Function at 0x1400fee50
Capabilities:
Persist via windows service
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x50]
sub rsp, 0x150
mov rax, qword [0x140672360]
xor rax, rsp
mov qword [rbp + 0x48], rax
mov rdi, rcx
mov qword [rsp + 0x78], rcx
mov qword [rbp - 0x40], rcx
lea rdx, str._Settings__Set_driver_minifilter_custom_options.
xor ecx, ecx
call fcn.140109e80
mov rbx, qword [rdi]
xor eax, eax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], 0xf
mov byte [rbp - 0x60], al
lea r8d, [rax + 0xc]
lea rdx, str.ultraexclude
lea rcx, [rbp - 0x60]
call fcn.140073120
nop
mov r14, qword [rbx]
mov rbx, qword [r14 + 8]
mov qword [rbp + 0x10], r14
mov r12d, 0xffffffff
mov r13, qword [rbp - 0x48]
mov rsi, qword [rbp - 0x50]
mov r15, qword [rbp - 0x60]
cmp byte [rbx + 0x19], 0
jne 0x1400fef51
nop dword [rax]
lea rcx, [rbx + 0x20]
lea rdx, [rbp - 0x60]
cmp r13, 0x10
cmovae rdx, r15
mov rdi, qword [rcx + 0x10]
cmp qword [rcx + 0x18], 0x10
jb 0x1400fef0e
mov rcx, qword [rcx]
mov r8, rdi
cmp rsi, rdi
cmovb r8, rsi
call fcn.14035bb80
test eax, eax
jne 0x1400fef33
cmp rdi, rsi
jae 0x1400fef2b
mov eax, r12d
jmp 0x1400fef33
xor eax, eax
cmp rdi, rsi
seta al
shr eax, 0x1f
test al, al
je 0x1400fef40
mov rbx, qword [rbx + 0x10]
jmp 0x1400fef46
mov r14, rbx
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
je 0x1400feef0
mov rdi, qword [rsp + 0x78]
cmp byte [r14 + 0x19], 0
jne 0x1400fefb3
lea rdx, [r14 + 0x20]
mov rbx, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x1400fef6a
mov rdx, qword [rdx]
lea rcx, [rbp - 0x60]
cmp r13, 0x10
cmovae rcx, r15
mov r8, rsi
cmp rbx, rsi
cmovb r8, rbx
call fcn.14035bb80
test eax, eax
jne 0x1400fef9b
cmp rsi, rbx
jae 0x1400fef93
mov eax, r12d
jmp 0x1400fef9b
xor eax, eax
cmp rsi, rbx
seta al
shr eax, 0x1f
test al, al
jne 0x1400fefb3
cmp r14, qword [rbp + 0x10]
je 0x1400fefb3
cmp byte [r14 + 0x60], 1
jne 0x1400fefb3
mov r12d, dword [r14 + 0x40]
cmp r13, 0x10
jb 0x1400fefea
lea rdx, [r13 + 1]
mov rax, r15
cmp rdx, 0x1000
jb 0x1400fefe2
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400ff56e
mov rcx, r15
call fcn.140359090
mov byte [rbp - 0x60], 0
cmp r12d, 0xffffffff
jne 0x1400ff00b
lea rdx, str._Settings__No_custom_option_policies__skipping.
xor ecx, ecx
call fcn.140109e80
nop
mov rcx, rdi
jmp 0x1400ff4e0
xor edi, edi
mov r13d, edi
cmp r12d, 1
sete r13b
xorps xmm0, xmm0
movups xmmword [rbp + 0x18], xmm0
movups xmmword [rbp + 0x28], xmm0
movups xmmword [rbp + 0x38], xmm0
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], 7
mov word [rsp + 0x58], di
lea r8d, [rdi + 0x2a]
lea rdx, str.SYSTEMCurrentControlSet_serviceshmpalert
lea rcx, [rsp + 0x58]
call fcn.1400739a0
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x18], xmm0
movdqa xmm1, xmmword [0x14060af30]
movdqu xmmword [rbp + 0x30], xmm1
mov word [rbp + 0x20], di
mov dword [rbp + 0x40], 2
lea rdx, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rdx, qword [rsp + 0x58]
mov r8, qword [rsp + 0x68]
lea rcx, [rbp + 0x20]
call fcn.1400739a0
lea rdx, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rdx, qword [rsp + 0x58]
lea rax, [rbp + 0x18]
mov qword [rsp + 0x20], rax
mov r9d, 0x20106
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 8
jb 0x1400ff107
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ff102
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400ff574
call fcn.140359090
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], 7
mov word [rsp + 0x58], di
cmp qword [rbp + 0x18], 0
je 0x1400ff40f
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
mov qword [rbp - 0x80], rdi
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x68], 7
mov word [rbp - 0x80], di
mov r8d, 0xd
lea rdx, str.CustomOptions
lea rcx, [rbp - 0x80]
call fcn.1400739a0
nop
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
mov qword [rsp + 0x50], rdi
mov ecx, 4
call fcn.1403590cc
mov qword [rsp + 0x40], rax
lea rcx, [rax + 4]
mov qword [rsp + 0x50], rcx
xor edx, edx
mov dword [rax], edx
mov qword [rsp + 0x48], rcx
mov rax, qword [rsp + 0x40]
mov dword [rax], r13d
mov qword [rbp - 0x30], rdi
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x20], xmm0
lea rsi, [rbp - 0x80]
mov r14, qword [rbp - 0x80]
mov r15, qword [rbp - 0x68]
cmp r15, 8
cmovae rsi, r14
mov rdi, qword [rbp - 0x70]
cmp rdi, 8
jae 0x1400ff1d9
movups xmm0, xmmword [rsi]
