Function at 0x14000fc80
Capabilities:
Persist via windows service
Set registry value

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x478
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0xb2
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x498]
mov rax, qword [0x140025040]
xor rax, rbp
mov qword [rbp + 0x438], rax
lea rcx, [0x14002949e]
call fcn.140015f10
mov dword [rbp + 4], 1
lea rdx, str.SYSTEMCurrentControlSetServicescapcom
lea rcx, [rbp + 0x28]
call fcn.1400040e0
nop
lea rdx, str.___
lea rcx, [rbp + 0x68]
call fcn.1400040e0
nop
mov rcx, qword [rbp + 0x460]
call fcn.140009390
mov rdx, rax
lea rcx, [rbp + 0x68]
call fcn.14000fc30
lea rcx, [rbp + 0x28]
call fcn.140009350
lea r8, [rbp + 0xa8]
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x14000fd68
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____RegCreateKey_error__d_n
call fcn.14000aa40
mov byte [rbp + 0x354], 0
lea rcx, [rbp + 0x68]
call fcn.1400051c0
nop
lea rcx, [rbp + 0x28]
call fcn.1400051c0
movzx eax, byte [rbp + 0x354]
jmp 0x140010075
lea rcx, [rbp + 0x68]
call fcn.14000a810
shl rax, 1
mov dword [rbp + 0x424], eax
lea rcx, [rbp + 0x68]
call fcn.140009350
mov qword [rbp + 0x428], rax
mov rax, qword [rbp + 0xa8]
mov qword [rbp + 0x430], rax
mov eax, dword [rbp + 0x424]
mov dword [rsp + 0x28], eax
mov rax, qword [rbp + 0x428]
mov qword [rsp + 0x20], rax
mov r9d, 2
lea r8, str.ImagePath
xor edx, edx
mov rcx, qword [rbp + 0x430]
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
test eax, eax
je 0x14000fe15
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____RegSetKeyValue_error__d_n
call fcn.14000aa40
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [rbp + 0x374], 0
lea rcx, [rbp + 0x68]
call fcn.1400051c0
nop
lea rcx, [rbp + 0x28]
call fcn.1400051c0
movzx eax, byte [rbp + 0x374]
jmp 0x140010075
mov dword [rsp + 0x28], 4
lea rax, [rbp + 4]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, str.Type
xor edx, edx
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
test eax, eax
je 0x14000fe8d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____RegSetKeyValue_error__d_n
call fcn.14000aa40
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [rbp + 0x394], 0
lea rcx, [rbp + 0x68]
call fcn.1400051c0
nop
lea rcx, [rbp + 0x28]
call fcn.1400051c0
movzx eax, byte [rbp + 0x394]
jmp 0x140010075
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [0x14001f080]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rbp + 0xc8], rax
cmp qword [rbp + 0xc8], 0
jne 0x14000fef2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____GetModuleHandle_error__d_n
call fcn.14000aa40
mov byte [rbp + 0x3b4], 0
lea rcx, [rbp + 0x68]
call fcn.1400051c0
nop
lea rcx, [rbp + 0x28]
call fcn.1400051c0
movzx eax, byte [rbp + 0x3b4]
jmp 0x140010075
lea rdx, str.RtlAdjustPrivilege
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x108], rax
lea rdx, str.NtLoadDriver
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x108]
mov qword [rbp + 0x428], rax
lea r9, [rbp + 0x144]
xor r8d, r8d
mov dl, 1
mov ecx, 0xa
call qword [rbp + 0x428]
mov dword [rbp + 0xe4], eax
cmp dword [rbp + 0xe4], 0
jge 0x14000ff94
mov edx, dword [rbp + 0xe4]
lea rcx, str.____RtlAdjustPrivilege_error_0x_X__run_file_as_administrator__n
call fcn.14000aa40
mov byte [rbp + 0x3d4], 0
lea rcx, [rbp + 0x68]
call fcn.1400051c0
nop
lea rcx, [rbp + 0x28]
call fcn.1400051c0
movzx eax, byte [rbp + 0x3d4]
jmp 0x140010075
lea rdx, str.RegistryMachineSystemCurrentControlSetServicescapcom
lea rcx, [rbp + 0x168]
call fcn.1400040e0
nop
lea rcx, [rbp + 0x168]
call fcn.140009350
mov rdx, rax
lea rcx, [rbp + 0x1a8]
call sub.ntdll.dll_RtlInitUnicodeString
mov rax, qword [rbp + 0x128]
mov qword [rbp + 0x428], rax
lea rcx, [rbp + 0x1a8]
call qword [rbp + 0x428]
mov dword [rbp + 0xe4], eax
cmp dword [rbp + 0xe4], 0
jge 0x140010047
cmp dword [rbp + 0xe4], 0xc000010e
je 0x14001003b
mov edx, dword [rbp + 0xe4]
lea rcx, str.____NtLoadDriver_error_0x_X_n
call fcn.14000aa40
mov byte [rbp + 0x3f4], 0
lea rcx, [rbp + 0x168]
call fcn.1400051c0
nop
lea rcx, [rbp + 0x68]
call fcn.1400051c0
nop
lea rcx, [rbp + 0x28]
call fcn.1400051c0
movzx eax, byte [rbp + 0x3f4]
jmp 0x140010075
lea rcx, str.____capcom.sys_already_loaded._n
call fcn.14000aa40
mov byte [rbp + 0x414], 1
lea rcx, [rbp + 0x168]
call fcn.1400051c0
nop
lea rcx, [rbp + 0x68]
call fcn.1400051c0
nop
lea rcx, [rbp + 0x28]
call fcn.1400051c0
movzx eax, byte [rbp + 0x414]
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x14001ee40]
call fcn.140015e80
mov rax, rdi
mov rcx, qword [rbp + 0x438]
xor rcx, rbp
call fcn.140016150
lea rsp, [rbp + 0x448]
pop rdi
pop rbp
ret