Function at 0x14002a6b0
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x1f0]
sub rsp, 0x2f0
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [rsp + 0x310], rbx
mov rax, qword [0x1400fb088]
xor rax, rsp
mov qword [rbp + 0x1e0], rax
mov rbx, r8
mov rdi, rdx
cmp qword [r8 + 0x10], 0
je 0x14002a827
mov dword [rbp - 0x78], 1
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x30]
call fcn.14008e5d0
cmp qword [rbx + 0x18], 8
jb 0x14002a718
mov rbx, qword [rbx]
mov r9, rbx
lea r8, [0x1400d9bc8]
mov edx, 0x104
lea rcx, [rbp - 0x30]
call fcn.140018cf8
lea r8, [rbp - 0x80]
lea rdx, str.systemCurrentControlSetServices
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x14002a7d3
mov rdx, rdi
cmp qword [rdi + 0x18], 8
jb 0x14002a75d
mov rdx, qword [rdi]
lea r8, [rsp + 0x78]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x14002a7c9
lea rcx, [rbp - 0x30]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
lea rax, [rax + 1]
cmp word [rcx + rax*2], 0
jne 0x14002a780
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.ImagePath
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x78]
test eax, eax
je 0x14002a7e7
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, qword gs:[0x30]
mov eax, dword [rax + 0x1250]
jmp 0x14002aa2a
mov dword [rsp + 0x28], 4
lea rax, [rbp - 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, [0x1400d9c40]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x78]
test eax, eax
jne 0x14002a7c3
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r8, rdi
lea rdx, str._registrymachineSYSTEMCurrentControlSetServices_
lea rcx, [rbp - 0x60]
call fcn.14001e450
nop
lea rsi, [rbp - 0x60]
cmp qword [rbp - 0x48], 8
cmovae rsi, qword [rbp - 0x60]
mov ecx, 0x20
call fcn.14006fa7c
mov qword [rsp + 0x60], 0x14
mov qword [rsp + 0x68], 0x1f
movups xmm0, xmmword [str.RtlInitUnicodeString]
movups xmmword [rax], xmm0
mov ecx, dword [0x1400d9b50]
mov dword [rax + 0x10], ecx
mov byte [rax + 0x14], 0
mov qword [rsp + 0x50], rax
call fcn.140027c70
mov rbx, rax
call fcn.14004af60
lea rdi, [rbx + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor eax, eax
mov qword [rbp - 0x70], rax
lea r8, [rsp + 0x50]
lea rdx, [rbp - 0x70]
mov rcx, rbx
call fcn.1400294b0
mov r8, qword [rbp - 0x70]
mov rcx, rdi
cmp r8, qword [rbx + 8]
je 0x14002a8d9
mov rbx, qword [r8 + 0x30]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
je 0x14002a8e0
mov rdx, rsi
lea rcx, [rbp - 0x40]
call rbx
jmp 0x14002a8e0
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x14002a91d
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002a918
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002aa4c
call fcn.14006fa74
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0
mov qword [rsp + 0x40], 0xc
mov r8d, 0xc
lea rdx, str.NtLoadDriver
lea rcx, [rsp + 0x30]
call fcn.14008e170
mov byte [rsp + 0x3c], 0
call fcn.140027c70
mov rbx, rax
call fcn.14004af60
lea rdi, [rbx + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor eax, eax
mov qword [rbp - 0x68], rax
lea r8, [rsp + 0x30]
lea rdx, [rbp - 0x68]
mov rcx, rbx
call fcn.1400294b0
mov rdx, qword [rbp - 0x68]
mov rcx, rdi
cmp rdx, qword [rbx + 8]
je 0x14002a9a7
mov rbx, qword [rdx + 0x30]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
je 0x14002a9ad
lea rcx, [rbp - 0x40]
call rbx
mov ebx, eax
jmp 0x14002a9b2
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, 0xc0000138
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x14002a9ec
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002a9e6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002aa4c
call fcn.14006fa74
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x14002aa28
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002aa23
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002aa4c
call fcn.14006fa74
mov eax, ebx
mov rcx, qword [rbp + 0x1e0]
xor rcx, rsp
call fcn.14006fa50
mov rbx, qword [rsp + 0x310]
add rsp, 0x2f0
pop rdi
pop rsi
pop rbp
ret
call fcn.140097f2c
nop
int3