Function at 0x14009a230
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x100
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x78], 0xfffffffffffffffe
mov rdi, rcx
lea rsi, [rbp - 0x50]
mov rcx, rsi
call section..text
lea rdx, str.SYSTEMCurrentControlSetServices_
lea rcx, [rbp - 0x28]
mov r8, rsi
call fcn.14009ad40
lea rdx, str.___
mov rsi, rbp
mov rcx, rsi
mov r8, rdi
call fcn.14009ad40
lea rcx, [rbp - 0x28]
call fcn.1400819e0
lea r8, [rbp + 0x58]
mov rcx, 0xffffffff80000002
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x14009a416
lea rcx, [0x140149ab0]
lea rdx, str.____Cant_create_service_key
call fcn.14001a4b0
mov ecx, dword [0x14014542c]
lea edx, [rcx - 1]
imul edx, ecx
test dl, 1
sete byte [rbp + 0x60]
mov ecx, dword [0x140145430]
sete dl
cmp ecx, 0xa
setl cl
setl byte [rbp + 0x28]
or cl, dl
mov r8d, 0xfa81deb6
mov ecx, 0x91685fa5
cmove r8d, ecx
mov esi, 0x79631133
cmove esi, ecx
mov ecx, 0x91105d4e
mov ebx, 0x3b2e9f46
cmovne ebx, ecx
mov edx, 0xf8bd502b
jmp 0x14009a320
mov edx, 0x7edbeddb
nop dword [rax + rax]
mov edi, edx
cmp edx, 0xfa81deb5
jle 0x14009a360
cmp edi, 0x4f763e7c
jle 0x14009a390
mov edx, esi
cmp edi, 0x4f763e7d
je 0x14009a320
mov edx, r8d
cmp edi, 0x79631133
je 0x14009a320
mov edx, edi
cmp edi, 0x7edbeddb
jne 0x14009a320
jmp 0x14009a409
cmp edi, 0xabdfd435
jg 0x14009a3c0
cmp edi, 0x91105d4e
je 0x14009a3ff
mov edx, edi
cmp edi, 0x91685fa5
jne 0x14009a320
mov edx, 0x79631133
jmp 0x14009a320
cmp edi, 0xfa81deb6
je 0x14009a313
mov edx, edi
cmp edi, 0x3b2e9f46
jne 0x14009a320
mov edx, 0xabdfd436
jmp 0x14009a320
mov edx, ebx
cmp edi, 0xabdfd436
je 0x14009a320
mov edx, edi
cmp edi, 0xf8bd502b
jne 0x14009a320
movzx ecx, byte [rbp + 0x60]
cmp byte [rbp + 0x28], 0
mov edi, 0xabdfd436
mov edx, 0xabdfd436
jne 0x14009a3f5
mov edx, 0x3b2e9f46
test cl, cl
cmovne edx, edi
jmp 0x14009a320
mov edx, 0x4f763e7d
jmp 0x14009a320
mov rcx, rax
call fcn.140005a60
jmp 0x14009a781
mov qword [rbp + 0x60], rsi
mov ecx, 0xd1671bcd
nop
cmp ecx, 0xcd7574b4
je 0x14009a43b
cmp ecx, 0xd1671bcd
jne 0x14009a420
mov rax, qword [rbp + 0x60]
mov ecx, 0xcd7574b4
jmp 0x14009a420
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
mov esi, dword [rax + 0x18]
mov rcx, rbp
call fcn.1400819e0
add esi, esi
mov rcx, qword [rbp + 0x58]
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
lea r8, str.ImagePath
xor edx, edx
mov r9d, 2
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov rcx, qword [rbp + 0x58]
test eax, eax
je 0x14009a5e6
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [0x140149ab0]
lea rdx, str.____Cant_create_ImagePath_registry_value
call fcn.14001a4b0
mov ecx, dword [0x14014542c]
