Function at 0x1400091b0
Capabilities:
Persist via windows service
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rax - 0x5f]
sub rsp, 0xe0
movaps xmmword [rax - 0x28], xmm6
mov rbx, rcx
xor r14d, r14d
lea rcx, [rbp - 0x59]
call fcn.140001cd0
nop
movabs rdi, 0x7ffffffffffffffe
mov rax, rdi
mov rcx, qword [rbp - 0x49]
sub rax, rcx
cmp rax, 0x22
jb 0x140009540
lea rax, [rbp - 0x59]
cmp qword [rbp - 0x41], 7
cmova rax, qword [rbp - 0x59]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x22
lea r9, str.SYSTEMCurrentControlSetServices_
lea rcx, [rbp + 7]
call fcn.140008780
nop
mov rcx, qword [rbx + 0x10]
mov rax, rdi
sub rax, rcx
cmp rax, 4
jb 0x140009546
cmp qword [rbx + 0x18], 7
jbe 0x14000924c
mov rbx, qword [rbx]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], 4
lea r9, str.___
lea rcx, [rbp - 0x39]
call fcn.140008780
nop
lea rdx, [rbp + 7]
cmp qword [rbp + 0x1f], 7
cmova rdx, qword [rbp + 7]
lea r8, [rbp + 0x77]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
movdqa xmm6, xmmword [0x140043f40]
test eax, eax
jne 0x140009438
mov eax, dword [rbp - 0x29]
add eax, eax
lea rcx, [rbp - 0x39]
cmp qword [rbp - 0x21], 7
cmova rcx, qword [rbp - 0x39]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 2
lea r8, str.ImagePath
xor edx, edx
mov rcx, qword [rbp + 0x77]
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov rcx, qword [rbp + 0x77]
test eax, eax
jne 0x140009432
mov dword [rsp + 0x28], 4
lea rax, [0x140043d80]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, str.Type
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov rcx, qword [rbp + 0x77]
test eax, eax
jne 0x140009432
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [0x14003b440]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rsi, rax
test rax, rax
je 0x140009438
lea rdx, str.RtlAdjustPrivilege
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rdx, str.NtLoadDriver
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
lea r9, [rbp + 0x6f]
xor r8d, r8d
mov dl, 1
mov ecx, 0xa
call rbx
test eax, eax
js 0x140009438
mov rcx, qword [rbp - 0x49]
sub rdi, rcx
cmp rdi, 0x34
jb 0x14000954c
lea rax, [rbp - 0x59]
cmp qword [rbp - 0x41], 7
cmova rax, qword [rbp - 0x59]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x34
lea r9, str.RegistryMachineSystemCurrentControlSetServices_
lea rcx, [rbp - 0x19]
call fcn.140008780
nop
lea rdx, [rbp - 0x19]
cmp qword [rbp - 1], 7
cmova rdx, qword [rbp - 0x19]
lea rcx, [rbp + 0x27]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rcx, [rbp + 0x27]
call rsi
mov ebx, eax
cmp eax, 0xc000010e
jne 0x1400093e0
mov bl, 1
jmp 0x1400093e6
shr ebx, 0x1f
xor bl, 1
mov rdx, qword [rbp - 1]
cmp rdx, 7
jbe 0x140009426
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009421
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009552
call fcn.14000b938
movdqu xmmword [rbp - 9], xmm6
mov word [rbp - 0x19], r14w
jmp 0x14000943a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor bl, bl
mov rdx, qword [rbp - 0x21]
cmp rdx, 7
jbe 0x140009482
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x39]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009475
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009558
call fcn.14000b938
movdqa xmm6, xmmword [0x140043f40]
movdqu xmmword [rbp - 0x29], xmm6
mov word [rbp - 0x39], r14w
mov rdx, qword [rbp + 0x1f]
cmp rdx, 7
jbe 0x1400094d4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400094c7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000955e
call fcn.14000b938
movdqa xmm6, xmmword [0x140043f40]
movdqu xmmword [rbp + 0x17], xmm6
mov word [rbp + 7], r14w
mov rdx, qword [rbp - 0x41]
cmp rdx, 7
jbe 0x14000951a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x59]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009515
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000953a
call fcn.14000b938
movzx eax, bl
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x38]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.140013748
nop
call fcn.1400012d0
nop
call fcn.1400012d0
nop
call fcn.1400012d0
int3
call fcn.140013748
nop
call fcn.140013748
nop
call fcn.140013748
int3