Function at 0x1000b990
Capabilities:
Copy file
Create process on windows
Persist via windows service
Print debug messages
Set registry value

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10080ac9
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x288
mov eax, dword [0x100a1040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x100a4110], 0
jne 0x1000ba16
push 8
call fcn.10053c2b
mov esi, eax
add esp, 4
mov dword [ebp - 0x278], esi
mov dword [ebp - 4], 1
mov ecx, esi
mov dword [esi], vtable.CPDFExDriver.0
mov dword [esi + 4], 0
call fcn.10020660
mov dword [ebp - 4], 0xffffffff
mov dword [0x100a4110], esi
call fcn.10031c00
cmp dword [0x100a40c4], 0x800
jge 0x1000ba31
mov eax, 0x80004005
jmp 0x1000bf1a
push 0x208
lea eax, [ebp - 0x220]
push 0
push eax
call fcn.10055b90
lea eax, [edi + 0x124]
add esp, 0xc
cmp dword [eax + 0x14], 7
jbe 0x1000ba55
mov eax, dword [eax]
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
push eax
lea eax, [ebp - 0x220]
push 0x10092f90
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0x220]
push str.data_
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x258]
call fcn.1000c060
lea eax, [ebp - 0x258]
mov dword [ebp - 4], 2
push eax
lea ecx, [ebp - 0x240]
call fcn.1000c140
mov byte [ebp - 4], 3
call fcn.10031c00
cmp dword [0x100a40c8], 0
mov ecx, str.IShowDrv.sys
mov eax, str.IShowDrv64.sys
cmove eax, ecx
lea ecx, [ebp - 0x270]
push eax
call fcn.1000c060
mov byte [ebp - 4], 4
lea eax, [ebp - 0x220]
cmp dword [ebp - 0x25c], 7
lea esi, [ebp - 0x270]
push 0x208
cmova esi, dword [ebp - 0x270]
push 0
push eax
call fcn.10055b90
add esp, 0xc
lea eax, [ebp - 0x258]
cmp dword [ebp - 0x244], 7
cmova eax, dword [ebp - 0x258]
push eax
lea eax, [ebp - 0x220]
push 0x10092f90
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0x220]
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push eax
call esi
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x298]
call fcn.1000c060
mov ecx, dword [ebp - 0x244]
cmp ecx, 7
jbe 0x1000bb89
mov edx, dword [ebp - 0x258]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1000bb7f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000bf3a
push ecx
push edx
call fcn.10053bf1
add esp, 8
movups xmm0, xmmword [ebp - 0x298]
push 0x208
lea eax, [ebp - 0x220]
movups xmmword [ebp - 0x258], xmm0
push 0
movq xmm0, qword [ebp - 0x288]
push eax
movq qword [ebp - 0x248], xmm0
call fcn.10055b90
add esp, 0xc
lea eax, [ebp - 0x240]
cmp dword [ebp - 0x22c], 7
cmova eax, dword [ebp - 0x240]
push eax
lea eax, [ebp - 0x220]
push 0x10092f90
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0x220]
push str.ExtensionProtectIM.sys
push eax
call esi
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x298]
call fcn.1000c060
mov ecx, dword [ebp - 0x22c]
cmp ecx, 7
jbe 0x1000bc43
mov edx, dword [ebp - 0x240]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1000bc39
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000bf3a
push ecx
push edx
call fcn.10053bf1
add esp, 8
movups xmm1, xmmword [ebp - 0x298]
lea ecx, [ebp - 0x240]
movq xmm0, qword [ebp - 0x288]
movd eax, xmm1
movq qword [ebp - 0x230], xmm0
cmp dword [ebp - 0x22c], 7
push 0
cmova ecx, eax
lea eax, [ebp - 0x258]
cmp dword [ebp - 0x244], 7
push ecx
cmova eax, dword [ebp - 0x258]
push eax
movups xmmword [ebp - 0x240], xmm1
call dword [sym.imp.KERNEL32.dll_CopyFileW]
cmp dword [ebp - 0x22c], 7
lea eax, [ebp - 0x240]
cmova eax, dword [ebp - 0x240]
sub esp, 0xc
push eax
push ecx
call fcn.1000b900
add esp, 0x14
mov dword [ebp - 0x274], 0
mov esi, eax
lea eax, [ebp - 0x274]
push eax
push 0xf003f
push 0
push str.SYSTEMControlSet001ServicesExtensionProtectIM
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000bd16
push 4
lea eax, [ebp - 0x224]
mov dword [ebp - 0x224], 2
push eax
push 4
push 0
push str.Start
push dword [ebp - 0x274]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x274]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x1000befe
call fcn.1000b750
cmp dword [ebx + 8], 0
mov esi, eax
mov dword [ebp - 0x224], esi
je 0x1000be10
mov esi, dword [0x100a4098]
mov dword [ebp - 0x228], 0
test esi, esi
je 0x1000bd53
lock inc dword [esi + 4]
mov esi, dword [0x100a4098]
mov ecx, dword [0x100a4094]
mov dword [ebp - 0x280], ecx
mov dword [ebp - 0x27c], esi
mov byte [ebp - 4], 5
lea edx, [ebp - 0x278]
mov eax, dword [ecx]
push edx
mov eax, dword [eax + 0x44]
call eax
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x228]
mov edx, dword [eax]
call fcn.10031080
mov byte [ebp - 4], 5
or edi, 0xffffffff
mov edx, dword [ebp - 0x278]
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1000bdac
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 4
test esi, esi
je 0x1000bdd3
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x1000bdd3
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
mov eax, edi
lock xadd dword [esi + 8], eax
jne 0x1000bdd3
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
push 1
push 0
push str._enable_im_protecttrue
push dword [ebp - 0x228]
push str.runas
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov edx, dword [ebp - 0x228]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x1000be0a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x224]
mov ecx, dword [ebp - 0x25c]
cmp ecx, 7
jbe 0x1000be50
mov edx, dword [ebp - 0x270]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1000be46
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000bf3a
push ecx
push edx
call fcn.10053bf1
add esp, 8
mov ecx, dword [ebp - 0x22c]
xor eax, eax
mov dword [ebp - 0x260], 0
mov dword [ebp - 0x25c], 7
mov word [ebp - 0x270], ax
cmp ecx, 7
jbe 0x1000bead
mov edx, dword [ebp - 0x240]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1000bea3
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000bf3a
push ecx
push edx
call fcn.10053bf1
add esp, 8
mov ecx, dword [ebp - 0x244]
xor eax, eax
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x22c], 7
mov word [ebp - 0x240], ax
cmp ecx, 7
jbe 0x1000bf18
mov edx, dword [ebp - 0x258]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1000bf0e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000bf3a
jmp 0x1000bf0e
push str.Install_ProDriver_Fail
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x1000be10
push ecx
push edx
call fcn.10053bf1
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100535a4
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
call fcn.10058b57
int3