Function at 0x140008bf4
Capabilities:
Access the windows event log
Delete registry value
Persist via windows service
Set registry value

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2c0
mov qword [rsp + 0x98], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
mov r13d, r8d
mov r12, rcx
call fcn.1400096d4
mov r11, qword [r12]
xor r9d, r9d
lea r15d, [r9 + 1]
mov r8d, r15d
lea edx, [r9 + 0x64]
mov rcx, r12
call qword [r11 + 0x40]
mov ebp, eax
xor r14d, r14d
cmp eax, r14d
jge 0x140008c78
mov r8d, eax
lea rdx, str.CServiceModule::RegisterServer:_Failed_to_UpdateRegistryFromResource_0x_x
mov ecx, r15d
call fcn.1400016b0
mov eax, ebp
jmp 0x140009333
mov rdi, r14
mov qword [rsp + 0x80], r14
mov qword [rsp + 0x88], r14
mov qword [rsp + 0x90], r14
mov qword [rsp + 0x58], r14
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
xor r8d, r8d
lea rdx, str.AppID
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
cmp eax, r14d
jne 0x140008cd6
mov ebx, r14d
mov rdi, qword [rsp + 0x58]
mov qword [rsp + 0x80], rdi
cmp ebx, r14d
je 0x140008d11
mov r8d, ebp
lea rdx, str.CServiceModule::RegisterServer:_Failed_to_Open_RegKey_AppID_0x_x
mov ecx, r15d
call fcn.1400016b0
movzx esi, bx
or esi, 0x80070000
cmp ebx, r14d
cmovle esi, ebx
cmp rdi, r14
je 0x140008d0a
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x140009333
mov rsi, r14
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x58], r14
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
xor r8d, r8d
lea rdx, str.FA018B44_5E9F_4875_B127_5085A1B02ABD
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
cmp eax, r14d
jne 0x140008d5f
mov ebx, r14d
mov rsi, qword [rsp + 0x58]
mov qword [rsp + 0x68], rsi
cmp ebx, r14d
je 0x140008da9
mov r8d, ebp
lea rdx, str.CServiceModule::RegisterServer:_Failed_to_Open_RegKey_GUID_0x_x
mov ecx, r15d
call fcn.1400016b0
movzx ebp, bx
or ebp, 0x80070000
cmp ebx, r14d
cmovle ebp, ebx
cmp rsi, r14
je 0x140008d94
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp rdi, r14
je 0x140008da2
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebp
jmp 0x140009333
lea rdx, str.LocalService
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea rbx, str.ehSched
cmp r13d, r14d
je 0x140008ef9
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, r15d
xor r8d, r8d
lea rdx, str.LocalService
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov r13d, eax
cmp eax, r14d
je 0x140008e44
mov r8d, ebp
lea rdx, str.CServiceModule::RegisterServer:_Failed_to_Set_Value_0x_x
mov ecx, r15d
call fcn.1400016b0
movzx ebx, r13w
or ebx, 0x80070000
cmp r13d, r14d
cmovle ebx, r13d
cmp rsi, r14
je 0x140008e2f
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp rdi, r14
je 0x140008e3d
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x140009333
lea rbx, str._Service
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, r15d
xor r8d, r8d
lea rdx, str.ServiceParameters
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov r13d, eax
cmp eax, r14d
je 0x140008ec6
mov r8d, ebp
lea rdx, str.CServiceModule::RegisterServer:_Failed_to_Set_Value_0x_x
mov ecx, r15d
call fcn.1400016b0
movzx ebx, r13w
or ebx, 0x80070000
cmp r13d, r14d
cmovle ebx, r13d
cmp rsi, r14
je 0x140008eb1
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp rdi, r14
je 0x140008ebf
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x140009333
mov rcx, r12
call fcn.1400093e0
mov ebx, eax
cmp eax, r14d
jge 0x140008ef9
cmp rsi, r14
je 0x140008ee4
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp rdi, r14
je 0x140008ef2
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x140009333
mov rbp, qword [r12 + 0x48]
cmp rbp, r14
je 0x140008f3d
cmp qword [rbp], r14
je 0x140008f3d
mov ecx, r15d
call qword [rbp + 8]
mov ebx, eax
cmp eax, r14d
jl 0x140008fb2
call qword [rbp + 0x38]
mov rdx, rax
mov r8d, r15d
mov rcx, qword [rbp]
call fcn.14000c440
mov ebx, eax
cmp eax, r14d
jl 0x140008fb2
add rbp, 0x48
cmp qword [rbp], r14
jne 0x140008f09
mov ebx, r14d
mov rbp, qword [0x14001d2d0]
mov rax, qword [0x14001d2d8]
cmp rbp, rax
jae 0x140008f96
mov r12, qword [rbp]
cmp r12, r14
je 0x140008f8d
mov ecx, r15d
call qword [r12 + 8]
mov ebx, eax
cmp eax, r14d
jl 0x140008f96
call qword [r12 + 0x38]
mov rdx, rax
mov r8d, r15d
mov rcx, qword [r12]
call fcn.14000c440
mov ebx, eax
cmp eax, r14d
jl 0x140008f96
mov rax, qword [0x14001d2d8]
add rbp, 8
cmp rbp, rax
jb 0x140008f53
cmp ebx, r14d
jl 0x140008fb2
mov rax, qword [0x14001e0a8]
cmp rax, r14
je 0x140008fb2
mov rcx, qword [0x14001d218]
call rax
mov ebx, eax
cmp ebx, r14d
jge 0x140008fee
mov r8d, ebx
lea rdx, str.CServiceModule::RegisterServer:_Failed_to_RegisterServer_0x_x
mov ecx, r15d
call fcn.1400016b0
nop
cmp rsi, r14
je 0x140008fd9
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp rdi, r14
je 0x140008fe7
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x140009333
mov qword [rsp + 0x40], r14
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetServicesEventLogMedia_CenterehSched
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, r14d
je 0x140009086
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r8d, ebx
lea rdx, str.CServiceModule::RegisterServer:_Failed_to_Create_Key_0x_x
mov ecx, r15d
call fcn.1400016b0
movzx ebp, bx
or ebp, 0x80070000
cmp ebx, r14d
cmovle ebp, ebx
cmp rsi, r14
je 0x140009071
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp rdi, r14
je 0x14000907f
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebp
jmp 0x140009333
mov r8d, 0x104
lea rdx, [rsp + 0xa0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, r14d
jne 0x1400090f9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r8d, ebx
lea rdx, str.CServiceModule::RegisterServer:_Failed_to_GetModuleFileName_0x_x
mov ecx, r15d
call fcn.1400016b0
movzx ebp, bx
or ebp, 0x80070000
cmp ebx, r14d
cmovle ebp, ebx
cmp rsi, r14
je 0x1400090e4
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp rdi, r14
je 0x1400090f2
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebp
jmp 0x140009333
add eax, eax
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
lea rdx, str.EventMessageFile
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, r14d
je 0x140009184
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r8d, ebx
lea rdx, str.CServiceModule::RegisterServer:_Failed_to_Set_Value_0x_x
mov ecx, r15d
call fcn.1400016b0
movzx ebp, bx
or ebp, 0x80070000
cmp ebx, r14d
cmovle ebp, ebx
cmp rsi, r14
je 0x14000916f
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp rdi, r14
je 0x14000917d
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebp
jmp 0x140009333
mov dword [rsp + 0x60], 7
mov r12d, 4
mov dword [rsp + 0x28], r12d
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, r12d
xor r8d, r8d
lea rdx, str.TypesSupported
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, r14d
je 0x140009216
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r8d, ebx
lea rdx, str.CServiceModule::RegisterServer:_Failed_to_Set_Value_0x_x
mov ecx, r15d
call fcn.1400016b0
movzx ebp, bx
or ebp, 0x80070000
cmp ebx, r14d
cmovle ebp, ebx
cmp rsi, r14
je 0x140009201
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp rdi, r14
je 0x14000920f
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebp
jmp 0x140009333
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.ehSched
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov rbp, rax
cmp rax, r14
jne 0x140009285
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov r8d, eax
lea rdx, str.CServiceModule::RegisterServer:_Failed_to_RegisterEventSource_0x_x
mov ecx, r15d
call fcn.1400016b0
movzx ebp, bx
or ebp, 0x80070000
cmp ebx, r14d
cmovle ebp, ebx
cmp rsi, r14
je 0x140009270
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp rdi, r14
je 0x14000927e
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebp
jmp 0x140009333
xor r8d, r8d
mov edx, r12d
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], r14d
mov word [rsp + 0x28], r14w
mov qword [rsp + 0x20], r14
lea r9d, [r8 + 3]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
cmp eax, r14d
jne 0x140009314
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 0x5de
je 0x140009311
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov r8d, ebx
lea rdx, str.CServiceModule::RegisterServer:_Failed_to_ReportEvent_0x_x
mov ecx, r15d
call fcn.1400016b0
movzx ebp, bx
or ebp, 0x80070000
cmp ebx, r14d
cmovle ebp, ebx
cmp rsi, r14
je 0x1400092ff
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp rdi, r14
je 0x14000930d
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebp
jmp 0x140009333
mov ebx, r14d
cmp rsi, r14
je 0x140009323
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp rdi, r14
je 0x140009331
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.140001710
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret