Function at 0x14003f5f4
Capabilities:
Persist via windows service
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov qword [r11 - 0x58], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov r12, r8
mov rdi, rdx
lea r14, [0x140148ea8]
mov eax, 5
lea r15, [0x14003f9c0]
mov rcx, qword [0x140148ea8]
cmp rcx, r14
je 0x14003f66b
test byte [rcx + 0x1c], 1
je 0x14003f66b
cmp byte [rcx + 0x19], al
jb 0x14003f66b
lea edx, [rax + 5]
mov qword [r11 - 0x70], r8
mov qword [r11 - 0x78], rdi
mov r9, r15
lea r8, [0x140006038]
mov rcx, qword [rcx + 0x10]
call fcn.140033380
mov rcx, qword [0x140148ea8]
xor r13d, r13d
mov ebp, r13d
lea esi, [r13 + 2]
test r15, r15
je 0x14003f684
test rdi, rdi
je 0x14003f684
test r12, r12
jne 0x14003f6b6
cmp rcx, r14
je 0x14003f6b1
test byte [rcx + 0x1c], sil
je 0x14003f6b1
cmp byte [rcx + 0x19], sil
jb 0x14003f6b1
mov edx, reloc.WSOCK32.dll_inet_ntoa
lea r8, [0x140006038]
mov rcx, qword [rcx + 0x10]
call fcn.14000fcb0
mov rcx, qword [0x140148ea8]
mov ebp, 0x80004003
mov rbx, r13
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], r13
test ebp, ebp
js 0x14003f960
mov rax, qword [section..data]
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [fcn.140015690]
lea rcx, section..data
call rbx
add rax, 0x18
mov qword [rsp + 0xb8], rax
mov r9, rdi
mov r8, r15
lea rdx, [0x14003f9d0]
lea rcx, [rsp + 0xb8]
call fcn.1400157a0
mov rbx, qword [rsp + 0xb8]
mov rcx, qword [0x140148ea8]
lea rdi, [0x140148ea8]
cmp rcx, rdi
je 0x14003f752
test byte [rcx + 0x1c], sil
je 0x14003f752
cmp byte [rcx + 0x19], 4
jb 0x14003f752
mov edx, SafeArrayGetDim
mov r9, rbx
lea r8, [0x140006038]
mov rcx, qword [rcx + 0x10]
call fcn.14000fcd0
mov dword [rsp + 0x28], 0x2001f
mov r8, rbx
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x48]
call fcn.140029e44
test eax, eax
je 0x14003f7a4
mov rcx, qword [0x140148ea8]
cmp rcx, rdi
je 0x14003f79f
test byte [rcx + 0x1c], sil
je 0x14003f79f
cmp byte [rcx + 0x19], sil
jb 0x14003f79f
mov edx, reloc.Cabinet.dll_FCIFlushCabinet
lea r8, [0x140006038]
mov rcx, qword [rcx + 0x10]
call fcn.14000fcb0
mov ebp, 0x8000ffff
lea r15, [rbx - 0x18]
or r14, 0xffffffffffffffff
mov eax, r14d
lock xadd dword [r15 + 0x10], eax
add eax, r14d
test eax, eax
jg 0x14003f7de
mov rdi, qword [r15]
mov rax, qword [rdi]
mov rbx, qword [rax + 8]
mov rcx, rbx
call qword [fcn.140015690]
mov rdx, r15
mov rcx, rdi
call rbx
lea rdi, [0x140148ea8]
test ebp, ebp
js 0x14003f94d
mov rcx, qword [0x140148ea8]
cmp rcx, rdi
je 0x14003f813
test byte [rcx + 0x1c], sil
je 0x14003f813
cmp byte [rcx + 0x19], 4
jb 0x14003f813
mov edx, reloc.Cabinet.dll_FCIDestroy
lea r8, [0x140006038]
mov rcx, qword [rcx + 0x10]
call fcn.14000fcb0
mov eax, r13d
test r12, r12
setne al
test eax, eax
jne 0x14003f82b
mov ecx, 0x80004005
call fcn.1400119f0
int3
inc r14
cmp word [r12 + r14*2], r13w
jne 0x14003f82b
lea eax, [r14*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r12
mov r9d, esi
xor r8d, r8d
lea rdx, [0x14003fa38]
mov rbx, qword [rsp + 0x48]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14003f8a0
mov rcx, qword [0x140148ea8]
cmp rcx, rdi
je 0x14003f899
test byte [rcx + 0x1c], sil
je 0x14003f899
cmp byte [rcx + 0x19], sil
jb 0x14003f899
mov edx, reloc.OLEAUT32.dll_SafeArrayDestroy
lea r8, [0x140006038]
mov rcx, qword [rcx + 0x10]
call fcn.14000fcb0
mov rcx, qword [0x140148ea8]
mov ebp, 0x8000ffff
jmp 0x14003f8a7
mov rcx, qword [0x140148ea8]
test ebp, ebp
js 0x14003f959
cmp rcx, rdi
je 0x14003f8d5
test byte [rcx + 0x1c], sil
je 0x14003f8d5
cmp byte [rcx + 0x19], 4
jb 0x14003f8d5
mov edx, reloc.OLEAUT32.dll_SafeArrayGetDim
lea r8, [0x140006038]
mov rcx, qword [rcx + 0x10]
call fcn.14000fcb0
mov dword [rsp + 0xa0], 7
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, [0x14003fa60]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14003f952
mov rcx, qword [0x140148ea8]
cmp rcx, rdi
je 0x14003f946
test byte [rcx + 0x1c], sil
je 0x14003f946
cmp byte [rcx + 0x19], sil
jb 0x14003f946
mov edx, SafeArrayUnlock
lea r8, [0x140006038]
mov rcx, qword [rcx + 0x10]
call fcn.14000fcb0
mov rcx, qword [0x140148ea8]
mov ebp, 0x8000ffff
jmp 0x14003f959
mov rbx, qword [rsp + 0x48]
mov rcx, qword [0x140148ea8]
lea r14, [0x140148ea8]
cmp rcx, r14
je 0x14003f996
test byte [rcx + 0x1c], 1
je 0x14003f996
movzx eax, byte [rcx + 0x19]
test ebp, ebp
mov edx, 5
cmovns esi, edx
cmp eax, esi
jl 0x14003f996
mov edx, SafeArrayAccessData
mov r9d, ebp
lea r8, [0x140006038]
mov rcx, qword [rcx + 0x10]
call fcn.14000fd64
nop
test rbx, rbx
je 0x14003f9a4
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebp
mov rbx, qword [rsp + 0xa8]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret