Function at 0x140031a58
Capabilities:
Persist via windows service
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov qword [r11 - 0x58], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov r12, r8
mov rdi, rdx
lea r14, [0x14014dd40]
mov eax, 5
lea r15, str.System
mov rcx, qword [0x14014dd40]
cmp rcx, r14
je 0x140031acf
test byte [rcx + 0x1c], 1
je 0x140031acf
cmp byte [rcx + 0x19], al
jb 0x140031acf
lea edx, [rax + 5]
mov qword [r11 - 0x70], r8
mov qword [r11 - 0x78], rdi
mov r9, r15
lea r8, [0x14011c560]
mov rcx, qword [rcx + 0x10]
call fcn.140025b48
mov rcx, qword [0x14014dd40]
xor r13d, r13d
mov ebp, r13d
lea esi, [r13 + 2]
test r15, r15
je 0x140031ae8
test rdi, rdi
je 0x140031ae8
test r12, r12
jne 0x140031b1a
cmp rcx, r14
je 0x140031b15
test byte [rcx + 0x1c], sil
je 0x140031b15
cmp byte [rcx + 0x19], sil
jb 0x140031b15
mov edx, reloc.WSOCK32.dll_inet_ntoa
lea r8, [0x14011c560]
mov rcx, qword [rcx + 0x10]
call fcn.140003614
mov rcx, qword [0x14014dd40]
mov ebp, 0x80004003
mov rbx, r13
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], r13
test ebp, ebp
js 0x140031dc4
mov rax, qword [0x14014e920]
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [fcn.140009050]
lea rcx, [0x14014e920]
call rbx
add rax, 0x18
mov qword [rsp + 0xb8], rax
mov r9, rdi
mov r8, r15
lea rdx, str.SYSTEMCurrentControlSetServicesEventLog_ls_ls
lea rcx, [rsp + 0xb8]
call fcn.14000916c
mov rbx, qword [rsp + 0xb8]
mov rcx, qword [0x14014dd40]
lea rdi, [0x14014dd40]
cmp rcx, rdi
je 0x140031bb6
test byte [rcx + 0x1c], sil
je 0x140031bb6
cmp byte [rcx + 0x19], 4
jb 0x140031bb6
mov edx, SafeArrayGetDim
mov r9, rbx
lea r8, [0x14011c560]
mov rcx, qword [rcx + 0x10]
call fcn.140003638
mov dword [rsp + 0x28], 0x2001f
mov r8, rbx
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x48]
call fcn.14001cc38
test eax, eax
je 0x140031c08
mov rcx, qword [0x14014dd40]
cmp rcx, rdi
je 0x140031c03
test byte [rcx + 0x1c], sil
je 0x140031c03
cmp byte [rcx + 0x19], sil
jb 0x140031c03
mov edx, reloc.Cabinet.dll_FCIFlushCabinet
lea r8, [0x14011c560]
mov rcx, qword [rcx + 0x10]
call fcn.140003614
mov ebp, 0x8000ffff
lea r15, [rbx - 0x18]
or r14, 0xffffffffffffffff
mov eax, r14d
lock xadd dword [r15 + 0x10], eax
add eax, r14d
test eax, eax
jg 0x140031c42
mov rdi, qword [r15]
mov rax, qword [rdi]
mov rbx, qword [rax + 8]
mov rcx, rbx
call qword [fcn.140009050]
mov rdx, r15
mov rcx, rdi
call rbx
lea rdi, [0x14014dd40]
test ebp, ebp
js 0x140031db1
mov rcx, qword [0x14014dd40]
cmp rcx, rdi
je 0x140031c77
test byte [rcx + 0x1c], sil
je 0x140031c77
cmp byte [rcx + 0x19], 4
jb 0x140031c77
mov edx, reloc.Cabinet.dll_FCIDestroy
lea r8, [0x14011c560]
mov rcx, qword [rcx + 0x10]
call fcn.140003614
mov eax, r13d
test r12, r12
setne al
test eax, eax
jne 0x140031c8f
mov ecx, 0x80004005
call fcn.140005300
int3
inc r14
cmp word [r12 + r14*2], r13w
jne 0x140031c8f
lea eax, [r14*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r12
mov r9d, esi
xor r8d, r8d
lea rdx, str.EventMessageFile
mov rbx, qword [rsp + 0x48]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x140031d04
mov rcx, qword [0x14014dd40]
cmp rcx, rdi
je 0x140031cfd
test byte [rcx + 0x1c], sil
je 0x140031cfd
cmp byte [rcx + 0x19], sil
jb 0x140031cfd
mov edx, reloc.OLEAUT32.dll_SafeArrayDestroy
lea r8, [0x14011c560]
mov rcx, qword [rcx + 0x10]
call fcn.140003614
mov rcx, qword [0x14014dd40]
mov ebp, 0x8000ffff
jmp 0x140031d0b
mov rcx, qword [0x14014dd40]
test ebp, ebp
js 0x140031dbd
cmp rcx, rdi
je 0x140031d39
test byte [rcx + 0x1c], sil
je 0x140031d39
cmp byte [rcx + 0x19], 4
jb 0x140031d39
mov edx, reloc.OLEAUT32.dll_SafeArrayGetDim
lea r8, [0x14011c560]
mov rcx, qword [rcx + 0x10]
call fcn.140003614
mov dword [rsp + 0xa0], 7
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.TypesSupported
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x140031db6
mov rcx, qword [0x14014dd40]
cmp rcx, rdi
je 0x140031daa
test byte [rcx + 0x1c], sil
je 0x140031daa
cmp byte [rcx + 0x19], sil
jb 0x140031daa
mov edx, SafeArrayUnlock
lea r8, [0x14011c560]
mov rcx, qword [rcx + 0x10]
call fcn.140003614
mov rcx, qword [0x14014dd40]
mov ebp, 0x8000ffff
jmp 0x140031dbd
mov rbx, qword [rsp + 0x48]
mov rcx, qword [0x14014dd40]
lea r14, [0x14014dd40]
cmp rcx, r14
je 0x140031dfa
test byte [rcx + 0x1c], 1
je 0x140031dfa
movzx eax, byte [rcx + 0x19]
test ebp, ebp
mov edx, 5
cmovns esi, edx
cmp eax, esi
jl 0x140031dfa
mov edx, SafeArrayAccessData
mov r9d, ebp
lea r8, [0x14011c560]
mov rcx, qword [rcx + 0x10]
call fcn.1400036d4
nop
test rbx, rbx
je 0x140031e08
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebp
mov rbx, qword [rsp + 0xa8]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret