Function at 0x14002fd18
Capabilities:
Persist via windows service
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov qword [r11 - 0x58], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov rbp, r8
mov r14, rdx
lea r12, [0x140106190]
mov eax, 5
lea rbx, str.System
lea r13, [0x1400de280]
mov rcx, qword [0x140106190]
cmp rcx, r12
je 0x14002fd92
test byte [rcx + 0x1c], 1
je 0x14002fd92
cmp byte [rcx + 0x19], al
jb 0x14002fd92
lea edx, [rax + 5]
mov qword [r11 - 0x70], r8
mov qword [r11 - 0x78], r14
mov r9, rbx
mov r8, r13
mov rcx, qword [rcx + 0x10]
call fcn.14002444c
mov rcx, qword [0x140106190]
xor r15d, r15d
mov esi, r15d
lea edi, [r15 + 2]
test rbx, rbx
je 0x14002fdab
test r14, r14
je 0x14002fdab
test rbp, rbp
jne 0x14002fdd9
cmp rcx, r12
je 0x14002fdd4
test byte [rcx + 0x1c], dil
je 0x14002fdd4
cmp byte [rcx + 0x19], dil
jb 0x14002fdd4
mov edx, reloc.WSOCK32.dll_inet_ntoa
mov r8, r13
mov rcx, qword [rcx + 0x10]
call fcn.140003574
mov rcx, qword [0x140106190]
mov esi, 0x80004003
mov rbx, r15
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], r15
test esi, esi
js 0x140030046
mov rax, qword [0x140108fd0]
lea rcx, [0x140108fd0]
mov rax, qword [rax + 0x18]
call qword [case.0x14006e230.0]
add rax, 0x18
mov qword [rsp + 0xb8], rax
mov r9, r14
lea r8, str.System
lea rdx, str.SYSTEMCurrentControlSetServicesEventLog_ls_ls
lea rcx, [rsp + 0xb8]
call fcn.140008d6c
mov r14d, 4
mov rbx, qword [rsp + 0xb8]
mov rcx, qword [0x140106190]
cmp rcx, r12
je 0x14002fe6e
test byte [rcx + 0x1c], dil
je 0x14002fe6e
cmp byte [rcx + 0x19], r14b
jb 0x14002fe6e
lea edx, [r14 + 8]
mov r9, rbx
mov r8, r13
mov rcx, qword [rcx + 0x10]
call fcn.140003598
mov dword [rsp + 0x28], 0x2001f
mov r8, rbx
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x48]
call fcn.14001b934
test eax, eax
je 0x14002febc
mov rcx, qword [0x140106190]
cmp rcx, r12
je 0x14002feb7
test byte [rcx + 0x1c], dil
je 0x14002feb7
cmp byte [rcx + 0x19], dil
jb 0x14002feb7
mov edx, SafeArrayDestroy
mov r8, r13
mov rcx, qword [rcx + 0x10]
call fcn.140003574
mov esi, 0x8000ffff
lea rdx, [rbx - 0x18]
or rbx, 0xffffffffffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x14002fee1
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14006e230.0]
test esi, esi
js 0x14003003a
mov rcx, qword [0x140106190]
cmp rcx, r12
je 0x14002ff12
test byte [rcx + 0x1c], dil
je 0x14002ff12
cmp byte [rcx + 0x19], r14b
jb 0x14002ff12
mov edx, SafeArrayDestroy
mov r8, r13
mov rcx, qword [rcx + 0x10]
call fcn.140003574
mov eax, r15d
test rbp, rbp
setne al
test eax, eax
jne 0x14002ff2a
mov ecx, 0x80004005
call fcn.14000507c
int3
inc rbx
cmp word [rbp + rbx*2], r15w
jne 0x14002ff2a
lea eax, [rbx*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbp
mov r9d, edi
xor r8d, r8d
lea rdx, str.EventMessageFile
mov rbx, qword [rsp + 0x48]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14002ff9b
mov rcx, qword [0x140106190]
cmp rcx, r12
je 0x14002ff94
test byte [rcx + 0x1c], dil
je 0x14002ff94
cmp byte [rcx + 0x19], dil
jb 0x14002ff94
mov edx, reloc.OLEAUT32.dll_SafeArrayDestroy
mov r8, r13
mov rcx, qword [rcx + 0x10]
call fcn.140003574
mov rcx, qword [0x140106190]
mov esi, 0x8000ffff
jmp 0x14002ffa2
mov rcx, qword [0x140106190]
test esi, esi
js 0x140030046
cmp rcx, r12
je 0x14002ffcc
test byte [rcx + 0x1c], dil
je 0x14002ffcc
cmp byte [rcx + 0x19], r14b
jb 0x14002ffcc
mov edx, reloc.OLEAUT32.dll_SafeArrayGetDim
mov r8, r13
mov rcx, qword [rcx + 0x10]
call fcn.140003574
mov dword [rsp + 0xa0], 7
mov dword [rsp + 0x28], r14d
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x20], rax
mov r9d, r14d
xor r8d, r8d
lea rdx, str.TypesSupported
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14003003f
mov rcx, qword [0x140106190]
cmp rcx, r12
je 0x140030033
test byte [rcx + 0x1c], dil
je 0x140030033
cmp byte [rcx + 0x19], dil
jb 0x140030033
mov edx, SafeArrayUnlock
mov r8, r13
mov rcx, qword [rcx + 0x10]
call fcn.140003574
mov rcx, qword [0x140106190]
mov esi, 0x8000ffff
jmp 0x140030046
mov rbx, qword [rsp + 0x48]
mov rcx, qword [0x140106190]
cmp rcx, r12
je 0x140030078
test byte [rcx + 0x1c], 1
je 0x140030078
movzx eax, byte [rcx + 0x19]
test esi, esi
mov edx, 5
cmovns edi, edx
cmp eax, edi
jl 0x140030078
mov edx, SafeArrayAccessData
mov r9d, esi
mov r8, r13
mov rcx, qword [rcx + 0x10]
call fcn.140003634
nop
test rbx, rbx
je 0x140030086
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov rbx, qword [rsp + 0xa8]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret