Function at 0x140015160
Capabilities:
Persist via windows service
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x178]
sub rsp, 0x250
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x14005c080]
xor rax, rsp
mov qword [rbp + 0x130], rax
mov r14, rcx
xor esi, esi
mov rdi, qword [rcx + 0x10]
mov rbx, rcx
cmp qword [rcx + 0x18], 0xf
jbe 0x1400151b1
mov rbx, qword [rcx]
call fcn.140018fc8
mov qword [rbp + 0x90], rbx
mov qword [rbp + 0x98], rdi
lea r8, [rbp + 0x90]
mov edx, eax
lea rcx, [rsp + 0x60]
call fcn.140014ed0
nop
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 7
cmova rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x70]
lea r11, [rcx + rax*2]
mov r10, r11
mov rdx, r11
call fcn.140015040
cmp rax, r11
je 0x14001521d
lea rdx, [r10 - 2]
movzx ecx, word [rdx]
cmp cx, 0x5c
je 0x14001521d
cmp cx, 0x2f
je 0x14001521d
mov r10, rdx
cmp rax, rdx
jne 0x140015202
sub r11, r10
sar r11, 1
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rsi
mov r8, r11
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.14000b940
nop
lea rdx, [rbp + 0x60]
lea rcx, [rsp + 0x30]
call fcn.14000ee70
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x140015297
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140015292
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140015db5
call fcn.140019650
movdqa xmm0, xmmword [0x140054760]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x30], si
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x1400152ec
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400152e7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140015dbb
call fcn.140019650
movdqa xmm0, xmmword [0x140054760]
movdqu xmmword [rsp + 0x70], xmm0
mov word [rsp + 0x60], si
mov r13, qword [rbp + 0x70]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r13
cmp rax, 0x22
jb 0x140015dc1
lea r12, [rbp + 0x60]
cmp qword [rbp + 0x78], 0xf
cmova r12, qword [rbp + 0x60]
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x50], xmm1
lea r15, [r13 + 0x22]
mov ebx, 0xf
mov edi, ebx
lea rsi, [rbp + 0x40]
movabs rax, 0x8000000000000000
lea edx, [rbx + 7]
cmp r15, rbx
jbe 0x1400153c4
mov rdi, r15
or rdi, rbx
cmp rdi, rcx
jbe 0x14001538c
mov rdi, rcx
add rax, 0x27
mov rcx, rax
call fcn.140019a1c
test rax, rax
je 0x140015ddf
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x1400153c0
cmp rdi, rdx
cmovb rdi, rdx
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x1400153af
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140015da9
jmp 0x14001536d
test rcx, rcx
je 0x1400153be
call fcn.140019a1c
mov rsi, rax
jmp 0x1400153c0
xor esi, esi
mov qword [rbp + 0x40], rsi
mov qword [rbp + 0x50], r15
mov qword [rbp + 0x58], rdi
movups xmm0, xmmword [str.SYSTEMCurrentControlSetServices_]
movups xmmword [rsi], xmm0
movups xmm1, xmmword [0x140054678]
movups xmmword [rsi + 0x10], xmm1
movzx eax, word [0x140054688]
mov word [rsi + 0x20], ax
lea rcx, [rsi + 0x22]
mov r8, r13
mov rdx, r12
call fcn.14003d530
mov byte [rsi + r15], 0
mov r15, qword [r14 + 0x10]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r15
cmp rax, 4
jb 0x140015dc7
cmp qword [r14 + 0x18], 0xf
jbe 0x140015428
mov r14, qword [r14]
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x30], xmm1
lea rsi, [r15 + 4]
lea rdi, [rbp + 0x20]
cmp rsi, 0xf
jbe 0x1400154bf
mov rbx, rsi
or rbx, 0xf
cmp rbx, rcx
jbe 0x140015481
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140019a1c
test rax, rax
je 0x140015dcd
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400154bb
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x1400154aa
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140015daf
jmp 0x140015462
test rcx, rcx
je 0x1400154b9
call fcn.140019a1c
mov rdi, rax
jmp 0x1400154bb
xor edi, edi
mov qword [rbp + 0x20], rdi
mov qword [rbp + 0x30], rsi
mov qword [rbp + 0x38], rbx
mov dword [rdi], 0x5c3f3f5c
lea rcx, [rdi + 4]
mov r8, r15
mov rdx, r14
call fcn.14003d530
mov byte [rdi + rsi], 0
lea rdx, [rbp + 0x40]
cmp qword [rbp + 0x58], 0xf
cmova rdx, qword [rbp + 0x40]
lea r8, [rbp - 0x10]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x1400156c2
movabs rax, 0x6e8ede258da0ab45
mov qword [rbp + 0x90], rax
movabs rax, 0xf782ce2c0b39408e
mov qword [rbp + 0x98], rax
movabs rax, 0x9ecb30eb6ae8cc37
mov qword [rbp + 0xa0], rax
movabs rax, 0x4bfd85e2d9cf2940
mov qword [rbp + 0xa8], rax
movabs rax, 0x49e0bf66adfd861e
mov qword [rsp + 0x30], rax
movabs rax, 0x92f6af49795a60fa
mov qword [rsp + 0x38], rax
movabs rax, 0xfba8599d188dbf17
mov qword [rsp + 0x40], rax
movabs rax, 0x4bfd85e8a0aa4260
mov qword [rsp + 0x48], rax
movups xmm0, xmmword [rsp + 0x30]
movups xmm1, xmmword [rsp + 0x40]
xorps xmm0, xmmword [rbp + 0x90]
movdqa xmmword [rsp + 0x30], xmm0
xorps xmm1, xmmword [rbp + 0xa0]
movdqa xmmword [rsp + 0x40], xmm1
lea rcx, [rsp + 0x30]
call fcn.140001280
xor bl, bl
mov rdx, qword [rbp + 0x38]
cmp rdx, 0xf
jbe 0x1400155f2
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400155ed
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140015dcd
call fcn.140019650
movdqa xmm0, xmmword [0x140054770]
movdqu xmmword [rbp + 0x30], xmm0
mov byte [rbp + 0x20], 0
mov rdx, qword [rbp + 0x58]
cmp rdx, 0xf
jbe 0x14001563e
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140015639
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140015ddf
call fcn.140019650
movdqa xmm0, xmmword [0x140054770]
movdqu xmmword [rbp + 0x50], xmm0
mov byte [rbp + 0x40], 0
mov rdx, qword [rbp + 0x78]
cmp rdx, 0xf
jbe 0x14001568a
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140015685
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140015da3
call fcn.140019650
movzx eax, bl
mov rcx, qword [rbp + 0x130]
xor rcx, rsp
call fcn.140019630
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
lea rcx, [rbp + 0x20]
cmp qword [rbp + 0x38], 0xf
cmova rcx, qword [rbp + 0x20]
mov eax, dword [rbp + 0x30]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 2
lea r8, str.ImagePath
xor edx, edx
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueA]
mov rcx, qword [rbp - 0x10]
test eax, eax
je 0x140015807
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movabs rax, 0x6e8ede258da0ab45
mov qword [rbp + 0x90], rax
movabs rax, 0xf782ce2c0b39408e
mov qword [rbp + 0x98], rax
movabs rax, 0x9ecb30eb6ae8cc37
mov qword [rbp + 0xa0], rax
movabs rax, 0x4bfd85e2d9cf2940
mov qword [rbp + 0xa8], rax
movabs rax, 0x735a8a019bf8b149
mov qword [rbp + 0xb0], rax
movabs rcx, 0xa23277b8723e7b32
movabs rax, 0x49e0bf66adfd861e
mov qword [rsp + 0x30], rax
movabs rax, 0x92f6af49795a60fa
mov qword [rsp + 0x38], rax
movabs rax, 0xceae578a07a1eb17
mov qword [rsp + 0x40], rax
movabs rax, 0x2c98f7c2fea75d21
mov qword [rsp + 0x48], rax
movabs rax, 0x122caa78e98cc220
mov qword [rsp + 0x50], rax
