Function at 0x1400011d0
Capabilities:
Access the windows event log
Persist via windows service
Set registry value

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x260
xor ebx, ebx
movzx r15d, r8w
mov rsi, rdx
mov r14d, ecx
movzx edi, bx
test rdx, rdx
je 0x140001201
movzx eax, di
cmp qword [rdx + rax*8], rbx
je 0x140001201
inc di
jmp 0x1400011f3
cmp dword [0x14000544c], ebx
mov qword [rsp + 0x290], rbp
je 0x1400012ee
movzx ecx, r15w
sub ecx, 1
je 0x140001243
sub ecx, 1
je 0x14000123a
cmp ecx, 2
je 0x140001231
lea rbp, str.Message
jmp 0x14000124a
lea rbp, str.Info
jmp 0x14000124a
lea rbp, str.Warning
jmp 0x14000124a
lea rbp, str.Error
mov rdx, qword [0x140005458]
lea rax, [rsp + 0x298]
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], ebx
mov r8d, r14d
mov ecx, 0x2900
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
mov r8d, r14d
mov rdx, rbp
test eax, eax
jne 0x1400012c2
lea rcx, str._s_0x_X___No_message_available_nMessage_inserts_were
call fcn.140001a00
movzx edi, di
test rdi, rdi
je 0x1400012e4
nop word [rax + rax]
mov rdx, qword [rsi + rbx*8]
lea rcx, str._s_
call fcn.140001a00
inc rbx
cmp rbx, rdi
jl 0x1400012a0
mov eax, 1
jmp 0x1400014f2
mov r9, qword [rsp + 0x298]
lea rcx, str._s_0x_X____s
call fcn.140001a00
mov rcx, qword [rsp + 0x298]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, 1
jmp 0x1400014f2
cmp dword [0x140005448], ebx
mov qword [rsp + 0x2a0], r12
lea r12, str.Python_Service
jne 0x14000149f
cmp word [0x140005240], bx
lea rbp, [0x140005240]
jne 0x14000132f
mov rcx, qword [0x140005458]
mov r8d, 0x104
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
movaps xmm0, xmmword [str.SYSTEMCurrentControlSetServicesEventLogApplication_]
lea rcx, [rsp + 0x50]
movaps xmm1, xmmword [0x1400033a0]
sub rcx, 2
movaps xmmword [rsp + 0x50], xmm0
movaps xmm0, xmmword [0x1400033b0]
movaps xmmword [rsp + 0x70], xmm0
movaps xmm0, xmmword [0x1400033d0]
movaps xmmword [rsp + 0x60], xmm1
movaps xmm1, xmmword [0x1400033c0]
movaps xmmword [rsp + 0x90], xmm0
movaps xmm0, xmmword [0x1400033f0]
movaps xmmword [rsp + 0x80], xmm1
movaps xmm1, xmmword [0x1400033e0]
movaps xmmword [rsp + 0xb0], xmm0
movaps xmmword [rsp + 0xa0], xmm1
nop dword [rax + rax]
cmp word [rcx + 2], bx
lea rcx, [rcx + 2]
jne 0x1400013a0
xor edx, edx
nop dword [rax]
movzx eax, word [r12 + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x1400013b0
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x2a8]
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], 0x20006
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140001495
mov rax, 0xffffffffffffffff
nop dword [rax]
cmp word [rbp + rax*2 + 2], bx
lea rax, [rax + 1]
jne 0x140001410
mov rcx, qword [rsp + 0x2a8]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
lea rdx, str.EventMessageFile
mov r9d, 1
mov qword [rsp + 0x20], rbp
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x2a8]
lea rax, [rsp + 0x298]
mov dword [rsp + 0x28], 4
lea rdx, str.TypesSupported
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x298], 7
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x2a8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x140005448], 1
mov rdx, r12
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov r12, qword [rsp + 0x2a0]
mov rbp, rax
test rax, rax
je 0x1400014f2
mov qword [rsp + 0x40], rbx
xor r8d, r8d
mov qword [rsp + 0x38], rsi
mov r9d, r14d
mov dword [rsp + 0x30], ebx
movzx edx, r15w
mov word [rsp + 0x28], di
mov rcx, rbp
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
mov rcx, rbp
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov eax, ebx
mov rbp, qword [rsp + 0x290]
add rsp, 0x260
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret