Function at 0x140015e70
Capabilities:
Persist via windows service
Set registry value

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xb0
mov qword [rbp - 1], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rax, qword [0x14004d010]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov r13, qword [0x14004dcf0]
mov qword [0x14004dcf0], 0xffffffff80000002
mov dword [rbp - 0x11], 1
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x29], xmm0
xor r14d, r14d
mov qword [rbp - 0x19], r14
movdqa xmm0, xmmword [0x140046520]
movdqu xmmword [rbp + 0x17], xmm0
mov word [rbp + 7], r14w
lea r8d, [r14 + 0x26]
lea rdx, str.00001104_0000_1000_8000_00805F9B34FB
lea rcx, [rbp + 7]
call fcn.14000c900
nop
lea r8, [rbp + 7]
xor edx, edx
lea rcx, [rbp - 0x29]
call fcn.14000ca90
nop
mov rdx, qword [rbp + 0x1f]
cmp rdx, 8
jb 0x140015f48
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140015f43
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400169a2
call fcn.140019b64
movdqa xmm0, xmmword [0x140046520]
movdqu xmmword [rbp + 0x17], xmm0
mov word [rbp + 7], r14w
mov r8d, 0x26
lea rdx, str.00001105_0000_1000_8000_00805F9B34FB
lea rcx, [rbp + 7]
call fcn.14000c900
nop
mov edi, 7
mov rbx, qword [rbp - 0x21]
mov rsi, qword [rbp - 0x19]
cmp rbx, rsi
je 0x140015fa3
movups xmm0, xmmword [rbp + 7]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rbp + 0x17]
movups xmmword [rbx + 0x10], xmm1
mov edx, edi
mov word [rbp + 7], r14w
add rbx, 0x20
mov qword [rbp - 0x21], rbx
jmp 0x140015fbf
lea r8, [rbp + 7]
mov rdx, rbx
lea rcx, [rbp - 0x29]
call fcn.14000ca90
mov rsi, qword [rbp - 0x19]
mov rbx, qword [rbp - 0x21]
mov rdx, qword [rbp + 0x1f]
cmp rdx, 8
jb 0x140015ffb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140015ff6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400169a2
call fcn.140019b64
movdqa xmm0, xmmword [0x140046520]
movdqu xmmword [rbp + 0x17], xmm0
mov word [rbp + 7], r14w
mov r8d, 0x26
lea rdx, str.00001106_0000_1000_8000_00805F9B34FB
lea rcx, [rbp + 7]
call fcn.14000c900
nop
cmp rbx, rsi
je 0x14001604a
movups xmm0, xmmword [rbp + 7]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rbp + 0x17]
movups xmmword [rbx + 0x10], xmm1
mov rdx, rdi
mov word [rbp + 7], r14w
add rbx, 0x20
mov qword [rbp - 0x21], rbx
jmp 0x140016066
lea r8, [rbp + 7]
mov rdx, rbx
lea rcx, [rbp - 0x29]
call fcn.14000ca90
mov rsi, qword [rbp - 0x19]
mov rbx, qword [rbp - 0x21]
mov rdx, qword [rbp + 0x1f]
cmp rdx, 8
jb 0x1400160a2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001609d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400169a2
call fcn.140019b64
movdqa xmm0, xmmword [0x140046520]
movdqu xmmword [rbp + 0x17], xmm0
mov word [rbp + 7], r14w
mov r8d, 0x26
lea rdx, str.0000110c_0000_1000_8000_00805F9B34FB
lea rcx, [rbp + 7]
call fcn.14000c900
nop
cmp rbx, rsi
je 0x1400160f1
movups xmm0, xmmword [rbp + 7]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rbp + 0x17]
movups xmmword [rbx + 0x10], xmm1
mov rdx, rdi
mov word [rbp + 7], r14w
add rbx, 0x20
mov qword [rbp - 0x21], rbx
jmp 0x14001610d
lea r8, [rbp + 7]
mov rdx, rbx
lea rcx, [rbp - 0x29]
call fcn.14000ca90
mov rsi, qword [rbp - 0x19]
mov rbx, qword [rbp - 0x21]
mov rdx, qword [rbp + 0x1f]
cmp rdx, 8
jb 0x140016149
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140016144
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400169a2
call fcn.140019b64
movdqa xmm0, xmmword [0x140046520]
movdqu xmmword [rbp + 0x17], xmm0
mov word [rbp + 7], r14w
mov r8d, 0x26
lea rdx, str.0000110e_0000_1000_8000_00805F9B34FB
lea rcx, [rbp + 7]
call fcn.14000c900
nop
cmp rbx, rsi
je 0x140016198
movups xmm0, xmmword [rbp + 7]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rbp + 0x17]
movups xmmword [rbx + 0x10], xmm1
mov rdx, rdi
mov word [rbp + 7], r14w
add rbx, 0x20
mov qword [rbp - 0x21], rbx
jmp 0x1400161b4
lea r8, [rbp + 7]
mov rdx, rbx
lea rcx, [rbp - 0x29]
call fcn.14000ca90
mov rsi, qword [rbp - 0x19]
mov rbx, qword [rbp - 0x21]
mov rdx, qword [rbp + 0x1f]
cmp rdx, 8
jb 0x1400161f0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400161eb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400169a2
call fcn.140019b64
movdqa xmm0, xmmword [0x140046520]
movdqu xmmword [rbp + 0x17], xmm0
mov word [rbp + 7], r14w
mov r8d, 0x26
lea rdx, str.00001111_0000_1000_8000_00805F9B34FB
lea rcx, [rbp + 7]
call fcn.14000c900
nop
cmp rbx, rsi
je 0x14001623f
movups xmm0, xmmword [rbp + 7]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rbp + 0x17]
movups xmmword [rbx + 0x10], xmm1
mov rdx, rdi
mov word [rbp + 7], r14w
add rbx, 0x20
mov qword [rbp - 0x21], rbx
jmp 0x14001625b
lea r8, [rbp + 7]
mov rdx, rbx
lea rcx, [rbp - 0x29]
call fcn.14000ca90
mov rsi, qword [rbp - 0x19]
mov rbx, qword [rbp - 0x21]
mov rdx, qword [rbp + 0x1f]
cmp rdx, 8
jb 0x140016297
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140016292
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400169a2
call fcn.140019b64
movdqa xmm0, xmmword [0x140046520]
movdqu xmmword [rbp + 0x17], xmm0
mov word [rbp + 7], r14w
mov r8d, 0x26
lea rdx, str.00001118_0000_1000_8000_00805F9B34FB
lea rcx, [rbp + 7]
call fcn.14000c900
nop
cmp rbx, rsi
je 0x1400162e6
movups xmm0, xmmword [rbp + 7]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rbp + 0x17]
movups xmmword [rbx + 0x10], xmm1
mov rdx, rdi
mov word [rbp + 7], r14w
add rbx, 0x20
mov qword [rbp - 0x21], rbx
jmp 0x140016302
lea r8, [rbp + 7]
mov rdx, rbx
lea rcx, [rbp - 0x29]
call fcn.14000ca90
mov rsi, qword [rbp - 0x19]
mov rbx, qword [rbp - 0x21]
mov rdx, qword [rbp + 0x1f]
cmp rdx, 8
jb 0x14001633e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140016339
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400169a2
call fcn.140019b64
movdqa xmm0, xmmword [0x140046520]
movdqu xmmword [rbp + 0x17], xmm0
mov word [rbp + 7], r14w
mov r8d, 0x26
lea rdx, str.00001123_0000_1000_8000_00805F9B34FB
lea rcx, [rbp + 7]
call fcn.14000c900
nop
cmp rbx, rsi
je 0x14001638d
movups xmm0, xmmword [rbp + 7]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rbp + 0x17]
movups xmmword [rbx + 0x10], xmm1
mov rdx, rdi
mov word [rbp + 7], r14w
add rbx, 0x20
mov qword [rbp - 0x21], rbx
jmp 0x1400163a9
lea r8, [rbp + 7]
mov rdx, rbx
lea rcx, [rbp - 0x29]
call fcn.14000ca90
mov rsi, qword [rbp - 0x19]
mov rbx, qword [rbp - 0x21]
mov rdx, qword [rbp + 0x1f]
cmp rdx, 8
jb 0x1400163e5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400163e0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400169a2
call fcn.140019b64
movdqa xmm0, xmmword [0x140046520]
movdqu xmmword [rbp + 0x17], xmm0
mov word [rbp + 7], r14w
mov r8d, 0x26