lea edx, [rcx - 1]
imul edx, ecx
test dl, 1
sete byte [rbp + 0x60]
mov ecx, dword [0x140145430]
sete dl
cmp ecx, 0xa
setl cl
setl byte [rbp + 0x28]
or cl, dl
mov r8d, 0xfa81deb6
mov ecx, 0x91685fa5
cmove r8d, ecx
mov esi, 0x79631133
cmove esi, ecx
mov ecx, 0x91105d4e
mov ebx, 0x3b2e9f46
cmovne ebx, ecx
mov edx, 0xf8bd502b
jmp 0x14009a4f0
mov edx, 0x7edbeddb
nop
mov edi, edx
cmp edx, 0xfa81deb5
jle 0x14009a530
cmp edi, 0x4f763e7c
jle 0x14009a560
mov edx, esi
cmp edi, 0x4f763e7d
je 0x14009a4f0
mov edx, r8d
cmp edi, 0x79631133
je 0x14009a4f0
mov edx, edi
cmp edi, 0x7edbeddb
jne 0x14009a4f0
jmp 0x14009a5d9
cmp edi, 0xabdfd435
jg 0x14009a590
cmp edi, 0x91105d4e
je 0x14009a5cf
mov edx, edi
cmp edi, 0x91685fa5
jne 0x14009a4f0
mov edx, 0x79631133
jmp 0x14009a4f0
cmp edi, 0xfa81deb6
je 0x14009a4ea
mov edx, edi
cmp edi, 0x3b2e9f46
jne 0x14009a4f0
mov edx, 0xabdfd436
jmp 0x14009a4f0
mov edx, ebx
cmp edi, 0xabdfd436
je 0x14009a4f0
mov edx, edi
cmp edi, 0xf8bd502b
jne 0x14009a4f0
movzx ecx, byte [rbp + 0x60]
cmp byte [rbp + 0x28], 0
mov edi, 0xabdfd436
mov edx, 0xabdfd436
jne 0x14009a5c5
mov edx, 0x3b2e9f46
test cl, cl
cmovne edx, edi
jmp 0x14009a4f0
mov edx, 0x4f763e7d
jmp 0x14009a4f0
mov rcx, rax
call fcn.140005a60
jmp 0x14009a781
lea rax, [0x1401189c8]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 4
lea r8, str.Type
xor edx, edx
mov r9d, 4
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov esi, eax
mov rcx, qword [rbp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x14009a7b1
lea rcx, [0x140149ab0]
lea rdx, str.____Cant_create_Type_registry_value
call fcn.14001a4b0
mov ecx, dword [0x14014542c]
lea edx, [rcx - 1]
imul edx, ecx
test dl, 1
sete byte [rbp + 0x60]
mov ecx, dword [0x140145430]
sete dl
cmp ecx, 0xa
setl cl
setl byte [rbp + 0x28]
or cl, dl
mov r8d, 0xfa81deb6
mov ecx, 0x91685fa5
cmove r8d, ecx
mov esi, 0x79631133
cmove esi, ecx
mov ecx, 0x91105d4e
mov ebx, 0x3b2e9f46
cmovne ebx, ecx
mov edx, 0xf8bd502b
jmp 0x14009a690
mov edx, 0x7edbeddb
nop
mov edi, edx
cmp edx, 0xfa81deb5
jle 0x14009a6d0
cmp edi, 0x4f763e7c
jle 0x14009a700
mov edx, esi
cmp edi, 0x4f763e7d
je 0x14009a690
mov edx, r8d
cmp edi, 0x79631133
je 0x14009a690
mov edx, edi
cmp edi, 0x7edbeddb
jne 0x14009a690
jmp 0x14009a779
cmp edi, 0xabdfd435
jg 0x14009a730
cmp edi, 0x91105d4e
je 0x14009a76f
mov edx, edi
cmp edi, 0x91685fa5
jne 0x14009a690
mov edx, 0x79631133
jmp 0x14009a690
cmp edi, 0xfa81deb6
je 0x14009a689
mov edx, edi
cmp edi, 0x3b2e9f46
jne 0x14009a690
mov edx, 0xabdfd436
jmp 0x14009a690
mov edx, ebx
cmp edi, 0xabdfd436
je 0x14009a690
mov edx, edi
cmp edi, 0xf8bd502b
jne 0x14009a690
movzx ecx, byte [rbp + 0x60]
cmp byte [rbp + 0x28], 0
mov edi, 0xabdfd436
mov edx, 0xabdfd436
jne 0x14009a765
mov edx, 0x3b2e9f46
test cl, cl
cmovne edx, edi
jmp 0x14009a690
mov edx, 0x4f763e7d
jmp 0x14009a690
mov rcx, rax
call fcn.140005a60
xor esi, esi
mov rcx, rbp
call fcn.140001e90
lea rcx, [rbp - 0x28]
call fcn.140001e90
lea rcx, [rbp - 0x50]
call fcn.140001e90
mov eax, esi
add rsp, 0x100
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
lea rcx, [0x140124297]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x14009a781
mov rsi, rax
lea rdx, str.RtlAdjustPrivilege
mov rbx, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call rbx
mov rdi, rax
lea rdx, str.NtLoadDriver
mov rcx, rsi
call rbx
mov rsi, rax
lea r9, [rbp + 0x75]
mov ecx, 0xa
mov dl, 1
xor r8d, r8d
call rdi
test eax, eax
js 0x14009aae3
lea rdx, str.RegistryMachineSystemCurrentControlSetServices_
lea rcx, [rbp + 0x28]
lea r8, [rbp - 0x50]
call fcn.14009ad40
lea rcx, [rbp + 0x28]
call fcn.1400819e0
lea rdi, [rbp + 0x60]
mov rcx, rdi
mov rdx, rax
call sub.ntdll.dll_RtlInitUnicodeString
mov rcx, rdi
call rsi
mov r12d, eax
lea rcx, [0x140149ab0]
lea rdx, str.___NtLoadDriver_Status_0x
call fcn.14001a4b0
mov rdi, rax
mov eax, dword [0x140144914]
mov ecx, dword [0x140144918]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete byte [rbp + 0x76]
cmp ecx, 0xa
setl byte [rbp + 0x77]
mov eax, 0x9497618
mov r14d, 0x89925eaf
mov r15d, 0xac995dab
nop
cmp eax, 0xac995daa
jg 0x14009a8e0
cmp eax, 0x8463822d
je 0x14009a964
cmp eax, 0x89925eaf
je 0x14009a910
cmp eax, 0xa8706c98
jne 0x14009a880
mov eax, 0xc902bd3a
mov rbx, qword [rbp + 0x50]
nop dword [rax]
cmp eax, 0x65725469
je 0x14009a91a
cmp eax, 0xc902bd3a
jne 0x14009a8b0
mov rcx, rbx
mov edx, 0x800
mov r8d, 0xe00
call fcn.140039400
mov eax, 0x65725469
jmp 0x14009a8b0
cmp eax, 0xac995dab
je 0x14009a924
cmp eax, 0x18ef5df2
je 0x14009a95a
cmp eax, 0x9497618
jne 0x14009a880
mov cl, byte [rbp + 0x76]
cmp byte [rbp + 0x77], 0
mov eax, 0x18ef5df2
cmovne eax, r15d
test cl, cl
cmovne eax, r15d
jmp 0x14009a880
mov eax, 0xa8706c98
jmp 0x14009a880
mov eax, 0x8463822d
jmp 0x14009a880
mov rax, qword [rdi]
movsxd rax, dword [rax + 4]
add rax, rdi
mov qword [rbp + 0x50], rax
mov eax, dword [0x140144914]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x18ef5df2
cmove eax, r14d
cmp dword [0x140144918], 0xa
cmovl eax, r14d
jmp 0x14009a880
mov eax, 0xac995dab
jmp 0x14009a880
mov rcx, rdi
mov edx, r12d
call fcn.14007e1b0
mov ecx, dword [0x14014542c]
lea edx, [rcx - 1]
imul edx, ecx
test dl, 1
sete byte [rbp + 0x77]
mov ecx, dword [0x140145430]
sete dl
cmp ecx, 0xa
setl cl
setl byte [rbp + 0x50]
or cl, dl
