Function at 0x140034158
Capabilities:
Persist via windows service
Set registry value

Disassembly:
jmp 0x140060b10
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x2a8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x6e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x2c8]
mov rax, qword [0x1400ca380]
xor rax, rbp
mov qword [rbp + 0x268], rax
lea rcx, [0x1400d826a]
call fcn.140034dd8
nop
lea rdx, str.SystemCurrentControlSetServices_
lea rcx, [rbp + 0x28]
call fcn.140033d43
nop
mov rdx, qword [rbp + 0x298]
lea rcx, [rbp + 0x28]
call fcn.1400336b8
nop
lea rcx, [rbp + 0x28]
call fcn.1400332f8
lea r8, [rbp + 8]
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov dword [rbp + 0x64], eax
cmp dword [rbp + 0x64], 0
je 0x140060bc3
mov byte [rbp + 0x1a4], 0
lea rcx, [rbp + 0x28]
call fcn.1400335a0
movzx eax, byte [rbp + 0x1a4]
jmp 0x140060d97
mov byte [rbp + 0x84], 1
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x84]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Type
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [rbp + 0x64], eax
cmp dword [rbp + 0x64], 0
je 0x140060c1d
mov byte [rbp + 0x1c4], 0
lea rcx, [rbp + 0x28]
call fcn.1400335a0
movzx eax, byte [rbp + 0x1c4]
jmp 0x140060d97
mov byte [rbp + 0xa4], 3
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0xa4]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.ErrorControl
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [rbp + 0x64], eax
cmp dword [rbp + 0x64], 0
je 0x140060c77
mov byte [rbp + 0x1e4], 0
lea rcx, [rbp + 0x28]
call fcn.1400335a0
movzx eax, byte [rbp + 0x1e4]
jmp 0x140060d97
mov byte [rbp + 0xc4], 3
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0xc4]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Start
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [rbp + 0x64], eax
cmp dword [rbp + 0x64], 0
je 0x140060cd1
mov byte [rbp + 0x204], 0
lea rcx, [rbp + 0x28]
call fcn.1400335a0
movzx eax, byte [rbp + 0x204]
jmp 0x140060d97
mov rcx, qword [rbp + 0x290]
call fcn.140034522
mov dword [rbp + 0x254], eax
mov rcx, qword [rbp + 0x290]
call fcn.1400332f8
mov qword [rbp + 0x258], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x260], rax
mov eax, dword [rbp + 0x254]
mov dword [rsp + 0x28], eax
mov rax, qword [rbp + 0x258]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.ImagePath
mov rcx, qword [rbp + 0x260]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [rbp + 0x64], eax
cmp dword [rbp + 0x64], 0
je 0x140060d56
mov byte [rbp + 0x224], 0
lea rcx, [rbp + 0x28]
call fcn.1400335a0
movzx eax, byte [rbp + 0x224]
jmp 0x140060d97
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x140060d70
mov dword [rbp + 0x254], 1
jmp 0x140060d7a
mov dword [rbp + 0x254], 0
movzx eax, byte [rbp + 0x254]
mov byte [rbp + 0x244], al
lea rcx, [rbp + 0x28]
call fcn.1400335a0
movzx eax, byte [rbp + 0x244]
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x1400af490]
call fcn.140034856
mov rax, rdi
mov rcx, qword [rbp + 0x268]
xor rcx, rbp
call fcn.140033e3d
lea rsp, [rbp + 0x278]
pop rdi
pop rbp
ret