movaps xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x18], 7
jmp 0x1400ff23b
or rdi, 7
movabs rax, 0x7ffffffffffffffe
cmp rdi, rax
cmova rdi, rax
lea rcx, [rdi + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x1400ff57a
lfence
add rcx, rcx
call fcn.140073800
mov qword [rbp - 0x30], rax
mov rbx, qword [rbp - 0x70]
lea r8, [rbx*2 + 2]
mov rdx, rsi
mov rcx, rax
call fcn.14035bc80
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], rdi
mov r15, qword [rbp - 0x68]
mov r14, qword [rbp - 0x80]
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x10], xmm0
xor edi, edi
mov qword [rbp], rdi
mov rsi, qword [rsp + 0x40]
mov r12, qword [rsp + 0x48]
cmp rsi, r12
je 0x1400ff299
mov rbx, r12
sub rbx, rsi
mov rcx, rbx
call fcn.140073800
mov rdi, rax
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rax
lea rcx, [rax + rbx]
mov qword [rbp], rcx
mov r8, rbx
mov rdx, rsi
mov rcx, rax
call fcn.14035bc80
sub rdi, rsi
lea rax, [rdi + r12]
mov qword [rbp - 8], rax
mov rsi, qword [rsp + 0x40]
xor edi, edi
mov dword [rbp + 8], 4
test rsi, rsi
je 0x1400ff2e8
mov rdx, qword [rsp + 0x50]
sub rdx, rsi
mov rax, rsi
cmp rdx, 0x1000
jb 0x1400ff2d2
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400ff580
mov rcx, rsi
call fcn.140359090
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rdi
cmp r15, 8
jb 0x1400ff323
lea rdx, [r15*2 + 2]
mov rax, r14
cmp rdx, 0x1000
jb 0x1400ff31b
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400ff586
mov rcx, r14
call fcn.140359090
mov rcx, qword [rbp - 8]
mov rax, qword [rbp - 0x10]
sub rcx, rax
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rdx, qword [rbp - 0x30]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 8]
xor r8d, r8d
mov rcx, qword [rbp + 0x18]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1400ff3c0
lea rdx, str._Settings__Failed_to_set_driver_minifilter_custom_options_value.
mov ecx, 3
call fcn.140109e80
nop
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x1400ff3b2
mov rdx, qword [rbp]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ff3a1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400ff568
call fcn.140359090
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x10], xmm0
mov qword [rbp], rdi
lea rcx, [rbp - 0x30]
call fcn.140073b90
jmp 0x1400ff4be
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x1400ff406
mov rdx, qword [rbp]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ff3f5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400ff568
call fcn.140359090
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x10], xmm0
mov qword [rbp], rdi
lea rcx, [rbp - 0x30]
call fcn.140073b90
call fcn.140084e80
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400ff4ac
mov dword [rbp + 0x10], edi
mov qword [rsp + 0x38], rdi
lea rax, [rbp + 0x10]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
mov edx, 0x222230
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x1400ff512
lea rdx, str.0cg_
mov rax, qword [str.0cg_]
cmp rax, rdx
je 0x1400ff4a3
test byte [rax + 0x1c], 1
je 0x1400ff4a3
cmp byte [rax + 0x19], 2
jb 0x1400ff4a3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [str.0cg_]
mov edx, 0x15
mov dword [rsp + 0x20], eax
lea r9, str.IOCTL_MINIFILTER_RELOADCUSTOMOPTIONS
lea r8, [0x1405f3430]
mov rcx, qword [rcx + 0x10]
call fcn.140079f00
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str._Settings__Failed_to_reload_driver_minifilter_custom_options.
mov ecx, 3
call fcn.140109e80
nop
mov rcx, qword [rbp + 0x18]
test rcx, rcx
je 0x1400ff4d1
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp + 0x18], rdi
lea rcx, [rbp + 0x20]
call fcn.140073b90
nop
mov rcx, qword [rsp + 0x78]
call fcn.140075ed0
mov rcx, qword [rbp + 0x48]
xor rcx, rsp
call fcn.140359070
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
lea rdx, str.0cg_
mov rcx, qword [str.0cg_]
cmp rcx, rdx
je 0x1400ff546
test byte [rcx + 0x1c], 1
je 0x1400ff546
cmp byte [rcx + 0x19], 2
jb 0x1400ff546
mov edx, 0x16
lea r8, [0x1405f3430]
mov rcx, qword [rcx + 0x10]
call fcn.14007d150
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, r13d
lea rdx, str._Settings__Successfully_reloaded_driver_minifilter_custom_options___010x_.
mov ecx, 1
call fcn.140109e80
jmp 0x1400ff4be
call fcn.140368068
nop
call fcn.140368068
nop
call fcn.140368068
nop
call fcn.140073980
nop
call fcn.140368068
nop
call fcn.140368068
int3