movabs rax, 0xa23277b8785b0e5e
mov qword [rsp + 0x58], rax
mov qword [rbp + 0xb8], rcx
movups xmm0, xmmword [rsp + 0x30]
movups xmm1, xmmword [rsp + 0x40]
movups xmm2, xmmword [rsp + 0x50]
xorps xmm0, xmmword [rbp + 0x90]
movdqa xmmword [rsp + 0x30], xmm0
xorps xmm1, xmmword [rbp + 0xa0]
movdqa xmmword [rsp + 0x40], xmm1
xorps xmm2, xmmword [rbp + 0xb0]
movdqa xmmword [rsp + 0x50], xmm2
lea rcx, [rsp + 0x30]
jmp 0x1400155b0
mov dword [rsp + 0x28], 4
lea rax, [0x140054750]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, str.Type
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueA]
mov rcx, qword [rbp - 0x10]
test eax, eax
je 0x1400158f6
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movabs rax, 0x6e8ede258da0ab45
mov qword [rbp + 0x90], rax
movabs rax, 0xf782ce2c0b39408e
mov qword [rbp + 0x98], rax
movabs rax, 0x9ecb30eb6ae8cc37
mov qword [rbp + 0xa0], rax
movabs rax, 0x4bfd85e2d9cf2940
mov qword [rbp + 0xa8], rax
movabs rax, 0x735a8a019bf8b149
mov qword [rbp + 0xb0], rax
movabs rcx, 0xa23277b8723e7b32
movabs rax, 0x49e0bf66adfd861e
mov qword [rsp + 0x30], rax
movabs rax, 0x92f6af49795a60fa
mov qword [rsp + 0x38], rax
movabs rax, 0xbeec559b13bceb17
mov qword [rsp + 0x40], rax
movabs rax, 0x328ff191b0a84c32
mov qword [rsp + 0x48], rax
movabs rax, 0x7350ef74f799c769
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rcx
jmp 0x1400157c0
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [0x14004bc78]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdi, rax
test rax, rax
je 0x1400155b5
lea rdx, str.RtlAdjustPrivilege
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rdx, str.NtLoadDriver
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
lea r9, [rbp - 8]
xor r8d, r8d
mov dl, 1
lea ecx, [r8 + 0xa]
call rbx
test eax, eax
jns 0x140015b73
movabs rax, 0x6e8ede258da0ab45
mov qword [rbp + 0xc0], rax
movabs rax, 0xf782ce2c0b39408e
mov qword [rbp + 0xc8], rax
movabs rax, 0x9ecb30eb6ae8cc37
mov qword [rbp + 0xd0], rax
movabs rax, 0x4bfd85e2d9cf2940
mov qword [rbp + 0xd8], rax
movabs rax, 0x735a8a019bf8b149
mov qword [rbp + 0xe0], rax
movabs rcx, 0xa23277b8723e7b32
mov qword [rbp + 0xe8], rcx
movabs rax, 0xea172d57be88449b
mov qword [rbp + 0xf0], rax
movabs rax, 0x19068eeea0cab684
mov qword [rbp + 0xf8], rax
movabs rax, 0x3874347dbfc3c18d
mov qword [rbp + 0x100], rax
movabs rax, 0x660b49a4ae31b0b6
mov qword [rbp + 0x108], rax
movabs rax, 0x49564463c252bdbf
mov qword [rbp + 0x110], rax
movabs rax, 0xba6a651a020bd228
mov qword [rbp + 0x118], rax
movabs rax, 0x64f6cb3975cf5451
mov qword [rbp + 0x120], rax
movabs rcx, 0x653e0e102c57f1da
mov qword [rbp + 0x128], rcx
movabs rax, 0x1cebfe49ecd4ca03
mov qword [rbp - 0x80], rax
movabs rax, 0x9ee3a80c314b2ffc
mov qword [rbp - 0x78], rax
movabs rax, 0xffeb5f9f4a8ca95b
mov qword [rbp - 0x70], rax
movabs rax, 0x18dde090b0ba5823
mov qword [rbp - 0x68], rax
movabs rax, 0x3705ce40d4b4ee0c
mov qword [rbp - 0x60], rax
movabs rax, 0xf06228ea37683260
mov qword [rbp - 0x58], rax
movabs rax, 0xc4526a12f2c112d2
mov qword [rbp - 0x50], rax
movabs rax, 0x6c75ae8bcbabfba4
mov qword [rbp - 0x48], rax
movabs rax, 0x59544112c6e3a4ff
mov qword [rbp - 0x40], rax
movabs rax, 0xf6527d1dc11d5c4
mov qword [rbp - 0x38], rax
movabs rax, 0x2d376410a372dad1
mov qword [rbp - 0x30], rax
movabs rax, 0xdb1811696b65bb45
mov qword [rbp - 0x28], rax
movabs rax, 0x64f6cb335bbd3b25
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rcx
movups xmm0, xmmword [rbp - 0x80]
movups xmm1, xmmword [rbp - 0x70]
movups xmm2, xmmword [rbp - 0x60]
movups xmm3, xmmword [rbp - 0x50]
movups xmm4, xmmword [rbp - 0x40]
movups xmm5, xmmword [rbp - 0x30]
movups xmm6, xmmword [rbp - 0x20]
xorps xmm0, xmmword [rbp + 0xc0]
movdqa xmmword [rbp - 0x80], xmm0
xorps xmm1, xmmword [rbp + 0xd0]
movdqa xmmword [rbp - 0x70], xmm1
xorps xmm2, xmmword [rbp + 0xe0]
movdqa xmmword [rbp - 0x60], xmm2
xorps xmm3, xmmword [rbp + 0xf0]
movdqa xmmword [rbp - 0x50], xmm3
xorps xmm4, xmmword [rbp + 0x100]
movdqa xmmword [rbp - 0x40], xmm4
xorps xmm5, xmmword [rbp + 0x110]
movdqa xmmword [rbp - 0x30], xmm5
xorps xmm6, xmmword [rbp + 0x120]
movdqa xmmword [rbp - 0x20], xmm6
lea rcx, [rbp - 0x80]
jmp 0x1400155b0
lea r8, [rbp + 0x60]
cmp qword [rbp + 0x78], 0xf
cmova r8, qword [rbp + 0x60]
add r8, qword [rbp + 0x70]
lea rdx, [rbp + 0x60]
cmp qword [rbp + 0x78], 0xf
cmova rdx, qword [rbp + 0x60]
lea rcx, [rbp]
call fcn.1400162e0
nop
lea r8, [rbp]
lea rdx, str.RegistryMachineSystemCurrentControlSetServices_
lea rcx, [rsp + 0x30]
call fcn.14000b260
mov rbx, rax
lea rax, [rbp]
cmp rax, rbx
je 0x140015c31
mov rdx, qword [rbp + 0x18]
cmp rdx, 7
jbe 0x140015bfe
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140015bf9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140015dd3
call fcn.140019650
movdqa xmm0, xmmword [0x140054760]
movdqu xmmword [rbp + 0x10], xmm0
xor esi, esi
mov word [rbp], si
movups xmm0, xmmword [rbx]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x10], xmm1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 7
mov word [rbx], si
jmp 0x140015c33
xor esi, esi
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x140015c75
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140015c70
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140015dd3
call fcn.140019650
lea rdx, [rbp]
cmp qword [rbp + 0x18], 7
cmova rdx, qword [rbp]
lea rcx, [rbp + 0x80]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rcx, [rbp + 0x80]
call rdi
mov ebx, eax
movabs rax, 0x6e8ede258da0ab45
mov qword [rbp + 0x90], rax
movabs rax, 0xf782ce2c0b39408e
mov qword [rbp + 0x98], rax
movabs rax, 0x9ecb30eb6ae8cc37
mov qword [rbp + 0xa0], rax
movabs rax, 0x4bfd85e2d9cf2940
mov qword [rbp + 0xa8], rax
movabs rax, 0x1c2aa6badfd801e
mov qword [rsp + 0x30], rax
movabs rax, 0x85e7b845797d24ef
mov qword [rsp + 0x38], rax
movabs rax, 0xbeb8459f0b9c9f17
mov qword [rsp + 0x40], rax
movabs rax, 0x4bfd8f9ab5ea5170
mov qword [rsp + 0x48], rax
movups xmm0, xmmword [rsp + 0x30]
movups xmm1, xmmword [rsp + 0x40]
xorps xmm0, xmmword [rbp + 0x90]
movdqa xmmword [rsp + 0x30], xmm0
xorps xmm1, xmmword [rbp + 0xa0]
movdqa xmmword [rsp + 0x40], xmm1
mov edx, ebx
lea rcx, [rsp + 0x30]
call fcn.140001280
shr ebx, 0x1f
xor bl, 1
mov rdx, qword [rbp + 0x18]
cmp rdx, 7
jbe 0x140015d8d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140015d88
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140015dd9
call fcn.140019650
movdqa xmm0, xmmword [0x140054760]
movdqu xmmword [rbp + 0x10], xmm0
mov word [rbp], si
jmp 0x1400155b7
call fcn.140023400
nop
call fcn.140001ca0
nop
call fcn.140001ca0
nop
call fcn.140023400
nop
call fcn.140023400
int3
call fcn.140001d40
nop
call fcn.140001d40
int3
call fcn.140023400
nop
call fcn.140023400
nop
call fcn.140023400
nop
call fcn.140023400
int3