Function at 0x140001560
Capabilities:
Access the windows event log
Persist via windows service
Set registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x140006008]
xor rax, rsp
mov qword [rsp + 0x270], rax
xor ebx, ebx
mov rsi, rdx
movzx edi, bx
test rdx, rdx
je 0x14000159e
nop word [rax + rax]
movzx eax, di
cmp qword [rdx + rax*8], rbx
je 0x14000159e
inc di
jmp 0x140001590
cmp dword [0x140006844], ebx
je 0x140001648
mov rdx, qword [0x140006a58]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], ebx
mov r8d, 0xc000000e
mov ecx, 0x2900
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
mov r8d, 0xc000000e
lea rdx, str.Error
test eax, eax
jne 0x140001622
lea rcx, str._s_0x_X___No_message_available_nMessage_inserts_were
call fcn.140001060
movzx edi, di
test rdi, rdi
je 0x14000163e
nop dword [rax]
mov rdx, qword [rsi + rbx*8]
lea rcx, str._s_
call fcn.140001060
inc rbx
cmp rbx, rdi
jl 0x140001600
mov eax, 1
jmp 0x140001843
mov r9, qword [rsp + 0x50]
lea rcx, str._s_0x_X____s
call fcn.140001060
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, 1
jmp 0x140001843
cmp word [0x140006850], bx
mov qword [rsp + 0x2a0], rbp
lea rbp, [0x140006850]
mov qword [rsp + 0x2b0], r14
jne 0x14000167e
mov rcx, qword [0x140006a58]
mov r8d, 0x104
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
movaps xmm0, xmmword [str.SYSTEMCurrentControlSetServicesEventLogApplication_]
lea rcx, [rsp + 0x60]
movaps xmm1, xmmword [0x140004420]
sub rcx, 2
movaps xmmword [rsp + 0x60], xmm0
movaps xmm0, xmmword [0x140004430]
movaps xmmword [rsp + 0x80], xmm0
movaps xmm0, xmmword [0x140004450]
movaps xmmword [rsp + 0x70], xmm1
movaps xmm1, xmmword [0x140004440]
movaps xmmword [rsp + 0xa0], xmm0
movaps xmm0, xmmword [0x140004470]
movaps xmmword [rsp + 0x90], xmm1
movaps xmm1, xmmword [0x140004460]
movaps xmmword [rsp + 0xc0], xmm0
movaps xmmword [rsp + 0xb0], xmm1
nop word [rax + rax]
cmp word [rcx + 2], bx
lea rcx, [rcx + 2]
jne 0x1400016f0
lea r14, str.Python_Service
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx eax, word [r14 + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x140001710
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], 0x20006
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400017db
mov rax, 0xffffffffffffffff
cmp word [rbp + rax*2 + 2], bx
lea rax, [rax + 1]
jne 0x140001765
mov rcx, qword [rsp + 0x50]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
lea rdx, str.EventMessageFile
mov r9d, 1
mov qword [rsp + 0x20], rbp
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x58]
mov dword [rsp + 0x28], 4
lea rdx, str.TypesSupported
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x58], 7
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, r14
mov dword [0x140006840], 1
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov r14, qword [rsp + 0x2b0]
mov rbp, rax
test rax, rax
je 0x14000183b
mov qword [rsp + 0x40], rbx
xor r8d, r8d
mov qword [rsp + 0x38], rsi
mov r9d, 0xc000000e
mov dword [rsp + 0x30], ebx
mov rcx, rbp
mov word [rsp + 0x28], di
lea edx, [r8 + 1]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbp
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov eax, ebx
mov rbp, qword [rsp + 0x2a0]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140001be0
add rsp, 0x280
pop rdi
pop rsi
pop rbx
ret