Function at 0x140015df0
Capabilities:
Persist via windows service
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xa0
mov rax, qword [0x140052010]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov r13, qword [0x140052d00]
mov qword [0x140052d00], 0xffffffff80000002
mov dword [rbp - 1], 1
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x19], xmm0
xor r14d, r14d
mov qword [rbp - 9], r14
mov qword [rbp + 0x1f], r14
mov edi, 7
mov qword [rbp + 0x27], rdi
mov word [rbp + 0xf], r14w
lea r8d, [r14 + 0x26]
lea rdx, str.00001104_0000_1000_8000_00805F9B34FB
lea rcx, [rbp + 0xf]
call fcn.14000c9b0
nop
lea r8, [rbp + 0xf]
xor edx, edx
lea rcx, [rbp - 0x19]
call fcn.14000cb50
nop
mov rdx, qword [rbp + 0x27]
cmp rdx, 8
jb 0x140015ec1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xf]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140015ebc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400168d2
call fcn.1400198f4
mov qword [rbp + 0x1f], r14
mov qword [rbp + 0x27], rdi
mov word [rbp + 0xf], r14w
mov r8d, 0x26
lea rdx, str.00001105_0000_1000_8000_00805F9B34FB
lea rcx, [rbp + 0xf]
call fcn.14000c9b0
nop
mov rbx, qword [rbp - 0x11]
mov rsi, qword [rbp - 9]
cmp rbx, rsi
je 0x140015f13
movups xmm0, xmmword [rbp + 0xf]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rbp + 0x1f]
movups xmmword [rbx + 0x10], xmm1
mov rdx, rdi
mov word [rbp + 0xf], r14w
add rbx, 0x20
mov qword [rbp - 0x11], rbx
jmp 0x140015f2f
lea r8, [rbp + 0xf]
mov rdx, rbx
lea rcx, [rbp - 0x19]
call fcn.14000cb50
mov rsi, qword [rbp - 9]
mov rbx, qword [rbp - 0x11]
mov rdx, qword [rbp + 0x27]
cmp rdx, 8
jb 0x140015f6b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xf]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140015f66
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400168d2
call fcn.1400198f4
mov qword [rbp + 0x1f], r14
mov qword [rbp + 0x27], rdi
mov word [rbp + 0xf], r14w
mov r8d, 0x26
lea rdx, str.00001106_0000_1000_8000_00805F9B34FB
lea rcx, [rbp + 0xf]
call fcn.14000c9b0
nop
cmp rbx, rsi
je 0x140015fb5
movups xmm0, xmmword [rbp + 0xf]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rbp + 0x1f]
movups xmmword [rbx + 0x10], xmm1
mov rdx, rdi
mov word [rbp + 0xf], r14w
add rbx, 0x20
mov qword [rbp - 0x11], rbx
jmp 0x140015fd1
lea r8, [rbp + 0xf]
mov rdx, rbx
lea rcx, [rbp - 0x19]
call fcn.14000cb50
mov rsi, qword [rbp - 9]
mov rbx, qword [rbp - 0x11]
mov rdx, qword [rbp + 0x27]
cmp rdx, 8
jb 0x14001600d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xf]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140016008
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400168d2
call fcn.1400198f4
mov qword [rbp + 0x1f], r14
mov qword [rbp + 0x27], rdi
mov word [rbp + 0xf], r14w
mov r8d, 0x26
lea rdx, str.0000110c_0000_1000_8000_00805F9B34FB
lea rcx, [rbp + 0xf]
call fcn.14000c9b0
nop
cmp rbx, rsi
je 0x140016057
movups xmm0, xmmword [rbp + 0xf]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rbp + 0x1f]
movups xmmword [rbx + 0x10], xmm1
mov rdx, rdi
mov word [rbp + 0xf], r14w
add rbx, 0x20
mov qword [rbp - 0x11], rbx
jmp 0x140016073
lea r8, [rbp + 0xf]
mov rdx, rbx
lea rcx, [rbp - 0x19]
call fcn.14000cb50
mov rsi, qword [rbp - 9]
mov rbx, qword [rbp - 0x11]
mov rdx, qword [rbp + 0x27]
cmp rdx, 8
jb 0x1400160af
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xf]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400160aa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400168d2
call fcn.1400198f4
mov qword [rbp + 0x1f], r14
mov qword [rbp + 0x27], rdi
mov word [rbp + 0xf], r14w
mov r8d, 0x26
lea rdx, str.0000110e_0000_1000_8000_00805F9B34FB
lea rcx, [rbp + 0xf]
call fcn.14000c9b0
nop
cmp rbx, rsi
je 0x1400160f9
movups xmm0, xmmword [rbp + 0xf]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rbp + 0x1f]
movups xmmword [rbx + 0x10], xmm1
mov rdx, rdi
mov word [rbp + 0xf], r14w
add rbx, 0x20
mov qword [rbp - 0x11], rbx
jmp 0x140016115
lea r8, [rbp + 0xf]
mov rdx, rbx
lea rcx, [rbp - 0x19]
call fcn.14000cb50
mov rsi, qword [rbp - 9]
mov rbx, qword [rbp - 0x11]
mov rdx, qword [rbp + 0x27]
cmp rdx, 8
jb 0x140016151
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xf]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001614c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400168d2
call fcn.1400198f4
mov qword [rbp + 0x1f], r14
mov qword [rbp + 0x27], rdi
mov word [rbp + 0xf], r14w
mov r8d, 0x26
lea rdx, str.00001111_0000_1000_8000_00805F9B34FB
lea rcx, [rbp + 0xf]
call fcn.14000c9b0
nop
cmp rbx, rsi
je 0x14001619b
movups xmm0, xmmword [rbp + 0xf]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rbp + 0x1f]
movups xmmword [rbx + 0x10], xmm1
mov rdx, rdi
mov word [rbp + 0xf], r14w
add rbx, 0x20
mov qword [rbp - 0x11], rbx
jmp 0x1400161b7
lea r8, [rbp + 0xf]
mov rdx, rbx
lea rcx, [rbp - 0x19]
call fcn.14000cb50
mov rsi, qword [rbp - 9]
mov rbx, qword [rbp - 0x11]
mov rdx, qword [rbp + 0x27]
cmp rdx, 8
jb 0x1400161f3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xf]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400161ee
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400168d2
call fcn.1400198f4
mov qword [rbp + 0x1f], r14
mov qword [rbp + 0x27], rdi
mov word [rbp + 0xf], r14w
mov r8d, 0x26
lea rdx, str.00001118_0000_1000_8000_00805F9B34FB
lea rcx, [rbp + 0xf]
call fcn.14000c9b0
nop
cmp rbx, rsi
je 0x14001623d
movups xmm0, xmmword [rbp + 0xf]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rbp + 0x1f]
movups xmmword [rbx + 0x10], xmm1
mov rdx, rdi
mov word [rbp + 0xf], r14w
add rbx, 0x20
mov qword [rbp - 0x11], rbx
jmp 0x140016259
lea r8, [rbp + 0xf]
mov rdx, rbx
lea rcx, [rbp - 0x19]
call fcn.14000cb50
mov rsi, qword [rbp - 9]
mov rbx, qword [rbp - 0x11]
mov rdx, qword [rbp + 0x27]
cmp rdx, 8
jb 0x140016295
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xf]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140016290
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400168d2
call fcn.1400198f4
mov qword [rbp + 0x1f], r14
mov qword [rbp + 0x27], rdi
mov word [rbp + 0xf], r14w
mov r8d, 0x26
lea rdx, str.00001123_0000_1000_8000_00805F9B34FB
lea rcx, [rbp + 0xf]
call fcn.14000c9b0
nop
cmp rbx, rsi
je 0x1400162df
movups xmm0, xmmword [rbp + 0xf]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rbp + 0x1f]
movups xmmword [rbx + 0x10], xmm1
mov rdx, rdi
mov word [rbp + 0xf], r14w
add rbx, 0x20
mov qword [rbp - 0x11], rbx
jmp 0x1400162fb
lea r8, [rbp + 0xf]
mov rdx, rbx
lea rcx, [rbp - 0x19]
call fcn.14000cb50
mov rsi, qword [rbp - 9]
mov rbx, qword [rbp - 0x11]
mov rdx, qword [rbp + 0x27]
cmp rdx, 8
jb 0x140016337
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xf]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140016332
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400168d2
call fcn.1400198f4
mov qword [rbp + 0x1f], r14
mov qword [rbp + 0x27], rdi
mov word [rbp + 0xf], r14w
mov r8d, 0x26
lea rdx, str.0000110a_0000_1000_8000_00805F9B34FB
lea rcx, [rbp + 0xf]
call fcn.14000c9b0
nop
cmp rbx, rsi
je 0x140016381
movups xmm0, xmmword [rbp + 0xf]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rbp + 0x1f]
movups xmmword [rbx + 0x10], xmm1
mov rdx, rdi
mov word [rbp + 0xf], r14w
add rbx, 0x20
mov qword [rbp - 0x11], rbx
jmp 0x14001639d
lea r8, [rbp + 0xf]
mov rdx, rbx
lea rcx, [rbp - 0x19]
call fcn.14000cb50
mov rsi, qword [rbp - 9]
mov rbx, qword [rbp - 0x11]
mov rdx, qword [rbp + 0x27]
cmp rdx, 8
jb 0x1400163d9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xf]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400163d4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400168d2
call fcn.1400198f4
mov qword [rbp + 0x1f], r14
mov qword [rbp + 0x27], rdi
mov word [rbp + 0xf], r14w
mov r8d, 0x26
lea rdx, str.00001303_0000_1000_8000_00805F9B34FB
lea rcx, [rbp + 0xf]
call fcn.14000c9b0
nop
cmp rbx, rsi
je 0x140016423
movups xmm0, xmmword [rbp + 0xf]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rbp + 0x1f]
movups xmmword [rbx + 0x10], xmm1
mov rdx, rdi
mov word [rbp + 0xf], r14w
add rbx, 0x20
mov qword [rbp - 0x11], rbx
jmp 0x14001643f
lea r8, [rbp + 0xf]
mov rdx, rbx
lea rcx, [rbp - 0x19]
call fcn.14000cb50
mov rsi, qword [rbp - 9]
mov rbx, qword [rbp - 0x11]
mov rdx, qword [rbp + 0x27]
cmp rdx, 8
jb 0x14001647b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xf]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140016476
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400168d2
call fcn.1400198f4
mov qword [rbp + 0x1f], r14
mov qword [rbp + 0x27], rdi
mov word [rbp + 0xf], r14w
mov r8d, 0x26
lea rdx, str.00001304_0000_1000_8000_00805F9B34FB
lea rcx, [rbp + 0xf]
call fcn.14000c9b0
nop
cmp rbx, rsi
je 0x1400164c5
movups xmm0, xmmword [rbp + 0xf]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rbp + 0x1f]
movups xmmword [rbx + 0x10], xmm1
mov rdx, rdi
mov word [rbp + 0xf], r14w
add rbx, 0x20
mov qword [rbp - 0x11], rbx
jmp 0x1400164e1
lea r8, [rbp + 0xf]
mov rdx, rbx
lea rcx, [rbp - 0x19]
call fcn.14000cb50
mov rsi, qword [rbp - 9]
mov rbx, qword [rbp - 0x11]
mov rdx, qword [rbp + 0x27]
cmp rdx, 8
jb 0x14001651d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xf]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140016518
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400168d2
call fcn.1400198f4
mov qword [rbp + 0x1f], r14
mov qword [rbp + 0x27], rdi
mov word [rbp + 0xf], r14w
mov r8d, 0x26
lea rdx, str.00001112_0000_1000_8000_00805f9b34fb
lea rcx, [rbp + 0xf]
call fcn.14000c9b0
nop
cmp rbx, rsi
je 0x140016567
movups xmm0, xmmword [rbp + 0xf]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rbp + 0x1f]
movups xmmword [rbx + 0x10], xmm1
mov rdx, rdi
mov word [rbp + 0xf], r14w
add rbx, 0x20
mov qword [rbp - 0x11], rbx
jmp 0x140016583
lea r8, [rbp + 0xf]
mov rdx, rbx
lea rcx, [rbp - 0x19]
call fcn.14000cb50
mov rsi, qword [rbp - 9]
mov rbx, qword [rbp - 0x11]
mov rdx, qword [rbp + 0x27]
cmp rdx, 8
jb 0x1400165bf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xf]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400165ba
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400168d2
call fcn.1400198f4
mov qword [rbp + 0x1f], r14
mov qword [rbp + 0x27], rdi
mov word [rbp + 0xf], r14w
mov r8d, 0x26
lea rdx, str.0000112d_0000_1000_8000_00805f9b34fb
lea rcx, [rbp + 0xf]
call fcn.14000c9b0
nop
cmp rbx, rsi
je 0x140016609
movups xmm0, xmmword [rbp + 0xf]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rbp + 0x1f]
movups xmmword [rbx + 0x10], xmm1
mov rdx, rdi
mov word [rbp + 0xf], r14w
add rbx, 0x20
mov qword [rbp - 0x11], rbx
jmp 0x140016625
lea r8, [rbp + 0xf]
mov rdx, rbx
lea rcx, [rbp - 0x19]
call fcn.14000cb50
mov rsi, qword [rbp - 9]
mov rbx, qword [rbp - 0x11]
mov rdx, qword [rbp + 0x27]
cmp rdx, 8
jb 0x140016661
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xf]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001665c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400168d2
call fcn.1400198f4
mov qword [rbp + 0x1f], r14
mov qword [rbp + 0x27], rdi
mov word [rbp + 0xf], r14w
mov r8d, 0x26
lea rdx, str.0000112e_0000_1000_8000_00805f9b34fb
lea rcx, [rbp + 0xf]
call fcn.14000c9b0
nop
cmp rbx, rsi
je 0x1400166ab
movups xmm0, xmmword [rbp + 0xf]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rbp + 0x1f]
movups xmmword [rbx + 0x10], xmm1
mov rdx, rdi
mov word [rbp + 0xf], r14w
add rbx, 0x20
mov qword [rbp - 0x11], rbx
jmp 0x1400166c7
lea r8, [rbp + 0xf]
mov rdx, rbx
lea rcx, [rbp - 0x19]
call fcn.14000cb50
mov rsi, qword [rbp - 9]
mov rbx, qword [rbp - 0x11]
mov rdx, qword [rbp + 0x27]
cmp rdx, 8
jb 0x140016703
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xf]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400166fe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400168d2
call fcn.1400198f4
mov qword [rbp + 0x1f], r14
mov qword [rbp + 0x27], rdi
mov word [rbp + 0xf], r14w
mov r8d, 0x26
lea rdx, str.0000112f_0000_1000_8000_00805f9b34fb
lea rcx, [rbp + 0xf]
call fcn.14000c9b0
nop
cmp rbx, rsi
je 0x140016746
movups xmm0, xmmword [rbp + 0xf]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rbp + 0x1f]
movups xmmword [rbx + 0x10], xmm1
mov word [rbp + 0xf], r14w
add rbx, 0x20
jmp 0x140016762
lea r8, [rbp + 0xf]
mov rdx, rbx
lea rcx, [rbp - 0x19]
call fcn.14000cb50
mov rsi, qword [rbp - 9]
mov rbx, qword [rbp - 0x11]
mov rdi, qword [rbp + 0x27]
cmp rdi, 8
jb 0x14001679e
lea rdx, [rdi*2 + 2]
mov rcx, qword [rbp + 0xf]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140016799
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400168d2
call fcn.1400198f4
mov r15d, r14d
mov r12, rbx
mov r14, qword [rbp - 0x19]
sub r12, r14
sar r12, 5
test r12, r12
je 0x140016855
xor ecx, ecx
mov edi, ecx
nop dword [rax]
shl rdi, 5
add rdi, r14
cmp qword [rdi + 0x18], 8
jb 0x1400167d1
mov rdi, qword [rdi]
mov qword [rsp + 0x40], rcx
lea rax, [rbp + 7]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rcx
mov eax, dword [0x140052cf8]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetServicesBTHPORTParametersSupportedServices
mov rcx, qword [0x140052d00]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140016841
mov dword [rsp + 0x28], 4
lea rax, [rbp - 1]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [rbp + 7]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 7]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc r15d
mov edi, r15d
cmp rdi, r12
mov ecx, 0
jb 0x1400167c0
mov qword [0x140052d00], r13
test r14, r14
je 0x14001689f
mov rdx, rbx
mov rcx, r14
call fcn.14000d240
sub rsi, r14
and rsi, 0xffffffffffffffe0
mov rax, r14
cmp rsi, 0x1000
jb 0x140016894
add rsi, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400168cc
mov rdx, rsi
mov rcx, r14
call fcn.1400198f4
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.1400198d0
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14002589c
nop
call fcn.14002589c
nop
int3