Function at 0x1401d48f0
Capabilities:
Persist via windows service
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xf0
mov rax, qword [0x1405ca2b0]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov rbx, rcx
lea rcx, [rbp - 0x49]
call fcn.1401d09c0
nop
lea rcx, str.SYSTEMCurrentControlSetServices_
call fcn.140060cd0
mov rcx, rax
call fcn.140041c30
mov rdi, rax
lea rcx, [rbp - 0x49]
call fcn.140046ee0
mov rsi, rax
lea rcx, [rbp - 0x49]
call fcn.14005f5f0
sub rax, rsi
cmp rax, rdi
jb 0x1401d4c55
lea rcx, [rbp - 0x49]
call fcn.14005f680
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, str.SYSTEMCurrentControlSetServices_
lea r8, [rbp - 0x49]
lea rcx, [rbp + 0x27]
call fcn.1401d32d0
nop
lea rcx, [0x1405aa018]
call fcn.140060cd0
mov rcx, rax
call fcn.140041c30
mov rdi, rax
mov rcx, rbx
call fcn.140046ee0
mov rsi, rax
mov rcx, rbx
call fcn.14005f5f0
sub rax, rsi
cmp rax, rdi
jb 0x1401d4c5b
mov rcx, rbx
call fcn.14005f680
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [0x1405aa018]
mov r8, rbx
lea rcx, [rbp - 0x19]
call fcn.1401d32d0
nop
lea rcx, [rbp + 0x27]
call fcn.14005f680
mov rdx, rax
lea r8, [rbp - 0x59]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x1401d4a17
lea rdx, str.____Cant_create_service_key
jmp 0x1401d4a65
lea rcx, [rbp - 0x19]
call fcn.140046ee0
mov rbx, rax
add ebx, ebx
lea rcx, [rbp - 0x19]
call fcn.14005f680
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
mov r9d, 2
lea r8, str.ImagePath
xor edx, edx
mov rcx, qword [rbp - 0x59]
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov rcx, qword [rbp - 0x59]
test eax, eax
je 0x1401d4ac8
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.____Cant_create_ImagePath_registry_value
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1401d2d30
mov rcx, rax
lea rdx, [0x1401d1f70]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor bl, bl
lea rcx, [rbp - 0x19]
call fcn.14005f8a0
nop
lea rcx, [rbp + 0x27]
call fcn.14005f8a0
nop
lea rcx, [rbp - 0x49]
call fcn.14005f8a0
movzx eax, bl
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140261670
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
mov dword [rsp + 0x28], 4
lea rax, reloc.WS2_32.dll_accept
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, str.Type
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov rcx, qword [rbp - 0x59]
test eax, eax
je 0x1401d4b0b
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.____Cant_create_Type_registry_value
jmp 0x1401d4a65
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [0x1405a97c0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdi, rax
test rax, rax
je 0x1401d4a81
lea rdx, [0x1405a9ff0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rdx, str.NtLoadDriver
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
lea r9, [rbp - 0x51]
xor r8d, r8d
mov dl, 1
lea ecx, [r8 + 0xa]
call rbx
test eax, eax
jns 0x1401d4b6f
lea rdx, str.Fatal_error:_failed_to_acquire_SE_LOAD_DRIVER_PRIVILEGE._Make_sure_you_are_running_as_administrator.
jmp 0x1401d4a65
lea rcx, str.RegistryMachineSystemCurrentControlSetServices_
call fcn.140060cd0
mov rcx, rax
call fcn.140041c30
mov rbx, rax
lea rcx, [rbp - 0x49]
call fcn.140046ee0
mov rdi, rax
lea rcx, [rbp - 0x49]
call fcn.14005f5f0
sub rax, rdi
cmp rax, rbx
jb 0x1401d4c4f
lea rcx, [rbp - 0x49]
call fcn.14005f680
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, str.RegistryMachineSystemCurrentControlSetServices_
lea r8, [rbp - 0x49]
lea rcx, [rbp + 7]
call fcn.1401d32d0
nop
lea rcx, [rbp + 7]
call fcn.14005f680
mov rdx, rax
lea rcx, [rbp - 0x29]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rcx, [rbp - 0x29]
call rsi
mov ebx, eax
lea rdx, str.___NtLoadDriver_Status_0x
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1401d2d30
mov rcx, rax
lea rdx, [0x140110bc0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___long_int____ptr64]
mov rcx, rax
lea rdx, [0x1401d1f70]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
cmp ebx, 0xc000010e
jne 0x1401d4c3c
mov bl, 1
jmp 0x1401d4c41
test ebx, ebx
setns bl
lea rcx, [rbp + 7]
call fcn.14005f8a0
jmp 0x1401d4a83
call fcn.140006020
nop
call fcn.140006020
nop
call fcn.140006020
int3