Function at 0x40ea00
Capabilities:
Disable system features via registry on windows
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x411f55
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x422040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [ebp - 0x2c]
call fcn.00401240
mov ebx, 0x7ffffffe
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x1c]
mov eax, ebx
sub eax, ecx
cmp eax, 0x22
jb 0x40ee55
cmp dword [ebp - 0x18], 7
lea eax, [ebp - 0x2c]
push ecx
cmova eax, dword [ebp - 0x2c]
push eax
push 0x22
push str.SYSTEMCurrentControlSetServices_
push ecx
push dword [ebp - 0x84]
lea ecx, [ebp - 0x74]
call fcn.00409050
mov byte [ebp - 4], 1
mov eax, ebx
mov ecx, dword [esi + 0x10]
sub eax, ecx
cmp eax, 4
jb 0x40ee55
cmp dword [esi + 0x14], 7
jbe 0x40ea90
mov esi, dword [esi]
push ecx
push esi
push 4
push str.___
push ecx
push dword [ebp - 0x84]
lea ecx, [ebp - 0x44]
call fcn.00409050
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x80]
cmp dword [ebp - 0x60], 7
lea eax, [ebp - 0x74]
push ecx
cmova eax, dword [ebp - 0x74]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x40ead2
mov edx, str.____Cant_create_service_key
jmp 0x40eb0f
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x30], 7
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
lea ecx, [eax + eax]
push ecx
lea eax, [ebp - 0x44]
cmova eax, dword [ebp - 0x44]
push eax
push 2
push str.ImagePath
push 0
push dword [ebp - 0x80]
call esi
test eax, eax
je 0x40ebff
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, str.____Cant_create_ImagePath_registry_value
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.00406130
push 0x406100
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_______cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_____]
xor bl, bl
mov ecx, dword [ebp - 0x30]
cmp ecx, 7
jbe 0x40eb63
mov edx, dword [ebp - 0x44]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40eb59
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ebf9
push ecx
push edx
call fcn.0040fe5c
add esp, 8
mov ecx, dword [ebp - 0x60]
xor eax, eax
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 7
mov word [ebp - 0x44], ax
cmp ecx, 7
jbe 0x40ebad
mov edx, dword [ebp - 0x74]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40eba3
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ebf9
push ecx
push edx
call fcn.0040fe5c
add esp, 8
mov ecx, dword [ebp - 0x18]
xor eax, eax
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x60], 7
mov word [ebp - 0x74], ax
cmp ecx, 7
jbe 0x40ee37
mov edx, dword [ebp - 0x2c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40ee2d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40ee2d
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push 4
push 0x41dd5c
push 4
push str.Type
push 0
push dword [ebp - 0x80]
call esi
push dword [ebp - 0x80]
test eax, eax
je 0x40ec2b
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, str.____Cant_create_Type_registry_value
jmp 0x40eb0f
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x414244
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x84], eax
test eax, eax
je 0x40eb27
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.RtlAdjustPrivilege
push eax
call esi
push str.NtLoadDriver
push dword [ebp - 0x84]
mov edi, eax
call esi
mov esi, eax
lea eax, [ebp - 0x11]
push eax
push 0
push 1
push 0xa
call edi
add esp, 0x10
test eax, eax
jns 0x40ec86
mov edx, str.Fatal_error:_failed_to_acquire_SE_LOAD_DRIVER_PRIVILEGE._Make_sure_you_are_running_as_administrator.
jmp 0x40eb0f
mov ecx, dword [ebp - 0x1c]
sub ebx, ecx
cmp ebx, 0x34
jb 0x40ee55
cmp dword [ebp - 0x18], 7
lea eax, [ebp - 0x2c]
push ecx
cmova eax, dword [ebp - 0x2c]
push eax
push 0x34
push str.RegistryMachineSystemCurrentControlSetServices_
push ecx
push dword [ebp - 0x84]
lea ecx, [ebp - 0x5c]
call fcn.00409050
mov byte [ebp - 4], 3
lea eax, [ebp - 0x5c]
cmp dword [ebp - 0x48], 7
cmova eax, dword [ebp - 0x5c]
push eax
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea eax, [ebp - 0x7c]
push eax
call esi
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
add esp, 4
mov edx, str.___NtLoadDriver_Status_0x
mov ebx, eax
call fcn.00406130
push 0x401220
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::ios_base_____cdecl___class_std::ios_base___]
push ebx
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___long_int_]
push 0x406100
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_______cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_____]
cmp ebx, 0xc0000603
jne 0x40edcb
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
mov edx, str.____Your_vulnerable_driver_list_is_enabled_and_have_blocked_the_driver_loading__you_must_disable_vulnerable_driver_list_to_use_kdmapper_with_intel_driver
call fcn.00406130
push 0x406100
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_______cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_____]
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
mov edx, str.____Registry_path_to_disable_vulnerable_driver_list:_HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlCIConfig
call fcn.00406130
push 0x406100
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_______cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_____]
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
mov edx, str.____Set_VulnerableDriverBlocklistEnable_as_dword_to_0
call fcn.00406130
push 0x406100
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_______cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_____]
shr ebx, 0x1f
xor bl, 1
mov ecx, dword [ebp - 0x48]
cmp ecx, 7
jbe 0x40edb2
mov edx, dword [ebp - 0x5c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40eda8
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ebf9
push ecx
push edx
call fcn.0040fe5c
add esp, 8
xor eax, eax
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 7
mov word [ebp - 0x5c], ax
jmp 0x40eb29
cmp ebx, 0xc0000022
je 0x40eddb
cmp ebx, 0xc000009a
jne 0x40ee1a
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
mov edx, str.____Access_Denied_or_Insufficient_Resources__0x
call fcn.00406130
push 0x401220
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::ios_base_____cdecl___class_std::ios_base___]
push ebx
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___long_int_]
mov edx, str.___Probably_some_anticheat_or_antivirus_running_blocking_the_load_of_vulnerable_driver
mov ecx, eax
call fcn.00406130
push 0x406100
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_______cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_____]
cmp ebx, 0xc000010e
jne 0x40ed72
mov bl, 1
jmp 0x40ed78
push ecx
push edx
call fcn.0040fe5c
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040fd39
mov esp, ebp
pop ebp
ret
call fcn.00401170
int3