lea rdx, str.0000110a_0000_1000_8000_00805F9B34FB
lea rcx, [rbp + 7]
call fcn.14000c900
nop
cmp rbx, rsi
je 0x140016434
movups xmm0, xmmword [rbp + 7]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rbp + 0x17]
movups xmmword [rbx + 0x10], xmm1
mov rdx, rdi
mov word [rbp + 7], r14w
add rbx, 0x20
mov qword [rbp - 0x21], rbx
jmp 0x140016450
lea r8, [rbp + 7]
mov rdx, rbx
lea rcx, [rbp - 0x29]
call fcn.14000ca90
mov rsi, qword [rbp - 0x19]
mov rbx, qword [rbp - 0x21]
mov rdx, qword [rbp + 0x1f]
cmp rdx, 8
jb 0x14001648c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140016487
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400169a2
call fcn.140019b64
movdqa xmm0, xmmword [0x140046520]
movdqu xmmword [rbp + 0x17], xmm0
mov word [rbp + 7], r14w
mov r8d, 0x26
lea rdx, str.00001303_0000_1000_8000_00805F9B34FB
lea rcx, [rbp + 7]
call fcn.14000c900
nop
cmp rbx, rsi
je 0x1400164db
movups xmm0, xmmword [rbp + 7]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rbp + 0x17]
movups xmmword [rbx + 0x10], xmm1
mov rdx, rdi
mov word [rbp + 7], r14w
add rbx, 0x20
mov qword [rbp - 0x21], rbx
jmp 0x1400164f7
lea r8, [rbp + 7]
mov rdx, rbx
lea rcx, [rbp - 0x29]
call fcn.14000ca90
mov rsi, qword [rbp - 0x19]
mov rbx, qword [rbp - 0x21]
mov rdx, qword [rbp + 0x1f]
cmp rdx, 8
jb 0x140016533
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001652e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400169a2
call fcn.140019b64
movdqa xmm0, xmmword [0x140046520]
movdqu xmmword [rbp + 0x17], xmm0
mov word [rbp + 7], r14w
mov r8d, 0x26
lea rdx, str.00001304_0000_1000_8000_00805F9B34FB
lea rcx, [rbp + 7]
call fcn.14000c900
nop
cmp rbx, rsi
je 0x140016582
movups xmm0, xmmword [rbp + 7]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rbp + 0x17]
movups xmmword [rbx + 0x10], xmm1
mov rdx, rdi
mov word [rbp + 7], r14w
add rbx, 0x20
mov qword [rbp - 0x21], rbx
jmp 0x14001659e
lea r8, [rbp + 7]
mov rdx, rbx
lea rcx, [rbp - 0x29]
call fcn.14000ca90
mov rsi, qword [rbp - 0x19]
mov rbx, qword [rbp - 0x21]
mov rdx, qword [rbp + 0x1f]
cmp rdx, 8
jb 0x1400165da
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400165d5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400169a2
call fcn.140019b64
movdqa xmm0, xmmword [0x140046520]
movdqu xmmword [rbp + 0x17], xmm0
mov word [rbp + 7], r14w
mov r8d, 0x26
lea rdx, str.00001112_0000_1000_8000_00805f9b34fb
lea rcx, [rbp + 7]
call fcn.14000c900
nop
cmp rbx, rsi
je 0x140016629
movups xmm0, xmmword [rbp + 7]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rbp + 0x17]
movups xmmword [rbx + 0x10], xmm1
mov rdx, rdi
mov word [rbp + 7], r14w
add rbx, 0x20
mov qword [rbp - 0x21], rbx
jmp 0x140016645
lea r8, [rbp + 7]
mov rdx, rbx
lea rcx, [rbp - 0x29]
call fcn.14000ca90
mov rsi, qword [rbp - 0x19]
mov rbx, qword [rbp - 0x21]
mov rdx, qword [rbp + 0x1f]
cmp rdx, 8
jb 0x140016681
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001667c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400169a2
call fcn.140019b64
movdqa xmm0, xmmword [0x140046520]
movdqu xmmword [rbp + 0x17], xmm0
mov word [rbp + 7], r14w
mov r8d, 0x26
lea rdx, str.0000112d_0000_1000_8000_00805f9b34fb
lea rcx, [rbp + 7]
call fcn.14000c900
nop
cmp rbx, rsi
je 0x1400166d0
movups xmm0, xmmword [rbp + 7]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rbp + 0x17]
movups xmmword [rbx + 0x10], xmm1
mov rdx, rdi
mov word [rbp + 7], r14w
add rbx, 0x20
mov qword [rbp - 0x21], rbx
jmp 0x1400166ec
lea r8, [rbp + 7]
mov rdx, rbx
lea rcx, [rbp - 0x29]
call fcn.14000ca90
mov rsi, qword [rbp - 0x19]
mov rbx, qword [rbp - 0x21]
mov rdx, qword [rbp + 0x1f]
cmp rdx, 8
jb 0x140016728
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140016723
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400169a2
call fcn.140019b64
movdqa xmm0, xmmword [0x140046520]
movdqu xmmword [rbp + 0x17], xmm0
mov word [rbp + 7], r14w
mov r8d, 0x26
lea rdx, str.0000112e_0000_1000_8000_00805f9b34fb
lea rcx, [rbp + 7]
call fcn.14000c900
nop
cmp rbx, rsi
je 0x140016777
movups xmm0, xmmword [rbp + 7]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rbp + 0x17]
movups xmmword [rbx + 0x10], xmm1
mov rdx, rdi
mov word [rbp + 7], r14w
add rbx, 0x20
mov qword [rbp - 0x21], rbx
jmp 0x140016793
lea r8, [rbp + 7]
mov rdx, rbx
lea rcx, [rbp - 0x29]
call fcn.14000ca90
mov rsi, qword [rbp - 0x19]
mov rbx, qword [rbp - 0x21]
mov rdx, qword [rbp + 0x1f]
cmp rdx, 8
jb 0x1400167cf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400167ca
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400169a2
call fcn.140019b64
movdqa xmm0, xmmword [0x140046520]
movdqu xmmword [rbp + 0x17], xmm0
mov word [rbp + 7], r14w
mov r8d, 0x26
lea rdx, str.0000112f_0000_1000_8000_00805f9b34fb
lea rcx, [rbp + 7]
call fcn.14000c900
nop
cmp rbx, rsi
je 0x140016817
movups xmm0, xmmword [rbp + 7]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rbp + 0x17]
movups xmmword [rbx + 0x10], xmm1
mov word [rbp + 7], r14w
add rbx, 0x20
jmp 0x140016833
lea r8, [rbp + 7]
mov rdx, rbx
lea rcx, [rbp - 0x29]
call fcn.14000ca90
mov rsi, qword [rbp - 0x19]
mov rbx, qword [rbp - 0x21]
mov rdi, qword [rbp + 0x1f]
cmp rdi, 8
jb 0x14001686f
lea rdx, [rdi*2 + 2]
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001686a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400169a2
call fcn.140019b64
mov r15d, r14d
mov r12, rbx
mov r14, qword [rbp - 0x29]
sub r12, r14
sar r12, 5
test r12, r12
je 0x140016925
xor ecx, ecx
mov edi, ecx
nop dword [rax]
shl rdi, 5
add rdi, r14
cmp qword [rdi + 0x18], 8
jb 0x1400168a1
mov rdi, qword [rdi]
mov qword [rsp + 0x40], rcx
lea rax, [rbp - 9]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rcx
mov eax, dword [0x14004dce8]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetServicesBTHPORTParametersSupportedServices
mov rcx, qword [0x14004dcf0]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140016911
mov dword [rsp + 0x28], 4
lea rax, [rbp - 0x11]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [rbp - 9]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp - 9]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc r15d
mov edi, r15d
cmp rdi, r12
mov ecx, 0
jb 0x140016890
mov qword [0x14004dcf0], r13
test r14, r14
je 0x14001696f
mov rdx, rbx
mov rcx, r14
call fcn.14000d0c0
sub rsi, r14
and rsi, 0xffffffffffffffe0
mov rax, r14
cmp rsi, 0x1000
jb 0x140016964
add rsi, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001699c
mov rdx, rsi
mov rcx, r14
call fcn.140019b64
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140019b40
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400219a8
nop
call fcn.1400219a8
nop
int3