Function at 0x180016600
Capabilities:
Check if file exists
Create process on windows
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push rbx
push rdi
sub rsp, 0x58
xor edi, edi
mov dword [0x18006b348], edi
call fcn.1800047e0
test al, al
je 0x18001671b
mov dword [rsp + 0x70], 4
lea rax, [rsp + 0x88]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSet_servicesdnscache
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1800166a1
lea rax, [rsp + 0x80]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x70]
xor r8d, r8d
lea rdx, str.Start
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1800166a1
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x78], 2
je 0x18001671b
jmp 0x1800166af
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x78], 2
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0xf013f
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSet_servicesdnscache
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x180016710
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Start
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, str.dnscache
call fcn.1800057c0
test al, al
jne 0x180016749
xor edx, edx
lea rcx, str.cmd__c_sc_config_dnscache_start_auto___filelog.log
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.cmd__c_sc.exe_start_dnscache___filelog.log
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, str.filelog.log
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x180016777
lea rcx, str.filelog.log
call fcn.18003231c
cmp eax, 0xffffffff
jne 0x180016777
lea rcx, str.filelog.log
call fcn.180006570
cmp qword [0x18006ba28], rdi
jbe 0x18001681b
mov qword [rsp + 0x40], rdi
mov ecx, 0x20
call fcn.180023694
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov r8, qword [0x18006ba20]
mov qword [rsp + 0x38], r8
mov qword [0x18006ba20], rax
mov rcx, qword [rsp + 0x40]
mov rax, qword [0x18006ba28]
mov qword [rsp + 0x40], rax
mov qword [0x18006ba28], rcx
mov rbx, qword [r8 + 8]
cmp byte [rbx + 0x19], dil
jne 0x18001680e
nop dword [rax]
mov r8, qword [rbx + 0x10]
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x38]
call fcn.180019a90
mov rcx, rbx
mov rbx, qword [rbx]
mov edx, 0x20
call fcn.18002368c
cmp byte [rbx + 0x19], dil
je 0x1800167e0
mov r8, qword [rsp + 0x38]
mov edx, 0x20
mov rcx, r8
call fcn.18002368c
lea rcx, [0x18006ba90]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp byte [0x18006bb34], dil
je 0x180016879
cmp qword [0x180068dc8], 0xffffffffffffffff
je 0x180016879
lea rcx, [0x18006ba90]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, 0x11
call fcn.180030000
mov rbx, rax
test rax, rax
je 0x180016886
mov qword [rax + 4], rdi
mov dword [rax], 0x12
mov dword [rax + 0xc], edi
mov rcx, rax
call fcn.18001b700
mov rcx, rbx
call fcn.180029a20
jmp 0x180016886
lea rcx, [0x18006ba90]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.18001eb80
call fcn.18001d960
mov eax, 1
jmp 0x180016899
add rsp, 0x58
pop rdi
pop rbx
ret