Function at 0x140005940
Capabilities:
Create process on windows
Delete registry value
Modify service
Schedule task via schtasks
Set registry value

Disassembly:
mov rax, rsp
push r12
push r14
push r15
sub rsp, 0x1a0
mov qword [rax - 0xd8], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x14014c228]
xor rax, rsp
mov qword [rsp + 0x198], rax
movzx r12d, dl
mov r15, rcx
mov dword [rsp + 0x60], 0x80004005
call fcn.140010040
test eax, eax
je 0x140005cf9
lea rax, str.APPID
mov qword [rsp + 0xe8], rax
lea rbx, str.2CA75AD3_A844_4DF9_999D_CB82069C55C3
mov qword [rsp + 0xf0], rbx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0xf8], xmm0
lea r9, [rsp + 0xe8]
mov edx, 0x65
lea r8d, [rdx - 0x64]
mov rcx, qword [0x14015b0f8]
call fcn.140010610
mov esi, eax
xor edi, edi
test eax, eax
js 0x140005ab5
mov qword [rsp + 0x88], rdi
mov dword [rsp + 0x90], edi
mov qword [rsp + 0x98], rdi
mov r9d, 0x20006
lea r8, str.AppID
mov rdx, 0xffffffff80000000
lea rcx, [rsp + 0x88]
call fcn.14000da90
test eax, eax
je 0x140005a3c
mov ecx, eax
call fcn.14000c270
mov esi, eax
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x140005ab5
jmp 0x140005aaf
mov qword [rsp + 0xa0], rdi
mov dword [rsp + 0xa8], edi
mov qword [rsp + 0xb0], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], edi
xor r9d, r9d
mov r8, rbx
mov rbx, qword [rsp + 0x88]
mov rdx, rbx
lea rcx, [rsp + 0xa0]
call fcn.14000c4d0
test eax, eax
je 0x140005ac2
mov ecx, eax
call fcn.14000c270
mov esi, eax
mov rcx, qword [rsp + 0xa0]
test rcx, rcx
je 0x140005aa7
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rbx, rbx
je 0x140005ab5
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jns 0x140005b72
jmp 0x140005cfb
lea rdx, str.LocalService
mov r14, qword [rsp + 0xa0]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test r12b, r12b
je 0x140005b56
lea rcx, [r15 + 0x48]
mov rsi, 0xffffffffffffffff
test rcx, rcx
je 0x140005b25
mov rax, rsi
lea rax, [rax + 1]
cmp word [rcx + rax*2], di
jne 0x140005af2
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
lea rdx, str.LocalService
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, r15
call fcn.14000d1d0
test eax, eax
jne 0x140005b56
test r14, r14
je 0x140005b3f
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rbx, rbx
je 0x140005d02
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140005d02
test r14, r14
je 0x140005b64
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rbx, rbx
je 0x140005b72
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
mov qword [rsp + 0x70], rax
test rax, rax
je 0x140005dda
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_LockServiceDatabase]
mov r14, rax
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x68], rdi
test rax, rax
je 0x140005e0d
add r15, 0x48
mov r8d, 0x12
mov rdx, r15
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
mov qword [rsp + 0x68], rax
test rax, rax
je 0x140005e35
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
mov edx, 0x10
mov r9d, 0xffffffff
lea r8d, [rdx - 0xe]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
je 0x140005e5d
mov qword [rsp + 0x80], r15
lea r8, [rsp + 0x80]
mov edx, 1
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
je 0x140005e85
mov qword [rsp + 0x180], 1
mov dword [rsp + 0x188], 1
mov qword [rsp + 0x18c], 0x1d4c0
mov dword [rsp + 0x194], edi
mov qword [rsp + 0xb8], 0x15180
mov qword [rsp + 0xd0], 3
xorps xmm0, xmm0
movdqu xmmword [rsp + 0xc0], xmm0
lea rax, [rsp + 0x180]
mov qword [rsp + 0xd8], rax
lea r8, [rsp + 0xb8]
mov edx, 2
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
test eax, eax
je 0x140005ead
mov dword [rsp + 0x60], edi
jmp 0x140005cd7
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_UnlockServiceDatabase]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, edi
jmp 0x140005ddf
xor edi, edi
mov rsi, 0xffffffffffffffff
call fcn.14000ce10
mov rcx, rax
test rax, rax
je 0x140005ed6
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x70]
call fcn.14000cc90
mov rbx, rax
lea rcx, [rsp + 0x78]
call fcn.14000cb10
nop
mov rcx, qword [0x14015b1c8]
mov qword [rsp + 0x20], rcx
mov r9, qword [rbx]
mov r8, qword [rax]
lea rdx, str._Create__SC_ONLOGON__TN__install_pulse_service___TR___s_s__Service__s___RL_HIGHEST__F
lea rcx, [rsp + 0x68]
call fcn.14000c9f0
nop
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140005d7d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140005d9b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
mov rbx, qword [rsp + 0x68]
mov r9, rbx
lea r8, str.schtasks.exe
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x140005dda
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, 0x80004005
mov rcx, qword [rsp + 0x198]
xor rcx, rsp
call fcn.1400a79f0
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
lea rdx, str.LockServiceDatabase_FAILED
lea rcx, [rsp + 0x108]
call fcn.140009c40
lea rdx, [0x140145de0]
lea rcx, [rsp + 0x108]
call fcn.1400ae2cc
lea rdx, str.OpenService_FAILED
lea rcx, [rsp + 0x120]
call fcn.140009c40
lea rdx, [0x140145de0]
lea rcx, [rsp + 0x120]
call fcn.1400ae2cc
lea rdx, str.ChangeServiceConfig_FAILED
lea rcx, [rsp + 0x138]
call fcn.140009c40
lea rdx, [0x140145de0]
lea rcx, [rsp + 0x138]
call fcn.1400ae2cc
lea rdx, str.ChangeServiceConfig2_FAILED
lea rcx, [rsp + 0x150]
call fcn.140009c40
lea rdx, [0x140145de0]
lea rcx, [rsp + 0x150]
call fcn.1400ae2cc
lea rdx, str.ChangeServiceConfig2_FAILED
lea rcx, [rsp + 0x168]
call fcn.140009c40
lea rdx, [0x140145de0]
lea rcx, [rsp + 0x168]
call fcn.1400ae2cc
nop
mov ecx, 0x80004005
call fcn.14000c310
int3