Function at 0x14000ab10
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xe8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x60], 0xfffffffffffffffe
mov rdi, rcx
lea rcx, [rbp - 0x18]
call section..text
mov r15, qword [rbp - 8]
movabs rax, 0x8000000000000023
add rax, r15
cmp rax, 0x21
jbe 0x14000b278
mov rbx, qword [rbp - 0x18]
mov r12, qword [rbp]
xorps xmm0, xmm0
movaps xmmword [rbp + 0x10], xmm0
movaps xmmword [rbp + 0x20], xmm0
lea r13, [r15 + 0x22]
cmp r13, 8
jb 0x14000abd8
mov rax, r13
or rax, 7
movabs rcx, 0x7ffffffffffffffe
cmp rax, rcx
ja 0x14000b288
cmp rax, 0xb
mov esi, 0xa
cmovae rsi, rax
lea rcx, [rsi + rsi]
cmp rsi, 0x7ff
jb 0x14000abe3
movabs rax, 0x7fffffffffffffec
cmp rsi, rax
jae 0x14000b288
add rcx, 0x29
call fcn.1401655a0
mov r14, rax
add r14, 0x27
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x14000abef
lea r14, [rbp + 0x10]
mov esi, 7
jmp 0x14000abf3
add rcx, 2
call fcn.1401655a0
mov r14, rax
mov qword [rbp + 0x10], r14
cmp r12, 8
lea rax, [rbp - 0x18]
cmovb rbx, rax
mov qword [rbp + 0x20], r13
mov qword [rbp + 0x28], rsi
movups xmm0, xmmword [0x1401cc24c]
movups xmmword [r14 + 0x30], xmm0
movups xmm0, xmmword [0x1401cc23c]
movups xmmword [r14 + 0x20], xmm0
movups xmm0, xmmword [0x1401cc22c]
movups xmmword [r14 + 0x10], xmm0
movups xmm0, xmmword [0x1401cc21c]
movups xmmword [r14], xmm0
mov dword [r14 + 0x40], 0x5c0073
lea rcx, [r14 + 0x44]
lea r8, [r15 + r15]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov word [r14 + r15*2 + 0x44], 0
mov r14, qword [rdi + 0x10]
movabs rax, 0x8000000000000005
add rax, r14
cmp rax, 3
jbe 0x14000b27d
mov r15, qword [rdi]
mov r12, qword [rdi + 0x18]
xorps xmm0, xmm0
movaps xmmword [rbp + 0x40], xmm0
movaps xmmword [rbp + 0x30], xmm0
lea r13, [r14 + 4]
cmp r13, 8
jb 0x14000acee
mov rax, r13
or rax, 7
movabs rcx, 0x7ffffffffffffffe
cmp rax, rcx
ja 0x14000b28d
cmp rax, 0xb
mov esi, 0xa
cmovae rsi, rax
lea rcx, [rsi + rsi]
cmp rsi, 0x7ff
jb 0x14000acf9
movabs rax, 0x7fffffffffffffec
cmp rsi, rax
jae 0x14000b28d
add rcx, 0x29
call fcn.1401655a0
mov rbx, rax
add rbx, 0x27
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x14000ad05
lea rbx, [rbp + 0x30]
mov esi, 7
jmp 0x14000ad09
add rcx, 2
call fcn.1401655a0
mov rbx, rax
mov qword [rbp + 0x30], rbx
cmp r12, 8
cmovae rdi, r15
mov qword [rbp + 0x40], r13
mov qword [rbp + 0x48], rsi
movabs rax, 0x5c003f003f005c
mov qword [rbx], rax
lea rcx, [rbx + 8]
lea r8, [r14 + r14]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov word [rbx + r14*2 + 8], 0
cmp qword [rbp + 0x28], 8
jb 0x14000ad4b
mov rdx, qword [rbp + 0x10]
jmp 0x14000ad4f
lea rdx, [rbp + 0x10]
lea r8, [rbp + 0x50]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x14000ada5
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.____Cant_create_service_key
call fcn.140060bb0
mov rsi, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rsi
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_wchar_t___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::widen_char_const___ptr64]
mov rcx, rsi
mov edx, eax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::put_wchar_t____ptr64]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::flush_void____ptr64]
jmp 0x14000aea2
mov eax, dword [rbp + 0x40]
add eax, eax
cmp qword [rbp + 0x48], 8
jb 0x14000adb7
mov rdx, qword [rbp + 0x30]
jmp 0x14000adbb
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 0x50]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
lea r8, [0x1401cc280]
xor edx, edx
mov r9d, 2
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov rcx, qword [rbp + 0x50]
test eax, eax
je 0x14000ae29
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.____Cant_create_ImagePath_registry_value
call fcn.140060bb0
mov rsi, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rsi
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_wchar_t___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::widen_char_const___ptr64]
mov rcx, rsi
mov edx, eax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::put_wchar_t____ptr64]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::flush_void____ptr64]
jmp 0x14000aea2
lea rax, [0x1401cc218]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 4
lea r8, [0x1401cc2c0]
xor edx, edx
mov r9d, 4
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov edi, eax
mov rcx, qword [rbp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x14000af8c
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.____Cant_create_Type_registry_value
call fcn.140060bb0
mov rsi, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rsi
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_wchar_t___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::widen_char_const___ptr64]
mov rcx, rsi
mov edx, eax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::put_wchar_t____ptr64]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::flush_void____ptr64]
xor esi, esi
mov rax, qword [rbp + 0x48]
cmp rax, 8
jb 0x14000aeea
mov rcx, qword [rbp + 0x30]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x14000aee5
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14000b282
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.1401658ec
mov rax, qword [rbp + 0x28]
cmp rax, 8
jb 0x14000af30
mov rcx, qword [rbp + 0x10]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x14000af2b
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14000b282
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.1401658ec
mov rax, qword [rbp]
cmp rax, 8
jb 0x14000af76
mov rcx, qword [rbp - 0x18]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x14000af71
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14000b282
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.1401658ec
mov eax, esi
add rsp, 0xe8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea rcx, [0x1401cb8e8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x14000aea2
mov rdi, rax
lea rdx, [0x1401cc2f1]
mov rsi, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call rsi
mov rbx, rax
lea rdx, str.NtLoadDriver
mov rcx, rdi
call rsi
mov rsi, rax
lea r9, [rbp + 0x5f]
mov ecx, 0xa
mov dl, 1
xor r8d, r8d
call rbx
test eax, eax
js 0x14000b094
mov r15, qword [rbp - 8]
movabs rax, 0x8000000000000035
add rax, r15
cmp rax, 0x33
jbe 0x14000b292
mov r8, qword [rbp - 0x18]
mov rdx, qword [rbp]
xorps xmm0, xmm0
movaps xmmword [rbp - 0x40], xmm0
movaps xmmword [rbp - 0x30], xmm0
lea rdi, [r15 + 0x34]
lea rbx, [rbp - 0x40]
mov r12d, 7
mov r14, rbx
cmp rdi, 8
jb 0x14000b0ce
mov rax, rdi
or rax, 7
movabs rcx, 0x7ffffffffffffffe
cmp rax, rcx
ja 0x14000b297
cmp rax, 0xb
mov r12d, 0xa
cmovae r12, rax
lea rcx, [r12 + r12]
cmp r12, 0x7ff
mov qword [rbp + 8], rdx
jb 0x14000b0b4
movabs rax, 0x7fffffffffffffec
cmp r12, rax
jae 0x14000b297
mov r13, r8
add rcx, 0x29
call fcn.1401655a0
mov r14, rax
add r14, 0x27
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x14000b0c3
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.Fatal_error:_failed_to_acquire_SE_LOAD_DRIVER_PRIVILEGE._Make_sure_you_are_running_as_administrator.
call fcn.140060bb0
mov rcx, rax
call fcn.140060800
jmp 0x14000aea2
mov r13, r8
add rcx, 2
call fcn.1401655a0
mov r14, rax
mov r8, r13
mov rdx, qword [rbp + 8]
mov qword [rbp - 0x40], r14
mov r13, rsi
cmp rdx, 8
lea rdx, [rbp - 0x18]
cmovae rdx, r8
mov qword [rbp - 0x30], rdi
mov qword [rbp - 0x28], r12
movups xmm0, xmmword [0x1401cc3c6]
movups xmmword [r14 + 0x50], xmm0
movups xmm0, xmmword [0x1401cc3b6]
movups xmmword [r14 + 0x40], xmm0
movups xmm0, xmmword [0x1401cc3a6]
movups xmmword [r14 + 0x30], xmm0
movups xmm0, xmmword [0x1401cc396]
movups xmmword [r14 + 0x20], xmm0
movups xmm0, xmmword [0x1401cc386]
movups xmmword [r14 + 0x10], xmm0
movups xmm0, xmmword [0x1401cc376]
movups xmmword [r14], xmm0
movabs rax, 0x5c007300650063
mov qword [r14 + 0x60], rax
lea rcx, [r14 + 0x68]
lea r8, [r15 + r15]
call sub.VCRUNTIME140.dll_memcpy
mov word [r14 + r15*2 + 0x68], 0
cmp qword [rbp - 0x28], 8
jb 0x14000b15a
mov rbx, qword [rbp - 0x40]
lea rsi, [rbp - 0x50]
mov rcx, rsi
mov rdx, rbx
call sub.ntdll.dll_RtlInitUnicodeString
mov rcx, rsi
call r13
mov esi, eax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.___NtLoadDriver_Status_0x
call fcn.140060bb0
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
mov edx, 0xfffff1ff
and edx, dword [rax + rcx + 0x18]
or edx, 0x800
mov dword [rax + rcx + 0x18], edx
mov rcx, rax
mov edx, esi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___long_int____ptr64]
mov rdi, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rdi
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_wchar_t___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::widen_char_const___ptr64]
mov rcx, rdi
mov edx, eax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::put_wchar_t____ptr64]
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::flush_void____ptr64]
cmp esi, 0xc000010d
jg 0x14000b1ff
cmp esi, 0xc0000022
je 0x14000b1ea
cmp esi, 0xc000009a
jne 0x14000b222
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.____Error_0xC0000022_or_0xC000009A
call fcn.140060bb0
jmp 0x14000b222
cmp esi, 0xc000010e
je 0x14000b22a
cmp esi, 0xc0000603
jne 0x14000b222
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.____Error_0xC0000603
call fcn.140060bb0
test esi, esi
setns sil
jmp 0x14000b22d
mov sil, 1
mov rax, qword [rbp - 0x28]
cmp rax, 8
jb 0x14000aea4
mov rcx, qword [rbp - 0x40]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x14000b26e
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14000b282
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.1401658ec
jmp 0x14000aea4
call fcn.140012110
call fcn.140012110
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
call fcn.140011f50
call fcn.140011f50
call fcn.140012110
call fcn.140011f50
int3