Function at 0x140019960
Capabilities:
Create thread
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
jmp 0x140019960
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x70
xor esi, esi
lea rcx, str..IBMPmDrv
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], esi
mov edx, 0xc0000000
mov dword [rbp + 0x38], esi
lea r8d, [rsi + 3]
mov dword [rbp + 0x20], esi
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140019fb7
mov qword [rsp + 0x38], rsi
lea rax, [rbp - 0x20]
mov qword [rsp + 0x30], rax
lea r9d, [rsi + 4]
lea rax, [rbp + 0x20]
mov dword [rsp + 0x28], 4
lea r8, [rbp + 0x38]
mov qword [rsp + 0x20], rax
mov edx, 0x222434
mov qword [rsp + 0x68], rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov ebx, dword [rbp + 0x20]
test eax, eax
je 0x140019f2c
cmp ebx, 0x100
jb 0x140019f2c
cmp ebx, 0x200
jne 0x140019a0c
mov dword [rbp + 0x38], 1
jmp 0x140019a1b
cmp ebx, 0x100
jne 0x140019b94
mov dword [rbp + 0x38], esi
mov qword [rsp + 0x38], rsi
lea rax, [rbp - 0x20]
mov qword [rsp + 0x30], rax
lea r8, [rbp + 0x38]
lea rax, [rbp + 0x20]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
mov edx, 0x222438
mov dword [rbp + 0x20], esi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov qword [rsp + 0x40], rsi
lea rax, [rbp - 0x18]
mov qword [rsp + 0x38], rax
lea rdx, str.SYSTEMCurrentControlSetServicesIBMPMSVCParametersCapability
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x140019b94
mov rcx, qword [rbp - 0x18]
lea rax, [rbp + 0x20]
mov dword [rsp + 0x28], 4
mov r9d, 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
mov dword [rbp + 0x28], 4
mov dword [rbp + 0x30], 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp - 0x18]
lea rax, [rbp + 0x20]
mov dword [rsp + 0x28], 4
lea rdx, str.IsExistPMInternalFunction
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp + 0x20], 0x804
mov dword [rbp + 0x30], 4
mov dword [rbp + 0x28], 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp - 0x18]
lea rax, [rbp + 0x20]
mov dword [rsp + 0x28], 4
lea rdx, str.OverrideCapability
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp + 0x28], 4
mov dword [rbp + 0x30], 4
mov dword [rbp + 0x20], 0x804
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp - 0x18]
lea rax, [rbp + 0x20]
mov dword [rsp + 0x28], 4
lea rdx, str.Type2
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp + 0x28], 4
mov dword [rbp + 0x30], 4
mov dword [rbp + 0x20], 0x7fffffff
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rsi
lea rax, [rbp - 0x18]
mov qword [rsp + 0x38], rax
lea rdx, str.SYSTEMCurrentControlSetServicesIBMPMSVCParametersInterfaceVersion
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x140019c24
mov rcx, qword [rbp - 0x18]
lea r9d, [rax + 4]
xor r8d, r8d
mov dword [rbp + 0x28], 4
xor edx, edx
mov dword [rbp + 0x30], 4
mov dword [rsp + 0x28], 4
cmp ebx, 0x100
je 0x140019c04
lea eax, [rbx + 1]
mov dword [rbp + 0x20], eax
jmp 0x140019c0b
mov dword [rbp + 0x20], 0x102
lea rax, [rbp + 0x20]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, 0x200
jne 0x140019c38
mov dword [rbp + 0x38], 1
mov dword [rbp + 0x20], esi
jmp 0x140019c44
cmp ebx, 0x100
jne 0x140019e54
mov qword [rsp + 0x38], rsi
lea rax, [rbp - 0x20]
mov qword [rsp + 0x30], rax
lea r8, [rbp + 0x38]
lea rax, [rbp + 0x20]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
mov edx, 0x22243c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov eax, dword [rbp + 0x20]
lea rdx, str.SYSTEMCurrentControlSetServicesIBMPMSVCParametersCurrentSetting
mov qword [rsp + 0x40], rsi
xor r9d, r9d
mov dword [0x1400b878c], eax
xor r8d, r8d
lea rax, [0x1400b84d0]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov eax, dword [rbp + 0x30]
xor r8d, r8d
mov r9d, dword [rbp + 0x28]
xor edx, edx
mov rcx, qword [0x1400b84d0]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x20]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov qword [rsp + 0x40], rsi
lea rax, [0x1400b84d8]
mov qword [rsp + 0x38], rax
lea rdx, str.SYSTEMCurrentControlSetServicesIBMPMSVCParametersOverrideSetting
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov rcx, qword [0x1400b84d8]
test rcx, rcx
je 0x140019d9d
lea rax, [rbp + 0x30]
mov dword [rbp + 0x28], 4
mov qword [rsp + 0x28], rax
lea rbx, [0x1400b8798]
lea r9, [rbp + 0x28]
mov qword [rsp + 0x20], rbx
xor r8d, r8d
mov dword [rbp + 0x30], 4
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x140019d9d
mov rcx, qword [0x1400b84d8]
mov r9d, 4
mov dword [rsp + 0x28], 4
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rbx
mov dword [0x1400b8798], esi
mov dword [rbp + 0x28], 4
mov dword [rbp + 0x30], 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov qword [rsp + 0x40], rsi
lea rax, [rbp - 0x18]
mov qword [rsp + 0x38], rax
lea rdx, str.SYSTEMCurrentControlSetServicesIBMPMSVCParametersNotification
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x140019e54
mov rcx, qword [rbp - 0x18]
lea rax, [rbp + 0x20]
mov dword [rsp + 0x28], 4
mov r9d, 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
mov dword [rbp + 0x28], 4
mov dword [rbp + 0x30], 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp - 0x18]
lea rax, [rbp + 0x20]
mov dword [rsp + 0x28], 4
lea rdx, str.Type2
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp + 0x28], 4
mov dword [rbp + 0x30], 4
mov dword [rbp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, str.PHThread
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov rcx, qword [0x1400b84d0]
xor edx, edx
mov r9, rax
mov qword [0x1400b87b8], rax
mov dword [rsp + 0x20], 1
lea r8d, [rdx + 4]
call qword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
lea rax, [rbp - 0x1c]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea r8, [0x140001f4b]
xor edx, edx
mov dword [rsp + 0x20], esi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea r9, str.PHOverrideThread
xor r8d, r8d
xor edx, edx
mov qword [0x1400b87a8], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov rcx, qword [0x1400b84d8]
xor edx, edx
mov r9, rax
mov qword [0x1400b87c0], rax
mov dword [rsp + 0x20], 1
lea r8d, [rdx + 4]
call qword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
lea rax, [rbp - 0x1c]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea r8, [0x1400045a2]
xor edx, edx
mov dword [rsp + 0x20], esi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, qword [rsp + 0x68]
mov qword [0x1400b87b0], rax
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
mov qword [rsp + 0x40], rsi
lea rax, [rbp - 0x18]
mov qword [rsp + 0x38], rax
lea rdx, str.SYSTEMCurrentControlSetServicesIBMPMSVCParametersCapability
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], esi
mov dword [0x1400b878c], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov eax, dword [0x1400b878c]
mov r9d, 4
mov rcx, qword [rbp - 0x18]
xor r8d, r8d
mov dword [rbp + 0x20], eax
xor edx, edx
lea rax, [rbp + 0x20]
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
mov dword [rbp + 0x28], 4
mov dword [rbp + 0x30], 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x68]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret