Function at 0x140024fa0
Capabilities:
Access the windows event log
Delete registry value
Persist via windows service
Set registry value

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x2c0
mov qword [rsp + 0x98], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
mov r12d, r8d
mov rbp, rcx
call fcn.140025d30
mov r11, qword [rbp]
xor r9d, r9d
lea r14d, [r9 + 1]
mov r8d, r14d
lea edx, [r9 + 0x64]
mov rcx, rbp
call qword [r11 + 0x40]
mov ebx, eax
xor r13d, r13d
cmp eax, r13d
jge 0x14002501f
mov r8d, eax
lea rdx, str.CRecvrServiceModule::RegisterServer:_Failed_to_UpdateRegistryFromResource_0x_x
mov ecx, r14d
call fcn.140001110
mov eax, ebx
jmp 0x1400256be
mov rdi, r13
mov qword [rsp + 0x80], r13
mov qword [rsp + 0x88], r13
mov qword [rsp + 0x90], r13
mov qword [rsp + 0x58], r13
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
xor r8d, r8d
lea rdx, str.AppID
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, r13d
jne 0x14002507b
mov eax, r13d
mov rdi, qword [rsp + 0x58]
mov qword [rsp + 0x80], rdi
cmp eax, r13d
je 0x1400250b7
movzx ebx, ax
or ebx, 0x80070000
cmp eax, r13d
cmovle ebx, eax
mov r8d, ebx
lea rdx, str.CRecvrServiceModule::RegisterServer:_Failed_to_Open_RegKey_AppID_0x_x
mov ecx, r14d
call fcn.140001110
nop
cmp rdi, r13
je 0x1400250b0
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x1400256be
mov rsi, r13
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x78], r13
mov qword [rsp + 0x58], r13
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
xor r8d, r8d
lea rdx, str.b622553e_eadb_445e_9493_c3df5af99268
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, r13d
jne 0x140025103
mov eax, r13d
mov rsi, qword [rsp + 0x58]
mov qword [rsp + 0x68], rsi
cmp eax, r13d
je 0x14002514e
movzx ebx, ax
or ebx, 0x80070000
cmp eax, r13d
cmovle ebx, eax
mov r8d, ebx
lea rdx, str.CRecvrServiceModule::RegisterServer:_Failed_to_Open_RegKey_GUID_0x_x
mov ecx, r14d
call fcn.140001110
nop
cmp rsi, r13
je 0x140025139
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp rdi, r13
je 0x140025147
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x1400256be
lea rdx, str.LocalService
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea rbx, str.ehRecvr
cmp r12d, r13d
je 0x1400252a9
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, r14d
xor r8d, r8d
lea rdx, str.LocalService
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, r13d
je 0x1400251e5
movzx ebx, ax
or ebx, 0x80070000
cmp eax, r13d
cmovle ebx, eax
mov r8d, ebx
lea rdx, str.CRecvrServiceModule::RegisterServer:_Failed_to_Set_Value_0x_x
mov ecx, r14d
call fcn.140001110
nop
cmp rsi, r13
je 0x1400251d0
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp rdi, r13
je 0x1400251de
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x1400256be
lea rbx, str._Service
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, r14d
xor r8d, r8d
lea rdx, str.ServiceParameters
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, r13d
je 0x140025263
movzx ebx, ax
or ebx, 0x80070000
cmp eax, r13d
cmovle ebx, eax
mov r8d, ebx
lea rdx, str.CRecvrServiceModule::RegisterServer:_Failed_to_Set_Value_0x_x
mov ecx, r14d
call fcn.140001110
nop
cmp rsi, r13
je 0x14002524e
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp rdi, r13
je 0x14002525c
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x1400256be
mov rcx, rbp
call fcn.1400258e0
mov ebx, eax
cmp eax, r13d
jge 0x1400252a9
mov r8d, eax
lea rdx, str.CRecvrServiceModule::RegisterServer:_Failed_to_install_0x_x
mov ecx, r14d
call fcn.140001110
nop
cmp rsi, r13
je 0x140025294
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp rdi, r13
je 0x1400252a2
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x1400256be
mov rbp, qword [rbp + 0x48]
cmp rbp, r13
je 0x1400252ec
cmp qword [rbp], r13
je 0x1400252ec
mov ecx, r14d
call qword [rbp + 8]
mov ebx, eax
cmp eax, r13d
jl 0x140025361
call qword [rbp + 0x38]
mov rdx, rax
mov r8d, r14d
mov rcx, qword [rbp]
call fcn.140027e10
mov ebx, eax
cmp eax, r13d
jl 0x140025361
add rbp, 0x48
cmp qword [rbp], r13
jne 0x1400252b8
mov ebx, r13d
mov rbp, qword [0x1400a4710]
mov rax, qword [0x1400a4718]
cmp rbp, rax
jae 0x140025345
mov r12, qword [rbp]
cmp r12, r13
je 0x14002533c
mov ecx, r14d
call qword [r12 + 8]
mov ebx, eax
cmp eax, r13d
jl 0x140025345
call qword [r12 + 0x38]
mov rdx, rax
mov r8d, r14d
