Function at 0x1400019f4
Capabilities:
Persist via windows service
Set registry value
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp + 8], ecx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
xor ebx, ebx
movsxd rax, ecx
mov dword [0x14000d734], 0xaa
mov ecx, 0xfff
mov dword [0x14001027c], ecx
mov r15, rdx
lea r12d, [rbx + 1]
test eax, eax
je 0x140001ff7
mov qword [rbp - 0x10], rax
mov esi, ebx
test rax, rax
jle 0x140001ff7
mov r14d, ebx
mov rdi, qword [r15 + r14*8]
lea rcx, [0x140010cb4]
mov qword [rbp - 0x18], rcx
mov r8d, 0x23
mov byte [rbp + 0x50], bl
mov r13d, ebx
lea rdx, [0x140010ca2]
movsxd rax, r13d
imul rax, rax, 0x58
add rax, rdx
mov edx, r8d
mov qword [rbp - 8], rax
mov eax, dword [rcx]
mov rcx, rdi
mov dword [rbp + 0x58], eax
call qword [sym.imp.msvcrt.dll_wcschr]
nop dword [rax + rax]
mov r12, rax
test rax, rax
je 0x140001aa0
mov word [rax], bx
add r12, 2
mov rdx, qword [rbp - 8]
lea r8, [rbp + 0x50]
mov rcx, rdi
call fcn.14000213c
test al, al
jne 0x140001f21
mov r8d, 0x23
test r12, r12
je 0x140001ac9
mov word [r12 - 2], r8w
mov rcx, qword [rbp - 0x18]
mov r12d, 1
add rcx, 0x58
add r13d, r12d
mov qword [rbp - 0x18], rcx
cmp r13d, 0x11
jl 0x140001a65
lea r8, [rbp + 0x50]
mov rcx, rdi
lea rdx, str.indent
call fcn.14000213c
test al, al
je 0x140001b09
mov al, byte [rbp + 0x50]
mov byte [0x1400102a0], al
jmp 0x140001fd1
lea rdx, [0x140009848]
mov rcx, rdi
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
je 0x140001f01
lea rdx, [0x140009850]
mov rcx, rdi
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
je 0x140001f01
lea rdx, [0x140009858]
mov rcx, rdi
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
je 0x140001ea3
lea rdx, [0x140009860]
mov rcx, rdi
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
je 0x140001ea3
lea rdx, [0x1400098b8]
mov rcx, rdi
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
je 0x140001e53
lea rdx, [0x1400098c0]
mov rcx, rdi
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
je 0x140001e53
lea rdx, [0x140009968]
mov rcx, rdi
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
je 0x140001e2c
lea rdx, str._etl
mov rcx, rdi
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
je 0x140001e2c
lea rdx, [0x140009988]
mov rcx, rdi
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
je 0x1400020ff
lea rdx, str._clear
mov rcx, rdi
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
je 0x1400020ff
lea r8, [rbp + 0x50]
mov rcx, rdi
lea rdx, [0x1400099a8]
call fcn.14000213c
lea r13, [0x1400099b0]
test al, al
jne 0x140001d11
lea r8, [rbp + 0x50]
mov rdx, r13
mov rcx, rdi
call fcn.14000213c
test al, al
jne 0x140001d11
lea rdx, [0x140009a40]
mov rcx, rdi
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
je 0x140001cda
lea rdx, str._help
mov rcx, rdi
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
je 0x140001cda
lea rdx, [0x140009a5c]
mov rcx, rdi
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
je 0x140001cda
lea rdx, [0x140009a64]
mov rcx, rdi
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140001fd1
lea eax, [rsi + 1]
cmp eax, dword [rbp + 0x40]
jge 0x140001ef3
movsxd rdi, esi
lea rdx, str.modules
mov rcx, qword [r15 + rdi*8 + 8]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140002062
mov ecx, r12d
jmp 0x140001ef5
lea r8, [rbp + 0x50]
mov qword [rbp + 0x58], rbx
lea rdx, [0x1400099a8]
mov rcx, rdi
call fcn.14000213c
test al, al
movzx r12d, bl
mov eax, 1
cmovne r12d, eax
add esi, eax
add r14, rax
cmp r14, qword [rbp - 0x10]
jge 0x1400020ec
mov rcx, qword [r15 + r14*8]
lea rdx, [0x1400099b8]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140001d67
or r13d, 0xffffffff
jmp 0x140001d93
mov rcx, qword [r15 + r14*8]
lea rdx, [rbp + 0x58]
xor r8d, r8d
call qword [sym.imp.msvcrt.dll_wcstol]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x58]
mov r13d, eax
test rcx, rcx
je 0x140001d93
cmp word [rcx], bx
jne 0x1400020ae
mov rdi, qword [0x140010288]
test rdi, rdi
jne 0x140001dd0
lea ecx, [rdi + 0x20]
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
je 0x1400020db
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbx
mov qword [0x140010288], rax
mov qword [rax + 8], rax
mov qword [rax], rax
mov ecx, 0x20
call qword [sym.imp.msvcrt.dll_malloc]
nop dword [rax + rax]
mov r8, rax
test rax, rax
je 0x1400020db
mov cl, byte [rbp + 0x50]
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
mov byte [rax + 0x10], cl
mov cl, r12b
neg cl
sbb edx, edx
and edx, r13d
mov dword [rax + 0x14], edx
test r12b, r12b
cmovne r13d, ebx
mov dword [rax + 0x18], r13d
mov rax, qword [rdi + 8]
mov qword [r8], rdi
mov qword [r8 + 8], rax
mov qword [rax], r8
mov qword [rdi + 8], r8
jmp 0x140001fcb
add r14, r12
lea rcx, [0x14000fe40]
add esi, r12d
mov edx, 0x104
mov r8, qword [r15 + r14*8]
call fcn.140001368
mov byte [0x140010059], r12b
jmp 0x140001fd1
add esi, r12d
mov qword [rbp + 0x50], rbx
add r14, r12
cmp r14, qword [rbp - 0x10]
jge 0x140002120
mov rcx, qword [r15 + r14*8]
lea rdx, [rbp + 0x50]
xor r8d, r8d
call qword [sym.imp.msvcrt.dll_wcstol]
nop dword [rax + rax]
mov dword [0x14000d734], eax
mov rax, qword [rbp + 0x50]
test rax, rax
je 0x140001fd1
cmp word [rax], bx
je 0x140001fd1
lea rcx, str.ERROR:_invalid__l__level__value:__s
jmp 0x140001ee7
add r14, r12
mov qword [rbp + 0x50], rbx
xor r8d, r8d
lea rdx, [rbp + 0x50]
add esi, r12d
mov rcx, qword [r15 + r14*8]
call qword [sym.imp.msvcrt.dll_wcstol]
nop dword [rax + rax]
mov dword [0x14001027c], eax
mov rax, qword [rbp + 0x50]
test rax, rax
je 0x140001fd1
cmp word [rax], bx
je 0x140001fd1
lea rcx, str.ERROR:_invalid__f__flags__value:__s
movsxd rdx, esi
mov rdx, qword [r15 + rdx*8]
call fcn.1400034a8
xor ecx, ecx
call fcn.140002fc4
xor al, al
jmp 0x140001ffa
add r14, r12
lea rcx, [0x140010060]
add esi, r12d
mov edx, 0x104
mov r8, qword [r15 + r14*8]
call fcn.140001368
jmp 0x140001fd1
mov eax, 1
cmp byte [rbp + 0x50], al
jne 0x140001f36
mov eax, dword [0x14001027c]
or eax, dword [rbp + 0x58]
jmp 0x140001f41
mov eax, dword [rbp + 0x58]
not eax
and eax, dword [0x14001027c]
mov dword [0x14001027c], eax
test r12, r12
je 0x140001fcb
mov eax, 0x23
mov qword [rbp - 0x18], rbx
mov word [r12 - 2], ax
lea rdx, str.SystemCurrentControlSetServicesVssTracingTraceModules
lea rax, [rbp + 0x58]
mov dword [rbp + 0x58], ebx
mov qword [rsp + 0x40], rax
xor r9d, r9d
lea rax, [rbp - 0x18]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
nop dword [rax + rax]
test eax, eax
je 0x140002013
lea rdx, str.SystemCurrentControlSetServicesVssTracingTraceModules
lea rcx, str.Unable_to_open_tracing_registry_key:__s___x_
mov r8d, eax
call fcn.1400034a8
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov r12d, 1
add esi, r12d
add r14, r12
cmp r14, qword [rbp - 0x10]
jl 0x140001a4a
mov eax, dword [0x14001027c]
mov ecx, 0xfff
test eax, eax
cmove eax, ecx
mov dword [0x14001027c], eax
mov al, r12b
mov rbx, qword [rsp + 0xb8]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
cmp byte [rbp + 0x50], bl
lea rdx, [rdi + 2]
mov eax, ebx
mov ecx, 4
setne al
mov dword [rsp + 0x28], ecx
mov dword [rbp - 0x20], eax
mov r9d, ecx
mov rcx, qword [rbp - 0x18]
lea rax, [rbp - 0x20]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop dword [rax + rax]
test eax, eax
je 0x140001fbb
lea rdx, [rdi + 2]
lea rcx, str.Unable_to_set_function_trace_registry_value:__s___x_
jmp 0x140001fb3
mov rcx, qword [r15 + rdi*8 + 8]
lea rdx, str.levels
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140002086
lea ecx, [rax + 2]
jmp 0x140001ef5
mov rcx, qword [r15 + rdi*8 + 8]
lea rdx, [0x140009a90]
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140001efa
lea ecx, [rax + 3]
jmp 0x140001ef5
test r12b, r12b
movsxd r8, esi
lea rax, [0x1400099c0]
lea rdx, [0x1400099c8]
cmovne rdx, rax
lea rcx, str.ERROR:_invalid__s_value:__s
mov r8, qword [r15 + r8*8]
call fcn.1400034a8
jmp 0x140001ef3
lea rcx, str.ERROR:_allocation_failed
call fcn.1400034a8
jmp 0x140001efa
test r12b, r12b
lea rax, [0x1400099a8]
cmovne r13, rax
mov rdx, r13
jmp 0x140002127
movsxd rcx, esi
mov rcx, qword [r15 + rcx*8 + 8]
call fcn.14000311c
test al, al
sete bl
mov ecx, ebx
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3
lea rdx, [0x1400098b8]
lea rcx, str.ERROR:_missing_argument_for_option__s
jmp 0x140001eee