Function at 0x140015770
Capabilities:
Persist via windows service
Set registry value

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xb0
mov qword [rbp + 0xf], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
mov rax, qword [0x14004b008]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov r15, qword [0x14004bbd0]
mov qword [0x14004bbd0], 0xffffffff80000002
mov dword [rbp - 1], 1
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x19], xmm0
xor r12d, r12d
mov qword [rbp - 9], r12
mov qword [rbp + 0x2f], 7
mov qword [rbp + 0x27], r12
mov word [rbp + 0x17], r12w
lea r8d, [r12 + 0x26]
lea rdx, str.00001104_0000_1000_8000_00805F9B34FB
lea rcx, [rbp + 0x17]
call fcn.14000c490
nop
lea rdx, [rbp + 0x17]
lea rcx, [rbp - 0x19]
call fcn.14000c120
nop
movabs rbx, 0x7fffffffffffffff
mov rax, qword [rbp + 0x2f]
cmp rax, 8
jb 0x140015875
inc rax
mov rcx, qword [rbp + 0x17]
cmp rax, rbx
jbe 0x14001582c
call fcn.140022518
int3
add rax, rax
cmp rax, 0x1000
jb 0x140015870
test byte [rbp + 0x17], 0x1f
je 0x140015843
call fcn.140022518
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x140015852
call fcn.140022518
int3
sub rcx, rax
cmp rcx, 8
jae 0x140015861
call fcn.140022518
int3
cmp rcx, 0x27
jbe 0x14001586d
call fcn.140022518
int3
mov rcx, rax
call fcn.140019294
mov qword [rbp + 0x2f], 7
mov qword [rbp + 0x27], r12
mov word [rbp + 0x17], r12w
mov r8d, 0x26
lea rdx, str.00001105_0000_1000_8000_00805F9B34FB
lea rcx, [rbp + 0x17]
call fcn.14000c490
nop
lea rdx, [rbp + 0x17]
lea rcx, [rbp - 0x19]
call fcn.14000c120
nop
mov rax, qword [rbp + 0x2f]
cmp rax, 8
jb 0x140015910
inc rax
mov rcx, qword [rbp + 0x17]
cmp rax, rbx
jbe 0x1400158c7
call fcn.140022518
int3
add rax, rax
cmp rax, 0x1000
jb 0x14001590b
test byte [rbp + 0x17], 0x1f
je 0x1400158de
call fcn.140022518
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x1400158ed
call fcn.140022518
int3
sub rcx, rax
cmp rcx, 8
jae 0x1400158fc
call fcn.140022518
int3
cmp rcx, 0x27
jbe 0x140015908
call fcn.140022518
int3
mov rcx, rax
call fcn.140019294
mov qword [rbp + 0x2f], 7
mov qword [rbp + 0x27], r12
mov word [rbp + 0x17], r12w
mov r8d, 0x26
lea rdx, str.00001106_0000_1000_8000_00805F9B34FB
lea rcx, [rbp + 0x17]
call fcn.14000c490
nop
lea rdx, [rbp + 0x17]
lea rcx, [rbp - 0x19]
call fcn.14000c120
nop
mov rax, qword [rbp + 0x2f]
cmp rax, 8
jb 0x1400159ab
inc rax
mov rcx, qword [rbp + 0x17]
cmp rax, rbx
jbe 0x140015962
call fcn.140022518
int3
add rax, rax
cmp rax, 0x1000
jb 0x1400159a6
test byte [rbp + 0x17], 0x1f
je 0x140015979
call fcn.140022518
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x140015988
call fcn.140022518
int3
sub rcx, rax
cmp rcx, 8
jae 0x140015997
call fcn.140022518
int3
cmp rcx, 0x27
jbe 0x1400159a3
call fcn.140022518
int3
mov rcx, rax
call fcn.140019294
mov qword [rbp + 0x2f], 7
mov qword [rbp + 0x27], r12
mov word [rbp + 0x17], r12w
mov r8d, 0x26
lea rdx, str.0000110c_0000_1000_8000_00805F9B34FB
lea rcx, [rbp + 0x17]
call fcn.14000c490
nop
lea rdx, [rbp + 0x17]
lea rcx, [rbp - 0x19]
call fcn.14000c120
nop
mov rax, qword [rbp + 0x2f]
cmp rax, 8
jb 0x140015a46
inc rax
mov rcx, qword [rbp + 0x17]
cmp rax, rbx
jbe 0x1400159fd
call fcn.140022518
int3
add rax, rax
cmp rax, 0x1000
jb 0x140015a41
test byte [rbp + 0x17], 0x1f
je 0x140015a14
call fcn.140022518
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x140015a23
call fcn.140022518
int3
sub rcx, rax
cmp rcx, 8
jae 0x140015a32
call fcn.140022518
int3
cmp rcx, 0x27
jbe 0x140015a3e
call fcn.140022518
int3
mov rcx, rax
call fcn.140019294
mov qword [rbp + 0x2f], 7
mov qword [rbp + 0x27], r12
mov word [rbp + 0x17], r12w
mov r8d, 0x26
lea rdx, str.0000110e_0000_1000_8000_00805F9B34FB
lea rcx, [rbp + 0x17]
call fcn.14000c490
nop
lea rdx, [rbp + 0x17]
lea rcx, [rbp - 0x19]
call fcn.14000c120
nop
mov rax, qword [rbp + 0x2f]
cmp rax, 8
jb 0x140015ae1
inc rax
mov rcx, qword [rbp + 0x17]
cmp rax, rbx
jbe 0x140015a98
call fcn.140022518
int3
add rax, rax
cmp rax, 0x1000
jb 0x140015adc
test byte [rbp + 0x17], 0x1f
je 0x140015aaf
call fcn.140022518
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x140015abe
call fcn.140022518
int3
sub rcx, rax
cmp rcx, 8
jae 0x140015acd
call fcn.140022518
int3
cmp rcx, 0x27
jbe 0x140015ad9
call fcn.140022518
int3
mov rcx, rax
call fcn.140019294
mov qword [rbp + 0x2f], 7
mov qword [rbp + 0x27], r12
mov word [rbp + 0x17], r12w
mov r8d, 0x26
lea rdx, str.00001111_0000_1000_8000_00805F9B34FB
lea rcx, [rbp + 0x17]
call fcn.14000c490
nop
lea rdx, [rbp + 0x17]
lea rcx, [rbp - 0x19]
call fcn.14000c120
nop
mov rax, qword [rbp + 0x2f]
cmp rax, 8
jb 0x140015b7c
inc rax
mov rcx, qword [rbp + 0x17]
cmp rax, rbx
jbe 0x140015b33
call fcn.140022518
int3
add rax, rax
cmp rax, 0x1000
jb 0x140015b77
test byte [rbp + 0x17], 0x1f
je 0x140015b4a
call fcn.140022518
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x140015b59
call fcn.140022518
int3
sub rcx, rax
cmp rcx, 8
jae 0x140015b68
call fcn.140022518
int3
cmp rcx, 0x27
jbe 0x140015b74
call fcn.140022518
int3
mov rcx, rax
call fcn.140019294
mov qword [rbp + 0x2f], 7
mov qword [rbp + 0x27], r12
mov word [rbp + 0x17], r12w
mov r8d, 0x26
lea rdx, str.00001118_0000_1000_8000_00805F9B34FB
lea rcx, [rbp + 0x17]
call fcn.14000c490
nop
lea rdx, [rbp + 0x17]
lea rcx, [rbp - 0x19]
call fcn.14000c120
nop
mov rax, qword [rbp + 0x2f]
cmp rax, 8
jb 0x140015c17
inc rax
mov rcx, qword [rbp + 0x17]
cmp rax, rbx
jbe 0x140015bce
call fcn.140022518
int3
add rax, rax
cmp rax, 0x1000
jb 0x140015c12
test byte [rbp + 0x17], 0x1f
je 0x140015be5
call fcn.140022518
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x140015bf4
call fcn.140022518
int3
sub rcx, rax
cmp rcx, 8
jae 0x140015c03
call fcn.140022518
int3
cmp rcx, 0x27
jbe 0x140015c0f
call fcn.140022518
int3
mov rcx, rax
call fcn.140019294
mov qword [rbp + 0x2f], 7
mov qword [rbp + 0x27], r12
mov word [rbp + 0x17], r12w
mov r8d, 0x26
lea rdx, str.00001123_0000_1000_8000_00805F9B34FB
lea rcx, [rbp + 0x17]
call fcn.14000c490
nop
lea rdx, [rbp + 0x17]
lea rcx, [rbp - 0x19]
call fcn.14000c120
nop
mov rax, qword [rbp + 0x2f]
cmp rax, 8
jb 0x140015cb2
inc rax
mov rcx, qword [rbp + 0x17]
cmp rax, rbx
jbe 0x140015c69
call fcn.140022518
int3
add rax, rax
cmp rax, 0x1000
jb 0x140015cad
test byte [rbp + 0x17], 0x1f
je 0x140015c80
call fcn.140022518
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x140015c8f
call fcn.140022518
int3
sub rcx, rax
cmp rcx, 8
jae 0x140015c9e
call fcn.140022518
int3
cmp rcx, 0x27
jbe 0x140015caa
call fcn.140022518
int3
mov rcx, rax
call fcn.140019294
mov qword [rbp + 0x2f], 7
mov qword [rbp + 0x27], r12
mov word [rbp + 0x17], r12w
mov r8d, 0x26
lea rdx, str.0000110a_0000_1000_8000_00805F9B34FB
lea rcx, [rbp + 0x17]
call fcn.14000c490
nop
lea rdx, [rbp + 0x17]
lea rcx, [rbp - 0x19]
call fcn.14000c120
nop
mov rax, qword [rbp + 0x2f]
cmp rax, 8
jb 0x140015d4d
inc rax
mov rcx, qword [rbp + 0x17]
cmp rax, rbx
jbe 0x140015d04
call fcn.140022518
int3
add rax, rax
cmp rax, 0x1000
jb 0x140015d48
test byte [rbp + 0x17], 0x1f
je 0x140015d1b
call fcn.140022518
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x140015d2a
call fcn.140022518
int3
sub rcx, rax
cmp rcx, 8
jae 0x140015d39
call fcn.140022518
int3
cmp rcx, 0x27
jbe 0x140015d45
call fcn.140022518
int3
mov rcx, rax
call fcn.140019294
mov qword [rbp + 0x2f], 7
mov qword [rbp + 0x27], r12
mov word [rbp + 0x17], r12w
mov r8d, 0x26
lea rdx, str.00001303_0000_1000_8000_00805F9B34FB
lea rcx, [rbp + 0x17]
call fcn.14000c490
nop
lea rdx, [rbp + 0x17]
lea rcx, [rbp - 0x19]
call fcn.14000c120
nop
mov rax, qword [rbp + 0x2f]
cmp rax, 8
jb 0x140015de8
inc rax
mov rcx, qword [rbp + 0x17]
cmp rax, rbx
jbe 0x140015d9f
call fcn.140022518
int3
add rax, rax
cmp rax, 0x1000
jb 0x140015de3
test byte [rbp + 0x17], 0x1f
je 0x140015db6
call fcn.140022518
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x140015dc5
call fcn.140022518
int3
sub rcx, rax
cmp rcx, 8
jae 0x140015dd4
call fcn.140022518
int3
cmp rcx, 0x27
jbe 0x140015de0
call fcn.140022518
int3
mov rcx, rax
call fcn.140019294
mov qword [rbp + 0x2f], 7
mov qword [rbp + 0x27], r12
mov word [rbp + 0x17], r12w
mov r8d, 0x26
lea rdx, str.00001304_0000_1000_8000_00805F9B34FB
lea rcx, [rbp + 0x17]
call fcn.14000c490
nop
lea rdx, [rbp + 0x17]
lea rcx, [rbp - 0x19]
call fcn.14000c120
nop
mov rax, qword [rbp + 0x2f]
cmp rax, 8
jb 0x140015e83
inc rax
mov rcx, qword [rbp + 0x17]
cmp rax, rbx
jbe 0x140015e3a
call fcn.140022518
int3
add rax, rax
cmp rax, 0x1000
jb 0x140015e7e
test byte [rbp + 0x17], 0x1f
je 0x140015e51
call fcn.140022518
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x140015e60
call fcn.140022518
int3
sub rcx, rax
cmp rcx, 8
jae 0x140015e6f
call fcn.140022518
int3
cmp rcx, 0x27
jbe 0x140015e7b
call fcn.140022518
int3
mov rcx, rax
call fcn.140019294
mov qword [rbp + 0x2f], 7
mov qword [rbp + 0x27], r12
mov word [rbp + 0x17], r12w
mov r8d, 0x26
lea rdx, str.00001112_0000_1000_8000_00805f9b34fb
lea rcx, [rbp + 0x17]
call fcn.14000c490
nop
lea rdx, [rbp + 0x17]
lea rcx, [rbp - 0x19]
call fcn.14000c120
nop
mov rax, qword [rbp + 0x2f]
cmp rax, 8
jb 0x140015f1e
inc rax
mov rcx, qword [rbp + 0x17]
cmp rax, rbx
jbe 0x140015ed5
call fcn.140022518
int3
add rax, rax
cmp rax, 0x1000
jb 0x140015f19
test byte [rbp + 0x17], 0x1f
je 0x140015eec
call fcn.140022518
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x140015efb
call fcn.140022518
int3
sub rcx, rax
cmp rcx, 8
jae 0x140015f0a
call fcn.140022518
int3
cmp rcx, 0x27
jbe 0x140015f16
call fcn.140022518
int3
mov rcx, rax
call fcn.140019294
mov qword [rbp + 0x2f], 7
mov qword [rbp + 0x27], r12
mov word [rbp + 0x17], r12w
mov r8d, 0x26
lea rdx, str.0000112d_0000_1000_8000_00805f9b34fb
lea rcx, [rbp + 0x17]
call fcn.14000c490
nop
lea rdx, [rbp + 0x17]
lea rcx, [rbp - 0x19]
call fcn.14000c120
nop
mov rax, qword [rbp + 0x2f]
cmp rax, 8
jb 0x140015fb9
inc rax
mov rcx, qword [rbp + 0x17]
cmp rax, rbx
jbe 0x140015f70
call fcn.140022518
int3
add rax, rax
cmp rax, 0x1000
jb 0x140015fb4
test byte [rbp + 0x17], 0x1f
je 0x140015f87
call fcn.140022518
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x140015f96
call fcn.140022518
int3
sub rcx, rax
cmp rcx, 8
jae 0x140015fa5
call fcn.140022518
int3
cmp rcx, 0x27
jbe 0x140015fb1
call fcn.140022518
int3
mov rcx, rax
call fcn.140019294
mov qword [rbp + 0x2f], 7
mov qword [rbp + 0x27], r12
mov word [rbp + 0x17], r12w
mov r8d, 0x26
lea rdx, str.0000112e_0000_1000_8000_00805f9b34fb
lea rcx, [rbp + 0x17]
call fcn.14000c490
nop
lea rdx, [rbp + 0x17]
lea rcx, [rbp - 0x19]
call fcn.14000c120
nop
mov rax, qword [rbp + 0x2f]
cmp rax, 8
jb 0x140016054
inc rax
mov rcx, qword [rbp + 0x17]
cmp rax, rbx
jbe 0x14001600b
call fcn.140022518
int3
add rax, rax
cmp rax, 0x1000
jb 0x14001604f
test byte [rbp + 0x17], 0x1f
je 0x140016022
call fcn.140022518
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x140016031
call fcn.140022518
int3
sub rcx, rax
cmp rcx, 8
jae 0x140016040
call fcn.140022518
int3
cmp rcx, 0x27
jbe 0x14001604c
call fcn.140022518
int3
mov rcx, rax
call fcn.140019294
mov qword [rbp + 0x2f], 7
mov qword [rbp + 0x27], r12
mov word [rbp + 0x17], r12w
mov r8d, 0x26
lea rdx, str.0000112f_0000_1000_8000_00805f9b34fb
lea rcx, [rbp + 0x17]
call fcn.14000c490
nop
lea rdx, [rbp + 0x17]
lea rcx, [rbp - 0x19]
call fcn.14000c120
nop
mov rax, qword [rbp + 0x2f]
cmp rax, 8
jb 0x1400160ef
inc rax
mov rcx, qword [rbp + 0x17]
cmp rax, rbx
jbe 0x1400160a6
call fcn.140022518
int3
add rax, rax
cmp rax, 0x1000
jb 0x1400160ea
test byte [rbp + 0x17], 0x1f
je 0x1400160bd
call fcn.140022518
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x1400160cc
call fcn.140022518
int3
sub rcx, rax
cmp rcx, 8
jae 0x1400160db
call fcn.140022518
int3
cmp rcx, 0x27
jbe 0x1400160e7
call fcn.140022518
int3
mov rcx, rax
call fcn.140019294
mov qword [rbp + 0x2f], 7
mov qword [rbp + 0x27], r12
mov word [rbp + 0x17], r12w
mov edi, r12d
mov rsi, qword [rbp - 0x11]
mov r14, qword [rbp - 0x19]
sub rsi, r14
sar rsi, 5
test rsi, rsi
je 0x1400161af
mov rbx, r12
nop
shl rbx, 5
add rbx, r14
cmp qword [rbx + 0x18], 8
jb 0x140016131
mov rbx, qword [rbx]
mov qword [rsp + 0x40], r12
lea rax, [rbp + 7]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov eax, dword [0x14004bbc8]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetServicesBTHPORTParametersSupportedServices
mov rcx, qword [0x14004bbd0]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400161a2
mov dword [rsp + 0x28], 4
lea rax, [rbp - 1]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rdx, rbx
mov rcx, qword [rbp + 7]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 7]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc edi
mov ebx, edi
cmp rbx, rsi
jb 0x140016120
mov qword [0x14004bbd0], r15
lea rcx, [rbp - 0x19]
call fcn.1400180d0
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.140019260
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret