Function at 0xea1460
Capabilities:
Delete file
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x768
mov eax, dword [0xeb0008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x75c]
push eax
push 0x28
mov dword [ebp - 0x754], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov edi, eax
test edi, edi
je 0xea16f5
lea ecx, [ebp - 0x74c]
push ecx
push str.SeLoadDriverPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov edi, eax
test edi, edi
je 0xea16f5
mov eax, dword [ebp - 0x75c]
push 0
push 0
push 0
lea edx, [ebp - 0x750]
push edx
push 0
push eax
mov dword [ebp - 0x750], 1
mov dword [ebp - 0x744], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov edi, eax
test edi, edi
je 0xea16f5
lea esi, [ebp - 0x218]
call fcn.00ea1220
test al, al
jne 0xea1518
push str.Error:_Cannot_extract_driver._n
call fcn.00ea1e01
add esp, 4
jmp 0xea16f5
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0xea15c3
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea esi, [ebp - 0x530]
lea ecx, [ebp - 0x218]
call fcn.00ea13d0
test al, al
je 0xea16f5
push str.DumpIt
push str.SYSTEMCurrentControlSetServices_S
lea eax, [ebp - 0x320]
push 0x105
push eax
call fcn.00ea1de3
add esp, 0x10
push 0
lea ecx, [ebp - 0x754]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
lea edx, [ebp - 0x320]
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0xea15dc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error:_Cannot_access_to_registry__Err_d_._r_n
call fcn.00ea1e01
add esp, 8
jmp 0xea16f5
lea edx, [ebp - 0x218]
push edx
push str.Error:_Driver_is_not_found._Please_double_check_at_:_r_n___s_r_n
call fcn.00ea1e01
add esp, 8
jmp 0xea16f5
mov ecx, dword [ebp - 0x754]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 4
lea eax, [ebp - 0x758]
push eax
push 4
push 0
push str.Type
push ecx
mov dword [ebp - 0x758], 1
call esi
test eax, eax
je 0xea161d
push str.Failed_to_create_Type_n
call fcn.00ea1e01
add esp, 4
jmp 0xea16f5
lea eax, [ebp - 0x530]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0xea1626
mov ecx, dword [ebp - 0x754]
sub eax, edx
sar eax, 1
lea edx, [eax + eax]
push edx
lea eax, [ebp - 0x530]
push eax
push 2
push 0
push str.ImagePath
push ecx
call esi
test eax, eax
je 0xea1668
push str.Failed_to_create_Type_n
call fcn.00ea1e01
add esp, 4
jmp 0xea16f5
mov eax, dword [ebp - 0x754]
push 4
lea edx, [ebp - 0x758]
push edx
push 4
push 0
push str.Start
push eax
mov dword [ebp - 0x758], 3
call esi
test eax, eax
je 0xea16a0
push str.Failed_to_create_Type_n
call fcn.00ea1e01
add esp, 4
jmp 0xea16f5
push str.DumpIt
push str.RegistryMachineSystemCurrentControlSetServices_s
lea ecx, [ebp - 0x740]
push 0x20a
push ecx
call fcn.00ea1dc5
add esp, 0x10
lea edx, [ebp - 0x740]
push edx
lea eax, [ebp - 0x764]
push eax
call dword [0xeb1b48]
lea ecx, [ebp - 0x764]
push ecx
call dword [0xeb1b50]
test eax, eax
jne 0xea16f5
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, 1
mov eax, dword [ebp - 0x754]
test eax, eax
je 0xea1706
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.00ea1db6
mov esp, ebp
pop ebp
ret