Function at 0x1400102f0
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x37]
sub rsp, 0xc0
mov rax, qword [0x1401d3b98]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
mov qword [rbp - 0x31], rcx
mov qword [rbp - 0x29], rdx
mov qword [rbp - 0x21], r8
mov r8, rdx
lea rdx, str.SYSTEMCurrentControlSetServices_
lea rcx, [rbp + 7]
call fcn.1400209f0
nop
mov r8, rbx
lea rdx, str.___
lea rcx, [rbp - 0x19]
call fcn.1400209f0
mov dword [rbp + 0x27], 2
lea rdx, [rbp + 7]
cmp qword [rbp + 0x1f], 0x10
cmovae rdx, qword [rbp + 7]
lea rax, [rbp + 0x27]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x39]
mov qword [rsp + 0x38], rax
xor r14d, r14d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x14001050d
mov rdx, qword [rbp - 1]
cmp rdx, 0x10
jb 0x1400103df
inc rdx
mov rcx, qword [rbp - 0x19]
cmp rdx, 0x1000
mov rax, rcx
jb 0x1400103da
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001095b
call fcn.14010fe30
mov byte [rbp - 0x19], r14b
mov qword [rbp - 1], reloc.WS2_32.dll_ntohs
mov qword [rbp - 9], r14
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0x10
jb 0x14001042a
inc rdx
mov rcx, qword [rbp + 7]
cmp rdx, 0x1000
mov rax, rcx
jb 0x140010425
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010961
call fcn.14010fe30
mov byte [rbp + 7], 0
mov qword [rbp + 0x1f], reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x17], r14
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x140010474
inc rdx
cmp rdx, 0x1000
mov rcx, qword [rbx]
jb 0x14001046f
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140010967
mov rcx, r8
call fcn.14010fe30
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rdx, qword [rsi + 0x18]
cmp rdx, 0x10
jb 0x1400104bd
inc rdx
mov rcx, qword [rsi]
cmp rdx, 0x1000
jb 0x1400104b8
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14001094f
mov rcx, r8
call fcn.14010fe30
mov qword [rsi + 0x10], r14
mov qword [rsi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rsi], 0
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x140010506
inc rdx
cmp rdx, 0x1000
mov rcx, qword [rdi]
jb 0x140010501
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140010955
mov rcx, r8
call fcn.14010fe30
xor al, al
jmp 0x140010926
lea rcx, [rbp - 0x19]
cmp qword [rbp - 1], 0x10
cmovae rcx, qword [rbp - 0x19]
mov eax, dword [rbp - 9]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 2
lea r8, str.ImagePath
xor edx, edx
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueA]
mov rcx, qword [rbp - 0x39]
test eax, eax
je 0x140010553
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400103a4
mov dword [rsp + 0x28], 4
lea rax, [0x1401bae60]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, str.Type
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueA]
mov rcx, qword [rbp - 0x39]
test eax, eax
je 0x14001058f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400103a4
mov dword [rsp + 0x28], 4
lea rax, [0x1401ba82c]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, str.Start
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueA]
test eax, eax
je 0x1400105cb
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400103a4
mov ecx, dword [rdi + 0x10]
mov rax, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x1400105db
mov rax, qword [rdi]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rax
mov r9d, 1
lea r8, str.DisplayName
xor edx, edx
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueA]
mov rcx, qword [rbp - 0x39]
test eax, eax
jne 0x14001066b
mov dword [rsp + 0x28], 4
lea rax, [0x1401bae60]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, str.ErrorControl
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueA]
mov rcx, qword [rbp - 0x39]
test eax, eax
jne 0x14001066b
mov dword [rsp + 0x28], 4
lea rax, [0x1401baa68]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [0x1401ba3a8]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueA]
test eax, eax
je 0x1400107ca
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbp - 1]
cmp rdx, 0x10
jb 0x1400106ac
mov rcx, qword [rbp - 0x19]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400106a7
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001095b
call fcn.14010fe30
mov qword [rbp - 9], r14
mov qword [rbp - 1], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x19], r14b
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0x10
jb 0x1400106f7
mov rcx, qword [rbp + 7]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400106f2
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010961
call fcn.14010fe30
mov qword [rbp + 0x17], r14
mov qword [rbp + 0x1f], reloc.WS2_32.dll_ntohs
mov byte [rbp + 7], 0
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x140010741
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x14001073c
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140010967
mov rcx, r8
call fcn.14010fe30
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rdx, qword [rsi + 0x18]
cmp rdx, 0x10
jb 0x14001078a
inc rdx
mov rcx, qword [rsi]
cmp rdx, 0x1000
jb 0x140010785
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14001094f
mov rcx, r8
call fcn.14010fe30
mov qword [rsi + 0x10], r14
mov qword [rsi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rsi], 0
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x140010506
inc rdx
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x140010501
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
jmp 0x1400104f0
mov rdx, qword [rbp - 1]
cmp rdx, 0x10
jb 0x140010805
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010800
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001095b
call fcn.14010fe30
mov qword [rbp - 9], r14
mov qword [rbp - 1], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x19], r14b
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0x10
jb 0x140010850
inc rdx
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001084b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010961
call fcn.14010fe30
mov qword [rbp + 0x17], r14
mov qword [rbp + 0x1f], reloc.WS2_32.dll_ntohs
mov byte [rbp + 7], 0
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x14001089a
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x140010895
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140010967
mov rcx, r8
call fcn.14010fe30
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rdx, qword [rsi + 0x18]
cmp rdx, 0x10
jb 0x1400108df
mov rcx, qword [rsi]
inc rdx
cmp rdx, 0x1000
jb 0x1400108da
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14001094f
mov rcx, r8
call fcn.14010fe30
mov qword [rsi + 0x10], r14
mov qword [rsi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rsi], 0
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x140010924
inc rdx
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x14001091f
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140010955
mov rcx, r8
call fcn.14010fe30
mov al, 1
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdi], 0
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.14010fe10
add rsp, 0xc0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.14011d47c
nop
call fcn.14011d47c
nop
call fcn.14011d47c
nop
call fcn.14011d47c
nop
call fcn.14011d47c
int3