Function at 0x140016230
Capabilities:
Persist via windows service
Set registry value

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xb0
mov qword [rbp + 0xf], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
mov rax, qword [0x140053008]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov r15, qword [0x140053bd0]
mov qword [0x140053bd0], 0xffffffff80000002
mov dword [rbp - 1], 1
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x19], xmm0
xor r12d, r12d
mov qword [rbp - 9], r12
mov qword [rbp + 0x2f], 7
mov qword [rbp + 0x27], r12
mov word [rbp + 0x17], r12w
lea r8d, [r12 + 0x26]
lea rdx, str.00001104_0000_1000_8000_00805F9B34FB
lea rcx, [rbp + 0x17]
call fcn.14000cb70
nop
lea rdx, [rbp + 0x17]
lea rcx, [rbp - 0x19]
call fcn.14000c800
nop
movabs rbx, 0x7fffffffffffffff
mov rax, qword [rbp + 0x2f]
cmp rax, 8
jb 0x140016335
inc rax
mov rcx, qword [rbp + 0x17]
cmp rax, rbx
jbe 0x1400162ec
call fcn.140029838
int3
add rax, rax
cmp rax, 0x1000
jb 0x140016330
test byte [rbp + 0x17], 0x1f
je 0x140016303
call fcn.140029838
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x140016312
call fcn.140029838
int3
sub rcx, rax
cmp rcx, 8
jae 0x140016321
call fcn.140029838
int3
cmp rcx, 0x27
jbe 0x14001632d
call fcn.140029838
int3
mov rcx, rax
call fcn.140019d14
mov qword [rbp + 0x2f], 7
mov qword [rbp + 0x27], r12
mov word [rbp + 0x17], r12w
mov r8d, 0x26
lea rdx, str.00001105_0000_1000_8000_00805F9B34FB
lea rcx, [rbp + 0x17]
call fcn.14000cb70
nop
lea rdx, [rbp + 0x17]
lea rcx, [rbp - 0x19]
call fcn.14000c800
nop
mov rax, qword [rbp + 0x2f]
cmp rax, 8
jb 0x1400163d0
inc rax
mov rcx, qword [rbp + 0x17]
cmp rax, rbx
jbe 0x140016387
call fcn.140029838
int3
add rax, rax
cmp rax, 0x1000
jb 0x1400163cb
test byte [rbp + 0x17], 0x1f
je 0x14001639e
call fcn.140029838
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x1400163ad
call fcn.140029838
int3
sub rcx, rax
cmp rcx, 8
jae 0x1400163bc
call fcn.140029838
int3
cmp rcx, 0x27
jbe 0x1400163c8
call fcn.140029838
int3
mov rcx, rax
call fcn.140019d14
mov qword [rbp + 0x2f], 7
mov qword [rbp + 0x27], r12
mov word [rbp + 0x17], r12w
mov r8d, 0x26
lea rdx, str.00001106_0000_1000_8000_00805F9B34FB
lea rcx, [rbp + 0x17]
call fcn.14000cb70
nop
lea rdx, [rbp + 0x17]
lea rcx, [rbp - 0x19]
call fcn.14000c800
nop
mov rax, qword [rbp + 0x2f]
cmp rax, 8
jb 0x14001646b
inc rax
mov rcx, qword [rbp + 0x17]
cmp rax, rbx
jbe 0x140016422
call fcn.140029838
int3
add rax, rax
cmp rax, 0x1000
jb 0x140016466
test byte [rbp + 0x17], 0x1f
je 0x140016439
call fcn.140029838
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x140016448
call fcn.140029838
int3
sub rcx, rax
cmp rcx, 8
jae 0x140016457
call fcn.140029838
int3
cmp rcx, 0x27
jbe 0x140016463
call fcn.140029838
int3
mov rcx, rax
call fcn.140019d14
mov qword [rbp + 0x2f], 7
mov qword [rbp + 0x27], r12
mov word [rbp + 0x17], r12w
mov r8d, 0x26
lea rdx, str.0000110c_0000_1000_8000_00805F9B34FB
lea rcx, [rbp + 0x17]
call fcn.14000cb70
nop
lea rdx, [rbp + 0x17]
lea rcx, [rbp - 0x19]
call fcn.14000c800
nop
mov rax, qword [rbp + 0x2f]
cmp rax, 8
jb 0x140016506
inc rax
mov rcx, qword [rbp + 0x17]
cmp rax, rbx
jbe 0x1400164bd
call fcn.140029838
int3
add rax, rax
cmp rax, 0x1000
jb 0x140016501
test byte [rbp + 0x17], 0x1f
je 0x1400164d4
call fcn.140029838
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x1400164e3
call fcn.140029838
int3
sub rcx, rax
cmp rcx, 8
jae 0x1400164f2
call fcn.140029838
int3
cmp rcx, 0x27
jbe 0x1400164fe
call fcn.140029838
int3
mov rcx, rax
call fcn.140019d14
mov qword [rbp + 0x2f], 7
mov qword [rbp + 0x27], r12
mov word [rbp + 0x17], r12w
mov r8d, 0x26
lea rdx, str.0000110e_0000_1000_8000_00805F9B34FB
lea rcx, [rbp + 0x17]
call fcn.14000cb70
nop
lea rdx, [rbp + 0x17]
lea rcx, [rbp - 0x19]
call fcn.14000c800
nop
mov rax, qword [rbp + 0x2f]
cmp rax, 8
jb 0x1400165a1
inc rax
mov rcx, qword [rbp + 0x17]
cmp rax, rbx
jbe 0x140016558
call fcn.140029838
int3
add rax, rax
cmp rax, 0x1000
jb 0x14001659c
test byte [rbp + 0x17], 0x1f
je 0x14001656f
call fcn.140029838
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x14001657e
call fcn.140029838
int3
sub rcx, rax
cmp rcx, 8
jae 0x14001658d
call fcn.140029838
int3
cmp rcx, 0x27
jbe 0x140016599
call fcn.140029838
int3
mov rcx, rax
call fcn.140019d14
mov qword [rbp + 0x2f], 7
mov qword [rbp + 0x27], r12
mov word [rbp + 0x17], r12w
mov r8d, 0x26
lea rdx, str.00001111_0000_1000_8000_00805F9B34FB
lea rcx, [rbp + 0x17]
call fcn.14000cb70
nop
lea rdx, [rbp + 0x17]
lea rcx, [rbp - 0x19]
call fcn.14000c800
nop
mov rax, qword [rbp + 0x2f]
cmp rax, 8
jb 0x14001663c
inc rax
mov rcx, qword [rbp + 0x17]
cmp rax, rbx
jbe 0x1400165f3
call fcn.140029838
int3
add rax, rax
cmp rax, 0x1000
jb 0x140016637
test byte [rbp + 0x17], 0x1f
je 0x14001660a
call fcn.140029838
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x140016619
call fcn.140029838
int3
sub rcx, rax
cmp rcx, 8
jae 0x140016628
call fcn.140029838
int3
cmp rcx, 0x27
jbe 0x140016634
call fcn.140029838
int3
mov rcx, rax
call fcn.140019d14
mov qword [rbp + 0x2f], 7
mov qword [rbp + 0x27], r12
mov word [rbp + 0x17], r12w
mov r8d, 0x26
lea rdx, str.00001118_0000_1000_8000_00805F9B34FB
lea rcx, [rbp + 0x17]
call fcn.14000cb70
nop
lea rdx, [rbp + 0x17]
lea rcx, [rbp - 0x19]
call fcn.14000c800
nop
mov rax, qword [rbp + 0x2f]
cmp rax, 8
jb 0x1400166d7
inc rax
mov rcx, qword [rbp + 0x17]
cmp rax, rbx
jbe 0x14001668e
call fcn.140029838
int3
add rax, rax
cmp rax, 0x1000
jb 0x1400166d2
test byte [rbp + 0x17], 0x1f
je 0x1400166a5
call fcn.140029838
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x1400166b4
call fcn.140029838
int3
sub rcx, rax
cmp rcx, 8
jae 0x1400166c3
call fcn.140029838
int3
cmp rcx, 0x27
jbe 0x1400166cf
call fcn.140029838
int3
mov rcx, rax
call fcn.140019d14
mov qword [rbp + 0x2f], 7
mov qword [rbp + 0x27], r12
mov word [rbp + 0x17], r12w
mov r8d, 0x26
lea rdx, str.00001123_0000_1000_8000_00805F9B34FB
lea rcx, [rbp + 0x17]
call fcn.14000cb70
nop
lea rdx, [rbp + 0x17]
lea rcx, [rbp - 0x19]
call fcn.14000c800
nop
mov rax, qword [rbp + 0x2f]
cmp rax, 8
jb 0x140016772
inc rax
mov rcx, qword [rbp + 0x17]
cmp rax, rbx
jbe 0x140016729
call fcn.140029838
int3
add rax, rax
cmp rax, 0x1000
jb 0x14001676d
test byte [rbp + 0x17], 0x1f
je 0x140016740
call fcn.140029838
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x14001674f
call fcn.140029838
int3
sub rcx, rax
cmp rcx, 8
jae 0x14001675e
call fcn.140029838
int3
cmp rcx, 0x27
jbe 0x14001676a
call fcn.140029838
int3
mov rcx, rax
call fcn.140019d14
mov qword [rbp + 0x2f], 7
mov qword [rbp + 0x27], r12
mov word [rbp + 0x17], r12w
mov r8d, 0x26
lea rdx, str.0000110a_0000_1000_8000_00805F9B34FB
lea rcx, [rbp + 0x17]
call fcn.14000cb70
nop
lea rdx, [rbp + 0x17]
lea rcx, [rbp - 0x19]
call fcn.14000c800
nop
mov rax, qword [rbp + 0x2f]
cmp rax, 8
jb 0x14001680d
inc rax
mov rcx, qword [rbp + 0x17]
cmp rax, rbx
jbe 0x1400167c4
call fcn.140029838
int3
add rax, rax
cmp rax, 0x1000
jb 0x140016808
test byte [rbp + 0x17], 0x1f
je 0x1400167db
call fcn.140029838
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x1400167ea
call fcn.140029838
int3
sub rcx, rax
cmp rcx, 8
jae 0x1400167f9
call fcn.140029838
int3
cmp rcx, 0x27
jbe 0x140016805
call fcn.140029838
int3
mov rcx, rax
call fcn.140019d14
mov qword [rbp + 0x2f], 7
mov qword [rbp + 0x27], r12
mov word [rbp + 0x17], r12w
mov r8d, 0x26
lea rdx, str.00001303_0000_1000_8000_00805F9B34FB
lea rcx, [rbp + 0x17]
call fcn.14000cb70
nop
lea rdx, [rbp + 0x17]
lea rcx, [rbp - 0x19]
call fcn.14000c800
nop
mov rax, qword [rbp + 0x2f]
cmp rax, 8
jb 0x1400168a8
inc rax
mov rcx, qword [rbp + 0x17]
cmp rax, rbx
jbe 0x14001685f
call fcn.140029838
int3
add rax, rax
cmp rax, 0x1000
jb 0x1400168a3
test byte [rbp + 0x17], 0x1f
je 0x140016876
call fcn.140029838
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x140016885
call fcn.140029838
int3
sub rcx, rax
cmp rcx, 8
jae 0x140016894
call fcn.140029838
int3
cmp rcx, 0x27
jbe 0x1400168a0
call fcn.140029838
int3
mov rcx, rax
call fcn.140019d14
mov qword [rbp + 0x2f], 7
mov qword [rbp + 0x27], r12
mov word [rbp + 0x17], r12w
mov r8d, 0x26
lea rdx, str.00001304_0000_1000_8000_00805F9B34FB
lea rcx, [rbp + 0x17]
call fcn.14000cb70
nop
lea rdx, [rbp + 0x17]
lea rcx, [rbp - 0x19]
call fcn.14000c800
nop
mov rax, qword [rbp + 0x2f]
cmp rax, 8
jb 0x140016943
inc rax
mov rcx, qword [rbp + 0x17]
cmp rax, rbx
jbe 0x1400168fa
call fcn.140029838
int3
add rax, rax
cmp rax, 0x1000
jb 0x14001693e
test byte [rbp + 0x17], 0x1f
je 0x140016911
call fcn.140029838
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x140016920
call fcn.140029838
int3
sub rcx, rax
cmp rcx, 8
jae 0x14001692f
call fcn.140029838
int3
cmp rcx, 0x27
jbe 0x14001693b
call fcn.140029838
int3
mov rcx, rax
call fcn.140019d14
mov qword [rbp + 0x2f], 7
mov qword [rbp + 0x27], r12
mov word [rbp + 0x17], r12w
mov r8d, 0x26
lea rdx, str.00001112_0000_1000_8000_00805f9b34fb
lea rcx, [rbp + 0x17]
call fcn.14000cb70
nop
lea rdx, [rbp + 0x17]
lea rcx, [rbp - 0x19]
call fcn.14000c800
nop
mov rax, qword [rbp + 0x2f]
cmp rax, 8
jb 0x1400169de
inc rax
mov rcx, qword [rbp + 0x17]
cmp rax, rbx
jbe 0x140016995
call fcn.140029838
int3
add rax, rax
cmp rax, 0x1000
jb 0x1400169d9
test byte [rbp + 0x17], 0x1f
je 0x1400169ac
call fcn.140029838
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x1400169bb
call fcn.140029838
int3
sub rcx, rax
cmp rcx, 8
jae 0x1400169ca
call fcn.140029838
int3
cmp rcx, 0x27
jbe 0x1400169d6
call fcn.140029838
int3
mov rcx, rax
call fcn.140019d14
mov qword [rbp + 0x2f], 7
mov qword [rbp + 0x27], r12
mov word [rbp + 0x17], r12w
mov r8d, 0x26
lea rdx, str.0000112d_0000_1000_8000_00805f9b34fb
lea rcx, [rbp + 0x17]
call fcn.14000cb70
nop
lea rdx, [rbp + 0x17]
lea rcx, [rbp - 0x19]
call fcn.14000c800
nop
mov rax, qword [rbp + 0x2f]
cmp rax, 8
jb 0x140016a79
inc rax
mov rcx, qword [rbp + 0x17]
cmp rax, rbx
jbe 0x140016a30
call fcn.140029838
int3
add rax, rax
cmp rax, 0x1000
jb 0x140016a74
test byte [rbp + 0x17], 0x1f
je 0x140016a47
call fcn.140029838
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x140016a56
call fcn.140029838
int3
sub rcx, rax
cmp rcx, 8
jae 0x140016a65
call fcn.140029838
int3
cmp rcx, 0x27
jbe 0x140016a71
call fcn.140029838
int3
mov rcx, rax
call fcn.140019d14
mov qword [rbp + 0x2f], 7
mov qword [rbp + 0x27], r12
mov word [rbp + 0x17], r12w
mov r8d, 0x26
lea rdx, str.0000112e_0000_1000_8000_00805f9b34fb
lea rcx, [rbp + 0x17]
call fcn.14000cb70
nop
lea rdx, [rbp + 0x17]
lea rcx, [rbp - 0x19]
call fcn.14000c800
nop
mov rax, qword [rbp + 0x2f]
cmp rax, 8
jb 0x140016b14
inc rax
mov rcx, qword [rbp + 0x17]
cmp rax, rbx
jbe 0x140016acb
call fcn.140029838
int3
add rax, rax
cmp rax, 0x1000
jb 0x140016b0f
test byte [rbp + 0x17], 0x1f
je 0x140016ae2
call fcn.140029838
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x140016af1
call fcn.140029838
int3
sub rcx, rax
cmp rcx, 8
jae 0x140016b00
call fcn.140029838
int3
cmp rcx, 0x27
jbe 0x140016b0c
call fcn.140029838
int3
mov rcx, rax
call fcn.140019d14
mov qword [rbp + 0x2f], 7
mov qword [rbp + 0x27], r12
mov word [rbp + 0x17], r12w
mov r8d, 0x26
lea rdx, str.0000112f_0000_1000_8000_00805f9b34fb
lea rcx, [rbp + 0x17]
call fcn.14000cb70
nop
lea rdx, [rbp + 0x17]
lea rcx, [rbp - 0x19]
call fcn.14000c800
nop
mov rax, qword [rbp + 0x2f]
cmp rax, 8
jb 0x140016baf
inc rax
mov rcx, qword [rbp + 0x17]
cmp rax, rbx
jbe 0x140016b66
call fcn.140029838
int3
add rax, rax
cmp rax, 0x1000
jb 0x140016baa
test byte [rbp + 0x17], 0x1f
je 0x140016b7d
call fcn.140029838
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x140016b8c
call fcn.140029838
int3
sub rcx, rax
cmp rcx, 8
jae 0x140016b9b
call fcn.140029838
int3
cmp rcx, 0x27
jbe 0x140016ba7
call fcn.140029838
int3
mov rcx, rax
call fcn.140019d14
mov qword [rbp + 0x2f], 7
mov qword [rbp + 0x27], r12
mov word [rbp + 0x17], r12w
mov edi, r12d
mov rsi, qword [rbp - 0x11]
mov r14, qword [rbp - 0x19]
sub rsi, r14
sar rsi, 5
test rsi, rsi
je 0x140016c6f
mov rbx, r12
nop
shl rbx, 5
add rbx, r14
cmp qword [rbx + 0x18], 8
jb 0x140016bf1
mov rbx, qword [rbx]
mov qword [rsp + 0x40], r12
lea rax, [rbp + 7]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov eax, dword [0x140053bc8]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetServicesBTHPORTParametersSupportedServices
mov rcx, qword [0x140053bd0]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140016c62
mov dword [rsp + 0x28], 4
lea rax, [rbp - 1]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rdx, rbx
mov rcx, qword [rbp + 7]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 7]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc edi
mov ebx, edi
cmp rbx, rsi
jb 0x140016be0
mov qword [0x140053bd0], r15
lea rcx, [rbp - 0x19]
call fcn.140018b90
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.140019ce0
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret