Function at 0x14005bd90
Capabilities:
Persist via windows service
Set registry value

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rdi, rdx
mov rbx, rcx
mov r15, qword [rcx + 0x10]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r15
cmp rax, 0x22
jb 0x14005c18b
mov r13, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x14005bde2
mov r13, qword [rbx]
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x10], xmm1
lea r12, [r15 + 0x22]
mov esi, select
lea r14, [rbp - 0x20]
cmp r12, rsi
jbe 0x14005be7d
mov rsi, r12
or rsi, 0xf
cmp rsi, rcx
jbe 0x14005be3f
mov rsi, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.14009bb58
test rax, rax
je 0x14005c1a3
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x14005be79
mov eax, socket
cmp rsi, rax
cmovb rsi, rax
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x14005be67
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14005c17f
jmp 0x14005be20
test rcx, rcx
je 0x14005be76
call fcn.14009bb58
mov r14, rax
jmp 0x14005be79
xor r14d, r14d
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x10], r12
mov qword [rbp - 8], rsi
movups xmm0, xmmword [str.SYSTEMCurrentControlSetServices_]
movups xmmword [r14], xmm0
movups xmm1, xmmword [0x1400f9db8]
movups xmmword [r14 + 0x10], xmm1
movzx eax, word [0x1400f9dc8]
mov word [r14 + 0x20], ax
lea rcx, [r14 + 0x22]
mov r8, r15
mov rdx, r13
call fcn.14009dd50
mov byte [r14 + r12], 0
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 0x10
cmovae rdx, qword [rbp - 0x20]
lea r8, [rbp + 0x50]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x14005c087
mov dword [rbp + 0x40], 1
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.ErrorControl
mov rcx, qword [rbp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Type
mov rcx, qword [rbp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [rbp + 0x40], 3
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Start
mov rcx, qword [rbp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [rdi + 0x10]
mov rax, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x14005bf82
mov rax, qword [rdi]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
lea rdx, str.ImagePath
mov rcx, qword [rbp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x14005bfea
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005bfe5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005c191
call fcn.14009ba30
movdqa xmm0, xmmword [0x1400fd660]
movdqu xmmword [rbp - 0x10], xmm0
mov byte [rbp - 0x20], 0
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x14005c035
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x14005c030
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14005c197
mov rcx, r8
call fcn.14009ba30
xor esi, esi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], select
mov byte [rbx], sil
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x14005c080
inc rdx
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x14005c07b
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14005c19d
mov rcx, r8
call fcn.14009ba30
mov al, 1
jmp 0x14005c152
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x14005c0c2
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005c0bd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005c1a3
call fcn.14009ba30
movdqa xmm0, xmmword [0x1400fd660]
movdqu xmmword [rbp - 0x10], xmm0
mov byte [rbp - 0x20], 0
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x14005c109
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x14005c104
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14005c179
mov rcx, r8
call fcn.14009ba30
xor esi, esi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], select
mov byte [rbx], sil
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x14005c150
inc rdx
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x14005c14b
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14005c185
mov rcx, r8
call fcn.14009ba30
xor al, al
mov byte [rdi], 0
mov qword [rdi + 0x18], select
mov qword [rdi + 0x10], rsi
mov rbx, qword [rsp + 0xa8]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1400a4160
nop
call fcn.140001410
nop
call fcn.1400a4160
nop
call fcn.1400014b0
int3
call fcn.1400a4160
nop
call fcn.1400a4160
nop
call fcn.1400a4160
nop
call fcn.1400a4160
int3