Function at 0x180005f10
Capabilities:
Install driver
Persist via windows service
Set registry value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x248]
sub rsp, 0x348
mov r14, rcx
xor r15d, r15d
mov dword [rsp + 0x30], r15d
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x50], r15
mov ecx, 0x68cf
call fcn.18000b110
test rax, rax
je 0x1800068f2
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
mov qword [rbp + 0x40], rsi
lea r13, [rsi + 0x68a8]
mov qword [rbp + 0x50], r13
mov r8d, 0x68a8
lea rdx, [0x180044c30]
mov rcx, rsi
call fcn.180010460
mov qword [rbp + 0x48], r13
lea rcx, [rbp + 0xb8]
call fcn.180005d50
nop
lea rdx, [rbp + 0x58]
mov rcx, rax
call fcn.180005180
nop
lea r8d, [r15 + 0x10]
lea rdx, [0x1800520c8]
mov rcx, rax
call fcn.180008fc0
mov qword [rbp - 0x38], r15
mov qword [rbp - 0x28], r15
mov qword [rbp - 0x20], r15
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x38], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x28], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], r15b
mov edi, 4
mov dword [rsp + 0x30], edi
mov rdx, qword [rbp + 0x70]
cmp rdx, 0x10
jb 0x180006033
inc rdx
mov rcx, qword [rbp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000602e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800068f8
call fcn.18000b108
mov qword [rbp + 0x68], r15
mov qword [rbp + 0x70], 0xf
mov byte [rbp + 0x58], 0
mov rdx, qword [rbp + 0xd0]
cmp rdx, 8
jb 0x180006089
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xb8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006084
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800068fe
call fcn.18000b108
movdqa xmm0, xmmword [0x180052180]
movdqu xmmword [rbp + 0xc8], xmm0
mov word [rbp + 0xb8], r15w
lea rdx, [rbp - 0x38]
cmp qword [rbp - 0x20], 0x10
cmovae rdx, qword [rbp - 0x38]
lea rcx, [rbp + 0x130]
call fcn.180007120
nop
mov r8d, 0x68a8
mov rdx, rsi
lea rcx, [rbp + 0x130]
call fcn.180007420
lea rcx, [rbp + 0x138]
call fcn.180008b40
mov ebx, 2
test rax, rax
jne 0x180006121
mov rax, qword [rbp + 0x130]
movsxd rcx, dword [rax + 4]
mov eax, 6
cmp qword [rbp + rcx + 0x178], 0
cmovne eax, ebx
or eax, dword [rbp + rcx + 0x140]
and eax, 0x17
mov dword [rbp + rcx + 0x140], eax
and eax, dword [rbp + rcx + 0x144]
jne 0x180006904
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], 0
mov ecx, 0x20
call fcn.18000b110
mov qword [rsp + 0x70], 0x10
mov qword [rsp + 0x78], 0x1f
movups xmm0, xmmword [0x1800520c8]
movups xmmword [rax], xmm0
mov byte [rax + 0x10], 0
mov qword [rsp + 0x60], rax
mov qword [rbp - 0x18], r15
mov qword [rbp - 8], r15
mov qword [rbp], 7
mov word [rbp - 0x18], r15w
mov r8d, 0x15
lea rdx, str.SeLoadDriverPrivilege
lea rcx, [rbp - 0x18]
call fcn.180008c70
nop
mov qword [rbp - 0x80], r15
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp - 0x80]
mov edx, 0x28
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x1800061b8
mov bl, 1
jmp 0x180006224
mov qword [rbp + 8], r15
lea rdx, [rbp - 0x18]
cmp qword [rbp], 8
cmovae rdx, qword [rbp - 0x18]
lea r8, [rbp + 8]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x1800061de
mov bl, 1
jmp 0x180006224
mov dword [rbp + 0x30], 1
mov rax, qword [rbp + 8]
mov qword [rbp + 0x34], rax
mov dword [rbp + 0x3c], ebx
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
mov r9d, 0x10
lea r8, [rbp + 0x30]
xor edx, edx
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x180006218
mov bl, 1
jmp 0x180006224
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor bl, bl
mov rdx, qword [rbp]
cmp rdx, 8
jb 0x180006264
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000625f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006954
call fcn.18000b108
mov qword [rbp - 8], r15
mov qword [rbp], 7
mov word [rbp - 0x18], r15w
test bl, bl
je 0x180006281
mov ebx, r15d
jmp 0x1800067df
lea rax, [rbp - 0x78]
mov qword [rbp + 0x2a0], rax
mov r14, qword [rbp - 0x28]
lea r15, [rbp - 0x38]
cmp qword [rbp - 0x20], 0x10
cmovae r15, qword [rbp - 0x38]
call fcn.18002b134
mov r12d, eax
xor eax, eax
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x60], 7
mov word [rbp - 0x78], ax
mov dword [rsp + 0x30], 0x24
test r14, r14
je 0x180006335
cmp r14, 0x7fffffff
ja 0x18000695a
mov dword [rsp + 0x20], eax
xor r9d, r9d
mov r8d, r14d
mov rdx, r15
mov ecx, r12d
call fcn.18002b15c
mov rbx, rax
shr rax, 0x20
test eax, eax
jne 0x180006960
xor r8d, r8d
movsxd rdx, ebx
lea rcx, [rbp - 0x78]
call fcn.1800084d0
lea r9, [rbp - 0x78]
cmp qword [rbp - 0x60], 8
cmovae r9, qword [rbp - 0x78]
mov dword [rsp + 0x20], ebx
mov r8d, r14d
mov rdx, r15
mov ecx, r12d
call fcn.18002b15c
shr rax, 0x20
test eax, eax
jne 0x180006968
xor r15d, r15d
mov qword [rbp + 0x10], r15
movdqa xmm0, xmmword [0x180052180]
movdqu xmmword [rbp + 0x20], xmm0
mov word [rbp + 0x10], r15w
mov dword [rsp + 0x30], 0x5c
lea rdx, [rbp - 0x78]
lea rcx, [rbp + 0x10]
call fcn.180005bc0
test eax, eax
jne 0x180006970
lea rdx, [rbp + 0x98]
lea rcx, [rbp + 0x10]
call fcn.180005180
nop
mov r8, rax
lea rcx, [rbp + 0x78]
call fcn.180009530
mov rbx, rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x50], 0xf
mov byte [rsp + 0x38], r15b
lea r8d, [r15 + 0x22]
lea rdx, str.SystemCurrentControlSetServices_
lea rcx, [rsp + 0x38]
call fcn.1800017e0
nop
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae rdx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.180008fc0
lea rdx, [rsp + 0x38]
cmp qword [rsp + 0x50], 0x10
cmovae rdx, qword [rsp + 0x38]
lea r8, [rsp + 0x58]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x180006444
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x18000643d
inc rdx
mov rcx, qword [rsp + 0x38]
cmp rdx, 0x1000
mov rax, rcx
jb 0x180006438
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006983
call fcn.18000b108
xor bl, bl
jmp 0x18000656b
mov byte [rbp + 0x2a0], 1
mov dword [rsp + 0x28], edi
lea rax, [rbp + 0x2a0]
mov qword [rsp + 0x20], rax
mov r9d, edi
xor r8d, r8d
lea rdx, str.Type
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x180006400
mov byte [rbp + 0x298], 3
mov dword [rsp + 0x28], edi
lea rax, [rbp + 0x298]
mov qword [rsp + 0x20], rax
mov r9d, edi
xor r8d, r8d
lea rdx, str.ErrorControl
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x180006400
mov byte [rbp + 0x2a8], 3
mov dword [rsp + 0x28], edi
lea rax, [rbp + 0x2a8]
mov qword [rsp + 0x20], rax
mov r9d, edi
xor r8d, r8d
lea rdx, str.Start
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x180006400
mov eax, dword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x1800064f2
mov rbx, qword [rbx]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
lea rdx, str.ImagePath
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x180006400
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
sete bl
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x18000656b
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006566
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006983
call fcn.18000b108
mov byte [rsp + 0x38], 0
mov qword [rsp + 0x50], 0xf
mov qword [rsp + 0x48], r15
mov rdx, qword [rbp + 0x90]
cmp rdx, 0x10
jb 0x1800065bc
inc rdx
mov rcx, qword [rbp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800065b7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006989
call fcn.18000b108
mov qword [rbp + 0x88], r15
mov qword [rbp + 0x90], 0xf
mov byte [rbp + 0x78], 0
mov rdx, qword [rbp + 0xb0]
cmp rdx, 0x10
jb 0x180006613
inc rdx
mov rcx, qword [rbp + 0x98]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000660e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000698f
call fcn.18000b108
mov qword [rbp + 0xa8], r15
mov qword [rbp + 0xb0], 0xf
mov byte [rbp + 0x98], 0
mov edi, 0x1c
mov dword [rsp + 0x30], edi
mov rdx, qword [rbp + 0x28]
cmp rdx, 8
jb 0x180006675
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006670
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180006995
call fcn.18000b108
movdqa xmm0, xmmword [0x180052180]
movdqu xmmword [rbp + 0x20], xmm0
mov word [rbp + 0x10], r15w
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x1800066c7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800066c2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000699b
call fcn.18000b108
movdqa xmm0, xmmword [0x180052180]
movdqu xmmword [rbp - 0x68], xmm0
mov word [rbp - 0x78], r15w
test bl, bl
jne 0x1800066e5
mov ebx, r15d
jmp 0x1800067d8
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x48], r15
mov qword [rbp - 0x40], 0xf
mov byte [rbp - 0x58], 0
mov r8d, 0x34
lea rdx, str.RegistryMachineSystemCurrentControlSetServices_
lea rcx, [rbp - 0x58]
call fcn.1800017e0
nop
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae rdx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x70]
lea rcx, [rbp - 0x58]
call fcn.180008fc0
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae rdx, qword [rsp + 0x60]
lea rcx, [0x1800520c0]
call fcn.1800023b0
lea rdx, [rbp - 0x58]
cmp qword [rbp - 0x40], 0x10
cmovae rdx, qword [rbp - 0x58]
lea rcx, [rbp + 0xd8]
call qword [sym.imp.ntdll.dll_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rbp + 0xd8]
lea rcx, [rbp + 0xe8]
call qword [sym.imp.ntdll.dll_RtlAnsiStringToUnicodeString]
lea rcx, [rbp + 0xe8]
call qword [sym.imp.ntdll.dll_NtLoadDriver]
mov ebx, eax
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x1800067c8
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800067c3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000699b
call fcn.18000b108
mov qword [rbp - 0x48], r15
mov qword [rbp - 0x40], 0xf
mov byte [rbp - 0x58], 0
mov r14, qword [rbp + 0x290]
mov dword [r14], ebx
lea rcx, [r14 + 8]
mov qword [rcx], r15
mov qword [rcx + 0x10], r15
mov qword [rcx + 0x18], 0xf
mov byte [rcx], 0
mov r8d, 0x10
lea rdx, [0x1800520c8]
call fcn.1800017e0
or edi, 2
mov dword [rsp + 0x30], edi
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x18000684e
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006849
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800069a1
call fcn.18000b108
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], 0
lea rcx, [rbp + 0x130]
call fcn.180005e10
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x1800068a6
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800068a0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800068ec
call fcn.18000b108
nop
sub r13, rsi
cmp r13, 0x1000
jb 0x1800068ca
add r13, 0x27
mov rcx, qword [rsi - 8]
sub rsi, rcx
lea rax, [rsi - 8]
cmp rax, 0x1f
ja 0x1800068f2
mov rsi, rcx
mov rdx, r13
mov rcx, rsi
call fcn.18000b108
mov rax, r14
add rsp, 0x348
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.1800112d8
nop
call fcn.1800112d8
nop
call fcn.1800112d8
nop
call fcn.1800112d8
nop
test al, 4
je 0x180006911
lea rdx, str.ios_base::badbit_set
jmp 0x180006925
test bl, al
lea rdx, str.ios_base::failbit_set
lea rax, str.ios_base::eofbit_set
cmove rdx, rax
lea rcx, [rbp + 0xf8]
call fcn.1800040d0
mov r8, rax
lea rcx, [rbp + 0x108]
call fcn.180004b50
lea rdx, [0x1800577a8]
lea rcx, [rbp + 0x108]
call fcn.18000bdb8
nop
call fcn.1800112d8
nop
call fcn.1800043c0
int3
mov ecx, eax
call fcn.180005140
int3
mov ecx, eax
call fcn.180005140
nop
lea r8, [rbp - 0x78]
mov edx, eax
lea rcx, str.absolute
call fcn.180005af0
nop
call fcn.1800112d8
nop
call fcn.1800112d8
nop
call fcn.1800112d8
nop
call fcn.1800112d8
nop
call fcn.1800112d8
nop
call fcn.1800112d8
int3