Function at 0x140017550
Capabilities:
Create thread
Persist via windows service
Query or enumerate registry value
Set registry value
Terminate thread

Disassembly:
jmp 0x140017550
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x68
mov r15d, ecx
xor r14d, r14d
mov r13d, 3
mov qword [rsp + 0x30], r14
mov rbx, rcx
shr r15d, 8
mov esi, 1
mov dword [rsp + 0x28], r14d
xor r9d, r9d
mov dword [rsp + 0x20], r13d
mov r8d, r13d
lea rcx, str..IBMPmDrv
mov edx, 0xc0000000
and r15d, 0xf
mov edi, esi
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x14001798d
lea eax, [r15 - 1]
cmp eax, esi
cmovbe r15d, r13d
cmp dword [0x1400b878c], r14d
movzx r13d, byte [rbp + 0x48]
je 0x1400176a6
lea ecx, [r13 - 1]
mov r14d, esi
shl r14d, cl
test r14d, r14d
je 0x1400176a3
mov eax, ebx
and eax, 0xff00
cmp eax, 0x1000
jne 0x1400176a3
lea rax, [rbp - 0x18]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMCurrentControlSetServicesIBMPMSVCParametersNotification
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400176a3
mov rcx, qword [rbp - 0x18]
lea rax, [rbp + 0x58]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x60]
lea rax, [rbp + 0x50]
mov dword [rbp + 0x58], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
mov dword [rbp + 0x60], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [rbp + 0x50]
test eax, r14d
je 0x140017668
not r14d
and eax, r14d
jmp 0x14001766b
or eax, r14d
mov r9d, dword [rbp + 0x60]
xor r8d, r8d
mov rcx, qword [rbp - 0x18]
xor edx, edx
mov dword [rbp + 0x50], eax
mov eax, dword [rbp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor r14d, r14d
mov edi, r14d
jmp 0x1400176a6
xor r14d, r14d
cmp dword [rbp + 0x4c], 0
jne 0x14001798d
lea ecx, [r13 - 1]
mov eax, esi
shl eax, cl
and eax, 0x804
test dword [0x1400b8798], eax
je 0x1400176d7
mov eax, ebx
and eax, 0xff00
cmp eax, 0x1000
je 0x14001798d
mov qword [rsp + 0x38], r14
lea rax, [rbp - 0x24]
mov qword [rsp + 0x30], rax
lea r8, [rbp - 0x20]
lea rax, [rbp - 0x28]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
mov edx, 0x222434
mov dword [rbp - 0x20], r14d
mov rcx, r12
mov dword [rbp - 0x28], r14d
mov dword [rbp - 0x24], r14d
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
cmp dword [rbp - 0x28], 0x200
jne 0x1400178f1
mov rax, qword [rbp + 0x48]
movzx ecx, al
and eax, 0xff00
cmp eax, 0x1100
je 0x140017814
cmp eax, 0x1300
jne 0x1400178f1
cmp dword [0x1400b84f0], 0
je 0x14001798d
dec ecx
shl esi, cl
test esi, esi
je 0x14001798d
lea rax, [rbp - 0x18]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMCurrentControlSetServicesIBMPMSVCParameters2Type10Notification
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14001798d
mov rcx, qword [rbp - 0x18]
lea rax, [rbp + 0x58]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x60]
lea rax, [rbp + 0x50]
mov dword [rbp + 0x58], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.Type13
mov dword [rbp + 0x60], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [rbp + 0x50]
test eax, esi
je 0x1400177d5
not esi
and eax, esi
jmp 0x1400177d7
or eax, esi
mov r9d, dword [rbp + 0x60]
lea rdx, str.Type13
mov rcx, qword [rbp - 0x18]
xor r8d, r8d
mov dword [rbp + 0x50], eax
mov eax, dword [rbp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, r14d
jmp 0x14001798d
cmp dword [0x1400b879c], 0
je 0x14001798d
dec ecx
shl esi, cl
test esi, esi
je 0x14001798d
and ebx, 0xff00
cmp ebx, 0x1100
jne 0x14001798d
lea rax, [rbp - 0x18]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMCurrentControlSetServicesIBMPMSVCParameters2Type10Notification
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14001798d
mov rcx, qword [rbp - 0x18]
lea rax, [rbp + 0x58]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x60]
lea rax, [rbp + 0x50]
mov dword [rbp + 0x58], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.Type12
mov dword [rbp + 0x60], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [rbp + 0x50]
test eax, esi
je 0x1400178b2
not esi
and eax, esi
jmp 0x1400178b4
or eax, esi
mov r9d, dword [rbp + 0x60]
lea rdx, str.Type12
mov rcx, qword [rbp - 0x18]
xor r8d, r8d
mov dword [rbp + 0x50], eax
mov eax, dword [rbp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, r14d
jmp 0x14001798d
and ebx, 0xfffff0ff
cmp ebx, 0x5001
ja 0x140017aec
je 0x140017ad5
cmp ebx, 0x3003
ja 0x140017a18
je 0x140017a50
cmp ebx, 0x2005
ja 0x14001797e
cmp ebx, 0x2004
jae 0x14001796d
sub ebx, 0x15
je 0x14001795e
sub ebx, 0xfee
je 0x140017947
cmp ebx, 9
jne case.0x140017c54.24599
call fcn.14000461a
mov edi, r14d
jmp 0x14001798d
cmp dword [0x1400b8200], 0
jne 0x140017a10
call fcn.140002761
mov edi, r14d
jmp 0x14001798d
mov ecx, 0x15
call fcn.140003fc1
mov edi, r14d
jmp 0x14001798d
mov r8d, r15d
xor edx, edx
mov ecx, esi
call fcn.140002a45
mov edi, r14d
jmp 0x14001798d
sub ebx, 0x2013
je 0x1400179ae
cmp ebx, 0xd
je 0x14001798d
mov edi, esi
test r12, r12
je 0x14001799b
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140003828
test al, al
je 0x140017a0b
cmp dword [0x1400b81fc], 0
jne 0x1400179d5
call fcn.140001c4e
mov edi, r14d
jmp 0x14001798d
mov ebx, r14d
nop dword [rax + rax]
movzx edx, sil
movzx r8d, sil
movzx ecx, dl
call fcn.14000450c
test al, al
jne 0x140017a10
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 3
jl 0x1400179e0
mov edi, r14d
jmp 0x14001798d
call fcn.140003800
mov edi, r14d
jmp 0x14001798d
cmp ebx, 0x4011
ja 0x140017a8d
je 0x140017a76
sub ebx, 0x3006
je 0x140017a64
sub ebx, 0xffd
je 0x140017a50
cmp ebx, 0xd
jne case.0x140017c54.24599
lea ecx, [rbx - 2]
call fcn.140003fc1
call fcn.140004318
mov edi, r14d
jmp 0x14001798d
xor r8d, r8d
mov edx, esi
xor ecx, ecx
call fcn.140002a45
mov edi, r14d
jmp 0x14001798d
mov ecx, 8
call fcn.140003fc1
mov edi, r14d
jmp 0x14001798d
mov ecx, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
call fcn.140003fc1
call fcn.140004318
mov edi, r14d
jmp 0x14001798d
sub ebx, 0x4012
je 0x140017ab9
cmp ebx, esi
jne case.0x140017c54.24599
call fcn.14000349a
call fcn.140003431
mov ecx, 4
call fcn.140001668
mov edi, r14d
jmp 0x14001798d
call fcn.1400022d9
call fcn.140003431
mov ecx, 3
call fcn.140001668
mov edi, r14d
jmp 0x14001798d
mov ecx, 5
call fcn.140003fc1
call fcn.140001d70
mov edi, r14d
jmp 0x14001798d
cmp ebx, 0x6000
ja 0x140017c17
je 0x140017c05
add ebx, 0xffffaffe
cmp ebx, 0x2e
ja case.0x140017c54.24599
lea rdx, [0x140000000]
movzx eax, byte [rdx + rbx + 0x17ef8]
mov ecx, dword [rdx + rax*4 + 0x17ec4]
add rcx, rdx
jmp rcx
mov ecx, 6
call fcn.140003fc1
xor ecx, ecx
call fcn.140002bc1
mov edi, r14d
jmp 0x14001798d
xor ecx, ecx
call fcn.140002464
mov edi, r14d
jmp 0x14001798d
mov ecx, esi
call fcn.140002464
mov edi, r14d
jmp 0x14001798d
xor ecx, ecx
call fcn.140002bd0
mov edi, r14d
jmp 0x14001798d
mov ecx, 2
call fcn.140003fc1
mov edi, r14d
jmp 0x14001798d
mov ecx, 3
call fcn.140003fc1
mov edi, r14d
jmp 0x14001798d
mov ecx, 0xa
call fcn.140003fc1
mov edi, r14d
jmp 0x14001798d
mov ecx, 0xf
call fcn.140003fc1
mov edi, r14d
jmp 0x14001798d
mov ecx, 0x1c
call fcn.140003fc1
call fcn.140001fd2
mov edi, r14d
jmp 0x14001798d
mov ecx, 0x1d
call fcn.140003fc1
call fcn.140001c26
mov edi, r14d
jmp 0x14001798d
mov ecx, 2
call fcn.140001668
mov edi, r14d
jmp 0x14001798d
mov ecx, esi
call fcn.140001668
mov edi, r14d
jmp 0x14001798d
mov ecx, 0xd
call fcn.140003fc1
mov edi, r14d
jmp 0x14001798d
cmp ebx, 0x7000
ja case.0x140017c54.24599
je 0x140017eb4
add ebx, 0xffff9fff
cmp ebx, 0xef
ja case.0x140017c54.24599
lea rdx, [0x140000000]
movzx eax, byte [rdx + rbx + 0x17f84]
mov ecx, dword [rdx + rax*4 + 0x17f28]
add rcx, rdx
jmp rcx
cmp qword [0x1400b8790], 0
je case.0x140017c54.24582
cmp dword [0x1400b8200], 0
jne case.0x140017c54.24582
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
call qword [sym.imp.USER32.dll_GetThreadDesktop]
xor edx, edx
xor ecx, ecx
mov r8d, 0x1ff
mov rdi, rax
call qword [sym.imp.USER32.dll_OpenInputDesktop]
mov rbx, rax
test rax, rax
je 0x140017ca3
mov rcx, rax
call qword [sym.imp.USER32.dll_SetThreadDesktop]
lea rdx, str.Warning
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140017cca
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 0x10]
call qword [sym.imp.USER32.dll_SendMessageA]
mov rcx, qword [0x1400b8790]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [0x1400b8790]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
mov qword [0x1400b8790], r14
call qword [sym.imp.USER32.dll_SetThreadDesktop]
mov rcx, rbx
call qword [sym.imp.USER32.dll_CloseDesktop]
call fcn.140003549
mov edi, r14d
jmp 0x14001798d
call fcn.140004034
test eax, eax
je 0x140017d42
lea rax, [rbp - 0x1c]
mov dword [rbp - 0x1c], r14d
mov qword [rsp + 0x28], rax
lea r8, [0x1400023ba]
xor r9d, r9d
mov dword [rsp + 0x20], r14d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x1400b8790], rax
mov edi, r14d
jmp 0x14001798d
mov ecx, 9
call fcn.140003fc1
mov edi, r14d
jmp 0x14001798d
mov ecx, 0xe
call fcn.140003fc1
mov edi, r14d
jmp 0x14001798d
mov ecx, 0x10
call fcn.140003fc1
mov edi, r14d
jmp 0x14001798d
mov ecx, 0x11
call fcn.140003fc1
mov edi, r14d
jmp 0x14001798d
mov ecx, 0x12
call fcn.140003fc1
mov edi, r14d
jmp 0x14001798d
mov ecx, 8
call fcn.140001668
mov edi, r14d
jmp 0x14001798d
mov ecx, 0x13
call fcn.140003fc1
mov edi, r14d
jmp 0x14001798d
mov ecx, 0x14
call fcn.140003fc1
mov edi, r14d
jmp 0x14001798d
mov ecx, 0x16
call fcn.140003fc1
mov edi, r14d
jmp 0x14001798d
mov ecx, 0x17
call fcn.140003fc1
mov edi, r14d
jmp 0x14001798d
mov ecx, 0x19
call fcn.140003fc1
mov edi, r14d
jmp 0x14001798d
mov ecx, 0x1a
call fcn.140003fc1
mov edi, r14d
jmp 0x14001798d
mov ecx, 0x1b
call fcn.140003fc1
mov edi, r14d
jmp 0x14001798d
mov ecx, 0x1e
call fcn.140003fc1
call fcn.1400014ab
call fcn.140004192
mov edi, r14d
jmp 0x14001798d
mov ecx, 0x1f
call fcn.140003fc1
mov edi, r14d
jmp 0x14001798d
mov ecx, 0x18
call fcn.140003fc1
mov edi, r14d
jmp 0x14001798d
mov ecx, 5
call fcn.140001668
mov edi, r14d
jmp 0x14001798d
mov ecx, 6
call fcn.140001668
call fcn.1400026d5
mov edi, r14d
jmp 0x14001798d
mov ecx, 7
call fcn.140001668
call fcn.140003607
mov edi, r14d
jmp 0x14001798d
mov ecx, esi
call fcn.140003fc1
mov edi, r14d
jmp 0x14001798d