [rsp + 0x150]
lea rcx, [rsp + 0xb8]
call fcn.1400012a0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0xe8]
call fcn.1400010c0
cmp qword [rsp + 0xd0], 0
jne 0x14013691a
mov dword [rsp + 0x200], 1
jmp 0x140136925
mov dword [rsp + 0x200], 0
movzx eax, byte [rsp + 0x200]
test eax, eax
jne 0x140136a98
mov dword [rsp + 0xe0], 8
mov dword [rsp + 0xe4], 7
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x158], rax
cmp qword [rsp + 0xd8], 8
jb 0x140136978
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x208], rax
jmp 0x140136988
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x208], rax
mov rax, qword [rsp + 0x158]
lea rax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x208]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.CategoryMessageFile
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rdx, qword [rsp + 0xd0]
mov qword [rsp + 0x160], rdx
cmp qword [rsp + 0xd8], 8
jb 0x1401369ee
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x210], rax
jmp 0x1401369fe
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x210], rax
mov rax, qword [rsp + 0x160]
lea rax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x210]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.EventMessageFile
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.CategoryCount
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0xe4]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.TypesSupported
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0xb8]
call fcn.1400010c0
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x88]
call fcn.1400010c0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x60]
call fcn.140011d00
add rsp, 0x220
pop rdi
ret