Function at 0x1400411d9
Capabilities:
Persist via windows service
Set registry value

Disassembly:
jmp 0x140048a50
push rbp
push rsi
push rdi
sub rsp, 0x440
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0xa4
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x1400e12c0]
xor rax, rbp
mov qword [rbp + 0x400], rax
lea rcx, [0x1400ef172]
call fcn.140041f9e
lea rax, [rbp + 8]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
lea rdx, str.SystemCurrentControlSet
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140048dc7
lea r8, [rbp + 0x28]
mov rdx, qword [0x1400e3460]
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x140048dc7
mov edx, 1
mov ecx, 0x400
call fcn.140040b2b
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0
jne 0x140048afa
xor eax, eax
jmp 0x140048dd5
lea rcx, [0x1400c9c24]
call fcn.140040568
mov r8, rax
lea rdx, [0x1400c9c24]
mov rcx, qword [rbp + 0x48]
call fcn.140040725
mov rcx, qword [0x1400e2498]
call fcn.140040568
mov qword [rbp + 0x3f8], rax
lea rcx, [0x1400c9c24]
call fcn.140040568
mov rcx, qword [rbp + 0x48]
add rcx, rax
mov rax, rcx
mov rcx, qword [rbp + 0x3f8]
mov r8, rcx
mov rdx, qword [0x1400e2498]
mov rcx, rax
call fcn.140040725
mov rcx, qword [rbp + 0x48]
call fcn.140040568
inc rax
mov dword [rsp + 0x28], eax
mov rax, qword [rbp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
lea rdx, str.ImagePath
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x140048ba5
lea rcx, str.Step1_Error_n
call fcn.14004069e
xor eax, eax
jmp 0x140048dd5
lea rax, [rbp + 0x64]
mov rdi, rax
xor eax, eax
mov ecx, 4
rep stosb byte [rdi], al
mov dword [rbp + 0x64], 1
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x64]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Type
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x140048bfe
lea rcx, str.Step2_Error_n
call fcn.14004069e
xor eax, eax
jmp 0x140048dd5
lea rax, [rbp + 8]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
lea rdx, str.SystemCurrentControlSet_services
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140048c3f
lea r8, [rbp + 0x28]
mov rdx, qword [0x1400e3460]
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
jmp 0x140048c52
lea rcx, str.Step3_Error_n
call fcn.14004069e
xor eax, eax
jmp 0x140048dd5
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jne 0x140048c8d
lea rcx, str.Step4_Error_n
call fcn.14004069e
xor eax, eax
jmp 0x140048dd5
lea rdx, str.RtlInitUnicodeString
mov rcx, qword [rbp + 0x88]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0xa8], rax
lea rdx, str.NtLoadDriver
mov rcx, qword [rbp + 0x88]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0xc8], rax
lea rdx, str.RtlAdjustPrivilege
mov rcx, qword [rbp + 0x88]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0xe8], rax
lea r9, [rbp + 0x104]
xor r8d, r8d
mov edx, 1
mov ecx, 0xa
call qword [rbp + 0xe8]
mov dword [rbp + 0x124], eax
cmp dword [rbp + 0x124], 0
jge 0x140048d1a
lea rcx, str.Step5_Error_n
call fcn.14004069e
xor eax, eax
jmp 0x140048dd5
lea rax, [rbp + 0x180]
lea rcx, str.RegistryMachineSystemCurrentControlSet_
mov rdi, rax
mov rsi, rcx
mov ecx, 0x58
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x1d8]
mov rdi, rax
xor eax, eax
mov ecx, 0x70
rep stosb byte [rdi], al
mov rdx, qword [0x1400e3460]
lea rcx, [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rbp + 0x180]
lea rcx, [rbp + 0x148]
call qword [rbp + 0xa8]
lea rcx, [rbp + 0x148]
call qword [rbp + 0xc8]
mov dword [rbp + 0x264], eax
cmp dword [rbp + 0x264], 0
jl 0x140048d95
mov eax, 1
jmp 0x140048dd5
cmp dword [rbp + 0x264], 0xc0000603
jne 0x140048daf
lea rcx, str.The_drivers_certificate_has_been_revoked__please_wait_for_the_project_to_be_updated.._n
call fcn.14004069e
jmp 0x140048dc1
mov edx, dword [rbp + 0x264]
lea rcx, str.Error_Code:___lx._n
call fcn.14004069e
xor eax, eax
jmp 0x140048dd5
lea rcx, str.Reg_Add_Error__The_program_needs_to_be_run_with_administrator_privileges__n
call fcn.14004069e
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x1400c8710]
call fcn.140041729
mov rax, rdi
mov rcx, qword [rbp + 0x400]
xor rcx, rbp
call fcn.140040720
lea rsp, [rbp + 0x410]
pop rdi
pop rsi
pop rbp
ret