mov rcx, qword [r12]
call fcn.140027e10
mov ebx, eax
cmp eax, r13d
jl 0x140025345
mov rax, qword [0x1400a4718]
add rbp, 8
cmp rbp, rax
jb 0x140025302
cmp ebx, r13d
jl 0x140025361
mov rax, qword [0x1400a55d8]
cmp rax, r13
je 0x140025361
mov rcx, qword [0x1400a42e8]
call rax
mov ebx, eax
cmp ebx, r13d
jge 0x14002539d
mov r8d, ebx
lea rdx, str.CRecvrServiceModule::RegisterServer:_Failed_to_RegisterServer_0x_x
mov ecx, r14d
call fcn.140001110
nop
cmp rsi, r13
je 0x140025388
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp rdi, r13
je 0x140025396
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x1400256be
mov dword [rsp + 0x60], r14d
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetServicesEventLogMedia_CenterehRecvr
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, r13d
je 0x14002543f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r8d, ebx
lea rdx, str.CRecvrServiceModule::RegisterServer:_Failed_to_Create_Key_0x_x
mov ecx, r14d
call fcn.140001110
movzx ebp, bx
or ebp, 0x80070000
cmp ebx, r13d
cmovle ebp, ebx
cmp rsi, r13
je 0x14002542a
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp rdi, r13
je 0x140025438
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebp
jmp 0x1400256be
mov r8d, 0x104
lea rdx, [rsp + 0xa0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, r13d
jne 0x1400254b2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r8d, ebx
lea rdx, str.CRecvrServiceModule::RegisterServer:_Failed_to_GetModuleFileName_0x_x
mov ecx, r14d
call fcn.140001110
movzx ebp, bx
or ebp, 0x80070000
cmp ebx, r13d
cmovle ebp, ebx
cmp rsi, r13
je 0x14002549d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp rdi, r13
je 0x1400254ab
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebp
jmp 0x1400256be
add eax, eax
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
lea rdx, str.EventMessageFile
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, r13d
je 0x14002553d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r8d, ebx
lea rdx, str.CRecvrServiceModule::RegisterServer:_Failed_to_Set_Value_0x_x
mov ecx, r14d
call fcn.140001110
movzx ebp, bx
or ebp, 0x80070000
cmp ebx, r13d
cmovle ebp, ebx
cmp rsi, r13
je 0x140025528
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp rdi, r13
je 0x140025536
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebp
jmp 0x1400256be
mov dword [rsp + 0x64], 7
mov r9d, 4
mov dword [rsp + 0x28], r9d
lea rax, [rsp + 0x64]
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.TypesSupported
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, r13d
je 0x1400255cc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r8d, ebx
lea rdx, str.CRecvrServiceModule::RegisterServer:_Failed_to_Set_Value_0x_x
mov ecx, r14d
call fcn.140001110
movzx ebp, bx
or ebp, 0x80070000
cmp ebx, r13d
cmovle ebp, ebx
cmp rsi, r13
je 0x1400255b7
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp rdi, r13
je 0x1400255c5
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebp
jmp 0x1400256be
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.ehRecvr
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rbp, rax
cmp rax, r13
jne 0x14002563b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov r8d, eax
lea rdx, str.CRecvrServiceModule::RegisterServer:_Failed_to_RegisterEventSource_0x_x
mov ecx, r14d
call fcn.140001110
movzx ebp, bx
or ebp, 0x80070000
cmp ebx, r13d
cmovle ebp, ebx
cmp rsi, r13
je 0x140025626
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp rdi, r13
je 0x140025634
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebp
jmp 0x1400256be
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r13
mov dword [rsp + 0x30], r13d
mov word [rsp + 0x28], r13w
mov qword [rsp + 0x20], r13
mov r9d, r14d
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
cmp eax, r13d
jne 0x140025695
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov r8d, eax
lea rdx, str.CRecvrServiceModule::RegisterServer:_Failed_to_ReportEvent_0x_x
mov ecx, r14d
call fcn.140001110
cmp ebx, 0x5de
je 0x140025692
cmp ebx, 2
jne 0x140025695
mov ebx, r13d
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
nop
cmp rsi, r13
je 0x1400256ae
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp rdi, r13
je 0x1400256bc
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.140001170
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret