Function at 0x140011249
Capabilities:
Persist via windows service
Set registry value

Disassembly:
jmp 0x140012520
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x778
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0x13a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x798]
mov rax, qword [0x140025018]
xor rax, rbp
mov qword [rbp + 0x718], rax
lea rcx, [0x14002b16f]
call fcn.1400114e2
mov qword [rbp + 8], 0
lea rax, [rbp + 0x30]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rax, [rbp + 0x260]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov dword [rbp + 0x484], 0xffffffff
mov dword [rbp + 0x4a4], 0
mov dword [rbp + 0x4c4], 0
mov rax, qword [rbp + 0x748]
mov qword [rsp + 0x20], rax
lea r9, str.SystemCurrentControlSetServices_ws
mov r8, 0xffffffffffffffff
mov edx, 0x104
lea rcx, [rbp + 0x30]
call fcn.1400114ab
mov rax, qword [rbp + 0x740]
mov qword [rsp + 0x28], rax
lea rax, str.___
mov qword [rsp + 0x20], rax
lea r9, [0x1400203a0]
mov r8, 0xffffffffffffffff
mov edx, 0x104
lea rcx, [rbp + 0x260]
call fcn.1400114ab
lea rax, [rbp + 0x4c4]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x30]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [rbp + 0x484], eax
cmp dword [rbp + 0x484], 0
je 0x140012683
mov edx, dword [rbp + 0x484]
lea rcx, str.SetRegistryValues.RegCreateKeyExA:__d_n
call fcn.140011221
xor eax, eax
jmp 0x1400127e8
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x4a4]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Type
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rbp + 0x484], eax
cmp dword [rbp + 0x484], 0
je 0x1400126d9
mov edx, dword [rbp + 0x484]
lea rcx, str.SetRegistryValues.RegSetValueEx.Type:__d_n
call fcn.140011221
xor eax, eax
jmp 0x1400127e8
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x4a4]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.ErrorControl
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rbp + 0x484], eax
cmp dword [rbp + 0x484], 0
je 0x14001272f
mov edx, dword [rbp + 0x484]
lea rcx, str.SetRegistryValues.RegSetValueEx.ErrorControl:__d_n
call fcn.140011221
xor eax, eax
jmp 0x1400127e8
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x4a4]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Start
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rbp + 0x484], eax
cmp dword [rbp + 0x484], 0
je 0x140012782
mov edx, dword [rbp + 0x484]
lea rcx, str.SetRegistryValues.RegSetValueEx.Start:__d_n
call fcn.140011221
xor eax, eax
jmp 0x1400127e8
lea rcx, [rbp + 0x260]
call qword [sym.imp.ucrtbased.dll_wcslen]
lea rax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x260]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.ImagePath
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rbp + 0x484], eax
cmp dword [rbp + 0x484], 0
je 0x1400127e3
mov edx, dword [rbp + 0x484]
lea rcx, str.SetRegistryValues.RegSetValueEx.ImagePath:__d_n
call fcn.140011221
xor eax, eax
jmp 0x1400127e8
mov eax, 1
mov rdi, rax
lea rcx, [rbp - 0x50]
lea rdx, [0x140020170]
call fcn.140011433
mov rax, rdi
mov rcx, qword [rbp + 0x718]
xor rcx, rbp
call fcn.140011244
lea rsp, [rbp + 0x728]
pop rdi
pop rbp
ret