mov r8d, 0xfa81deb6
mov ecx, 0x91685fa5
cmove r8d, ecx
mov esi, 0x79631133
cmove esi, ecx
mov ecx, 0x91105d4e
mov ebx, 0x3b2e9f46
cmovne ebx, ecx
mov edx, 0xf8bd502b
jmp 0x14009a9d0
mov edx, 0x7edbeddb
nop word [rax + rax]
mov edi, edx
cmp edx, 0xfa81deb5
jle 0x14009aa10
cmp edi, 0x4f763e7c
jle 0x14009aa40
mov edx, esi
cmp edi, 0x4f763e7d
je 0x14009a9d0
mov edx, r8d
cmp edi, 0x79631133
je 0x14009a9d0
mov edx, edi
cmp edi, 0x7edbeddb
jne 0x14009a9d0
jmp 0x14009aab9
cmp edi, 0xabdfd435
jg 0x14009aa70
cmp edi, 0x91105d4e
je 0x14009aaaf
mov edx, edi
cmp edi, 0x91685fa5
jne 0x14009a9d0
mov edx, 0x79631133
jmp 0x14009a9d0
cmp edi, 0xfa81deb6
je 0x14009a9c2
mov edx, edi
cmp edi, 0x3b2e9f46
jne 0x14009a9d0
mov edx, 0xabdfd436
jmp 0x14009a9d0
mov edx, ebx
cmp edi, 0xabdfd436
je 0x14009a9d0
mov edx, edi
cmp edi, 0xf8bd502b
jne 0x14009a9d0
movzx ecx, byte [rbp + 0x77]
cmp byte [rbp + 0x50], 0
mov edi, 0xabdfd436
mov edx, 0xabdfd436
jne 0x14009aaa5
mov edx, 0x3b2e9f46
test cl, cl
cmovne edx, edi
jmp 0x14009a9d0
mov edx, 0x4f763e7d
jmp 0x14009a9d0
mov rcx, rax
call fcn.140005a60
cmp r12d, 0xc000010e
sete al
test r12d, r12d
setns sil
or sil, al
lea rcx, [rbp + 0x28]
call fcn.140001e90
jmp 0x14009a783
lea rcx, [0x140149ab0]
lea rdx, str.Fatal_error:_failed_to_acquire_SE_LOAD_DRIVER_PRIVILEGE._Make_sure_you_are_running_as_administrator.
call fcn.14001a4b0
mov ecx, dword [0x14014542c]
lea edx, [rcx - 1]
imul edx, ecx
test dl, 1
sete byte [rbp + 0x60]
mov ecx, dword [0x140145430]
sete dl
cmp ecx, 0xa
setl cl
setl byte [rbp + 0x28]
or cl, dl
mov r8d, 0xfa81deb6
mov ecx, 0x91685fa5
cmove r8d, ecx
mov esi, 0x79631133
cmove esi, ecx
mov ecx, 0x91105d4e
mov ebx, 0x3b2e9f46
cmovne ebx, ecx
mov edx, 0xf8bd502b
jmp 0x14009ab50
mov edx, 0x7edbeddb
nop
mov edi, edx
cmp edx, 0xfa81deb5
jle 0x14009ab90
cmp edi, 0x4f763e7c
jle 0x14009abc0
mov edx, esi
cmp edi, 0x4f763e7d
je 0x14009ab50
mov edx, r8d
cmp edi, 0x79631133
je 0x14009ab50
mov edx, edi
cmp edi, 0x7edbeddb
jne 0x14009ab50
jmp 0x14009ac29
cmp edi, 0xabdfd435
jg 0x14009abe0
cmp edi, 0x91105d4e
je 0x14009ac1f
mov edx, edi
cmp edi, 0x91685fa5
jne 0x14009ab50
mov edx, 0x79631133
jmp 0x14009ab50
cmp edi, 0xfa81deb6
je 0x14009ab49
mov edx, edi
cmp edi, 0x3b2e9f46
jne 0x14009ab50
mov edx, 0xabdfd436
jmp 0x14009ab50
mov edx, ebx
cmp edi, 0xabdfd436
je 0x14009ab50
mov edx, edi
cmp edi, 0xf8bd502b
jne 0x14009ab50
movzx ecx, byte [rbp + 0x60]
cmp byte [rbp + 0x28], 0
mov edi, 0xabdfd436
mov edx, 0xabdfd436
jne 0x14009ac15
mov edx, 0x3b2e9f46
test cl, cl
cmovne edx, edi
jmp 0x14009ab50
mov edx, 0x4f763e7d
jmp 0x14009ab50
mov rcx, rax
call fcn.140005a60
jmp 0x14009a781