Function at 0x1400401ac
Capabilities:
Persist via windows service
Set registry value

Disassembly:
jmp 0x140047560
push rbp
push rsi
push rdi
sub rsp, 0x440
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0xa4
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x1400de2c0]
xor rax, rbp
mov qword [rbp + 0x400], rax
lea rcx, [0x1400ec0a7]
call fcn.140040f62
nop
lea rax, [rbp + 8]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
lea rdx, str.SystemCurrentControlSet
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400478e5
lea r8, [rbp + 0x28]
mov rdx, qword [0x1400df4a8]
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x1400478e5
mov edx, 1
mov ecx, 0x400
call fcn.14003fb0d
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0
jne 0x14004760b
xor eax, eax
jmp 0x1400478f4
lea rcx, [0x1400c6b94]
call fcn.14003f554
mov r8, rax
lea rdx, [0x1400c6b94]
mov rcx, qword [rbp + 0x48]
call fcn.14003f711
nop
mov rcx, qword [0x1400df488]
call fcn.14003f554
mov qword [rbp + 0x3f8], rax
lea rcx, [0x1400c6b94]
call fcn.14003f554
mov rcx, qword [rbp + 0x48]
add rcx, rax
mov rax, rcx
mov rcx, qword [rbp + 0x3f8]
mov r8, rcx
mov rdx, qword [0x1400df488]
mov rcx, rax
call fcn.14003f711
nop
mov rcx, qword [rbp + 0x48]
call fcn.14003f554
inc rax
mov dword [rsp + 0x28], eax
mov rax, qword [rbp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
lea rdx, str.ImagePath
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x1400476b9
lea rcx, str.Step1_Error_n
call fcn.14003f68a
nop
xor eax, eax
jmp 0x1400478f4
lea rax, [rbp + 0x64]
mov rdi, rax
xor eax, eax
mov ecx, 4
rep stosb byte [rdi], al
mov dword [rbp + 0x64], 1
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x64]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Type
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x140047713
lea rcx, str.Step2_Error_n
call fcn.14003f68a
nop
xor eax, eax
jmp 0x1400478f4
lea rax, [rbp + 8]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
lea rdx, str.SystemCurrentControlSet_services
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140047755
lea r8, [rbp + 0x28]
mov rdx, qword [0x1400df4a8]
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
nop
jmp 0x140047769
lea rcx, str.Step3_Error_n
call fcn.14003f68a
nop
xor eax, eax
jmp 0x1400478f4
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jne 0x1400477a6
lea rcx, str.Step4_Error_n
call fcn.14003f68a
nop
xor eax, eax
jmp 0x1400478f4
lea rdx, str.RtlInitUnicodeString
mov rcx, qword [rbp + 0x88]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0xa8], rax
lea rdx, str.NtLoadDriver
mov rcx, qword [rbp + 0x88]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0xc8], rax
lea rdx, str.RtlAdjustPrivilege
mov rcx, qword [rbp + 0x88]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0xe8], rax
lea r9, [rbp + 0x104]
xor r8d, r8d
mov edx, 1
mov ecx, 0xa
call qword [rbp + 0xe8]
mov dword [rbp + 0x124], eax
cmp dword [rbp + 0x124], 0
jge 0x140047834
lea rcx, str.Step5_Error_n
call fcn.14003f68a
nop
xor eax, eax
jmp 0x1400478f4
lea rax, [rbp + 0x180]
lea rcx, str.RegistryMachineSystemCurrentControlSet_
mov rdi, rax
mov rsi, rcx
mov ecx, 0x58
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x1d8]
mov rdi, rax
xor eax, eax
mov ecx, 0x70
rep stosb byte [rdi], al
mov rdx, qword [0x1400df4a8]
lea rcx, [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
nop
lea rdx, [rbp + 0x180]
lea rcx, [rbp + 0x148]
call qword [rbp + 0xa8]
nop
lea rcx, [rbp + 0x148]
call qword [rbp + 0xc8]
mov dword [rbp + 0x264], eax
cmp dword [rbp + 0x264], 0
jl 0x1400478b1
mov eax, 1
jmp 0x1400478f4
cmp dword [rbp + 0x264], 0xc0000603
jne 0x1400478cc
lea rcx, str.The_drivers_certificate_has_been_revoked__please_wait_for_the_project_to_be_updated.._n
call fcn.14003f68a
nop
jmp 0x1400478df
mov edx, dword [rbp + 0x264]
lea rcx, str.Error_Code:___lx._n
call fcn.14003f68a
nop
xor eax, eax
jmp 0x1400478f4
lea rcx, str.Reg_Add_Error__The_program_needs_to_be_run_with_administrator_privileges__n
call fcn.14003f68a
nop
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x1400c5680]
call fcn.1400406f7
mov rax, rdi
mov rcx, qword [rbp + 0x400]
xor rcx, rbp
call fcn.14003f70c
lea rsp, [rbp + 0x410]
pop rdi
pop rsi
pop rbp
ret