Function at 0x1400152e0
Capabilities:
Persist via windows service
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x218]
sub rsp, 0x2f0
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x14005c080]
xor rax, rsp
mov qword [rbp + 0x1d0], rax
mov r14, rcx
xor esi, esi
mov rdi, qword [rcx + 0x10]
mov rbx, rcx
cmp qword [rcx + 0x18], 0xf
jbe 0x140015331
mov rbx, qword [rcx]
call fcn.140019218
mov qword [rbp + 0x130], rbx
mov qword [rbp + 0x138], rdi
lea r8, [rbp + 0x130]
mov edx, eax
lea rcx, [rsp + 0x60]
call fcn.140015050
nop
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 7
cmova rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x70]
lea r11, [rcx + rax*2]
mov r10, r11
mov rdx, r11
call fcn.1400151c0
cmp rax, r11
je 0x14001539d
lea rdx, [r10 - 2]
movzx ecx, word [rdx]
cmp cx, 0x5c
je 0x14001539d
cmp cx, 0x2f
je 0x14001539d
mov r10, rdx
cmp rax, rdx
jne 0x140015382
sub r11, r10
sar r11, 1
xorps xmm0, xmm0
movups xmmword [rbp + 0x100], xmm0
mov qword [rbp + 0x110], rsi
mov qword [rbp + 0x118], rsi
mov r8, r11
mov rdx, r10
lea rcx, [rbp + 0x100]
call fcn.14000b910
nop
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0x100]
call fcn.14000eed0
nop
mov rdx, qword [rbp + 0x118]
cmp rdx, 7
jbe 0x140015428
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140015423
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140015ff4
call fcn.1400198a0
movdqa xmm0, xmmword [0x140054760]
movdqu xmmword [rbp + 0x110], xmm0
mov word [rbp + 0x100], si
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x140015481
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001547c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140015ffa
call fcn.1400198a0
movdqa xmm0, xmmword [0x140054760]
movdqu xmmword [rsp + 0x70], xmm0
mov word [rsp + 0x60], si
mov r13, qword [rbp + 0xe0]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r13
cmp rax, 0x22
jb 0x140016000
lea r12, [rbp + 0xd0]
cmp qword [rbp + 0xe8], 0xf
cmova r12, qword [rbp + 0xd0]
xorps xmm0, xmm0
movups xmmword [rbp + 0xb0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xc0], xmm1
lea r15, [r13 + 0x22]
mov ebx, 0xf
mov edi, ebx
lea rsi, [rbp + 0xb0]
movabs rax, 0x8000000000000000
lea edx, [rbx + 7]
cmp r15, rbx
jbe 0x140015571
mov rdi, r15
or rdi, rbx
cmp rdi, rcx
jbe 0x140015536
mov rdi, rcx
add rax, 0x27
mov rcx, rax
call fcn.140019c6c
test rax, rax
je 0x14001601e
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x14001556a
cmp rdi, rdx
cmovb rdi, rdx
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x140015559
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140015fe8
jmp 0x140015517
test rcx, rcx
je 0x140015568
call fcn.140019c6c
mov rsi, rax
jmp 0x14001556a
xor esi, esi
mov qword [rbp + 0xb0], rsi
mov qword [rbp + 0xc0], r15
mov qword [rbp + 0xc8], rdi
movups xmm0, xmmword [str.SYSTEMCurrentControlSetServices_]
movups xmmword [rsi], xmm0
movups xmm1, xmmword [0x140054678]
movups xmmword [rsi + 0x10], xmm1
movzx eax, word [0x140054688]
mov word [rsi + 0x20], ax
lea rcx, [rsi + 0x22]
mov r8, r13
mov rdx, r12
call fcn.14003d780
mov byte [rsi + r15], 0
mov r15, qword [r14 + 0x10]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r15
cmp rax, 4
jb 0x140016006
cmp qword [r14 + 0x18], 0xf
jbe 0x1400155db
mov r14, qword [r14]
xorps xmm0, xmm0
movups xmmword [rbp + 0x90], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xa0], xmm1
lea rsi, [r15 + 4]
lea rdi, [rbp + 0x90]
cmp rsi, 0xf
jbe 0x14001567e
mov rbx, rsi
or rbx, 0xf
cmp rbx, rcx
jbe 0x14001563d
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140019c6c
test rax, rax
je 0x14001600c
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140015677
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140015666
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140015fee
jmp 0x14001561e
test rcx, rcx
je 0x140015675
call fcn.140019c6c
mov rdi, rax
jmp 0x140015677
xor edi, edi
mov qword [rbp + 0x90], rdi
mov qword [rbp + 0xa0], rsi
mov qword [rbp + 0xa8], rbx
mov dword [rdi], 0x5c3f3f5c
lea rcx, [rdi + 4]
mov r8, r15
mov rdx, r14
call fcn.14003d780
mov byte [rdi + rsi], 0
lea rdx, [rbp + 0xb0]
cmp qword [rbp + 0xc8], 0xf
cmova rdx, qword [rbp + 0xb0]
lea r8, [rbp + 0x60]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x1400158ba
movabs rax, 0xc8c77863e98edf41
mov qword [rbp + 0x130], rax
movabs rax, 0xb8e6996691cb9546
mov qword [rbp + 0x138], rax
movabs rax, 0xa12e55cd84a09a0b
mov qword [rbp + 0x140], rax
movabs rax, 0xd27896a83e8b7048
mov qword [rbp + 0x148], rax
movabs rax, 0xefa91920c9d3f21a
mov qword [rbp + 0x100], rax
movabs rax, 0xdd92f803e3a8b532
mov qword [rbp + 0x108], rax
movabs rax, 0xc44d3cbbf6c5e92b
mov qword [rbp + 0x110], rax
movabs rax, 0xd27896a247ee1b68
mov qword [rbp + 0x118], rax
movups xmm0, xmmword [rbp + 0x100]
movups xmm1, xmmword [rbp + 0x110]
xorps xmm0, xmmword [rbp + 0x130]
movdqa xmmword [rsp + 0x30], xmm0
xorps xmm1, xmmword [rbp + 0x140]
movdqa xmmword [rsp + 0x40], xmm1
lea rcx, [rsp + 0x30]
call fcn.140001280
xor bl, bl
mov rdx, qword [rbp + 0xa8]
cmp rdx, 0xf
jbe 0x1400157d2
inc rdx
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400157cd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001600c
call fcn.1400198a0
movdqa xmm0, xmmword [0x140054770]
movdqu xmmword [rbp + 0xa0], xmm0
mov byte [rbp + 0x90], 0
mov rdx, qword [rbp + 0xc8]
cmp rdx, 0xf
jbe 0x14001582a
inc rdx
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140015825
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001601e
call fcn.1400198a0
movdqa xmm0, xmmword [0x140054770]
movdqu xmmword [rbp + 0xc0], xmm0
mov byte [rbp + 0xb0], 0
mov rdx, qword [rbp + 0xe8]
cmp rdx, 0xf
jbe 0x140015882
inc rdx
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001587d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140015fe2
call fcn.1400198a0
movzx eax, bl
mov rcx, qword [rbp + 0x1d0]
xor rcx, rsp
call fcn.140019880
lea r11, [rsp + 0x2f0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
lea rcx, [rbp + 0x90]
cmp qword [rbp + 0xa8], 0xf
cmova rcx, qword [rbp + 0x90]
mov eax, dword [rbp + 0xa0]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 2
lea r8, str.ImagePath
xor edx, edx
mov rcx, qword [rbp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueA]
mov rcx, qword [rbp + 0x60]
test eax, eax
je 0x140015a13
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movabs rax, 0xc8c77863e98edf41
mov qword [rbp + 0x100], rax
movabs rax, 0xb8e6996691cb9546
mov qword [rbp + 0x108], rax
movabs rax, 0xa12e55cd84a09a0b
mov qword [rbp + 0x110], rax
movabs rax, 0xd27896a83e8b7048
mov qword [rbp + 0x118], rax
movabs rax, 0x6bc8eacf60060035
mov qword [rbp + 0x120], rax
movabs rcx, 0xbbe399e25c44bd5a
movabs rax, 0xefa91920c9d3f21a
mov qword [rsp + 0x30], rax
movabs rax, 0xdd92f803e3a8b532
mov qword [rsp + 0x38], rax
movabs rax, 0xf14b32ace9e9bd2b
mov qword [rsp + 0x40], rax
movabs rax, 0xb51de48819e30429
mov qword [rsp + 0x48], rax
movabs rax, 0xabecab61272735c
mov qword [rsp + 0x50], rax
movabs rax, 0xbbe399e25621c836
mov qword [rsp + 0x58], rax
mov qword [rbp + 0x128], rcx
movups xmm0, xmmword [rsp + 0x30]
movups xmm1, xmmword [rsp + 0x40]
movups xmm2, xmmword [rsp + 0x50]
xorps xmm0, xmmword [rbp + 0x100]
movdqa xmmword [rbp + 0x130], xmm0
xorps xmm1, xmmword [rbp + 0x110]
movdqa xmmword [rbp + 0x140], xmm1
xorps xmm2, xmmword [rbp + 0x120]
movdqa xmmword [rbp + 0x150], xmm2
lea rcx, [rbp + 0x130]
jmp 0x14001578a
mov dword [rsp + 0x28], 4
lea rax, [0x140054750]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, str.Type
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueA]
mov rcx, qword [rbp + 0x60]
test eax, eax
je 0x140015b02
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movabs rax, 0xc8c77863e98edf41
mov qword [rbp + 0x100], rax
movabs rax, 0xb8e6996691cb9546
mov qword [rbp + 0x108], rax
movabs rax, 0xa12e55cd84a09a0b
mov qword [rbp + 0x110], rax
movabs rax, 0xd27896a83e8b7048
mov qword [rbp + 0x118], rax
movabs rax, 0x6bc8eacf60060035
mov qword [rbp + 0x120], rax
movabs rcx, 0xbbe399e25c44bd5a
movabs rax, 0xefa91920c9d3f21a
mov qword [rsp + 0x30], rax
movabs rax, 0xdd92f803e3a8b532
mov qword [rsp + 0x38], rax
movabs rax, 0x810930bdfdf4bd2b
mov qword [rsp + 0x40], rax
movabs rax, 0xab0ae2db57ec153a
mov qword [rsp + 0x48], rax
movabs rax, 0x6bc28fba0c677615
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rcx
jmp 0x1400159c4
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [0x14004bc78]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdi, rax
test rax, rax
je 0x14001578f
lea rdx, str.RtlAdjustPrivilege
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rdx, str.NtLoadDriver
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
lea r9, [rbp + 0x68]
xor r8d, r8d
mov dl, 1
lea ecx, [r8 + 0xa]
call rbx
test eax, eax
jns 0x140015d7f
movabs rax, 0xc8c77863e98edf41
mov qword [rbp + 0x160], rax
movabs rax, 0xb8e6996691cb9546
mov qword [rbp + 0x168], rax
movabs rax, 0xa12e55cd84a09a0b
mov qword [rbp + 0x170], rax
movabs rax, 0xd27896a83e8b7048
mov qword [rbp + 0x178], rax
movabs rax, 0x6bc8eacf60060035
mov qword [rbp + 0x180], rax
movabs rcx, 0xbbe399e25c44bd5a
mov qword [rbp + 0x188], rcx
movabs rax, 0x4223fb09a5b66e8f
mov qword [rbp + 0x190], rax
movabs rax, 0x9270cb243caf40dc
mov qword [rbp + 0x198], rax
movabs rax, 0x9cef20bb499f3c9
mov qword [rbp + 0x1a0], rax
movabs rax, 0xe1b661ce06ab6dce
mov qword [rbp + 0x1a8], rax
movabs rax, 0xbcb8e935a877eab3
mov qword [rbp + 0x1b0], rax
movabs rax, 0x1598df07ebb14d0
mov qword [rbp + 0x1b8], rax
movabs rax, 0x32c4589733a7293d
mov qword [rbp + 0x1c0], rax
movabs rcx, 0x8101272a97920302
mov qword [rbp + 0x1c8], rcx
movabs rax, 0xbaa2580f88fabe07
mov qword [rbp - 0x80], rax
movabs rax, 0xd187ff46abb9fa34
mov qword [rbp - 0x78], rax
movabs rax, 0xc00e3ab9a4c4ff67
mov qword [rbp - 0x70], rax
movabs rax, 0x8158f3da57fe012b
mov qword [rbp - 0x68], rax
movabs rax, 0x2f97ae8e2f4a5f70
mov qword [rbp - 0x60], rax
movabs rax, 0xe9b3c6b01912f408
mov qword [rbp - 0x58], rax
movabs rax, 0x6c66bc4ce9ff38c6
mov qword [rbp - 0x50], rax
movabs rax, 0xe703eb4157ce0dfc
mov qword [rbp - 0x48], rax
movabs rax, 0x68ee8764cdb996bb
mov qword [rbp - 0x40], rax
movabs rax, 0x88d80fbb748b08bc
mov qword [rbp - 0x38], rax
movabs rax, 0xd8d9c946c9578ddd
mov qword [rbp - 0x30], rax
movabs rax, 0x602bf98317d57dbd
mov qword [rbp - 0x28], rax
movabs rax, 0x32c4589d1dd54649
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rcx
movups xmm0, xmmword [rbp - 0x80]
movups xmm1, xmmword [rbp - 0x70]
movups xmm2, xmmword [rbp - 0x60]
movups xmm3, xmmword [rbp - 0x50]
movups xmm4, xmmword [rbp - 0x40]
movups xmm5, xmmword [rbp - 0x30]
movups xmm6, xmmword [rbp - 0x20]
xorps xmm0, xmmword [rbp + 0x160]
movdqa xmmword [rbp - 0x10], xmm0
xorps xmm1, xmmword [rbp + 0x170]
movdqa xmmword [rbp], xmm1
xorps xmm2, xmmword [rbp + 0x180]
movdqa xmmword [rbp + 0x10], xmm2
xorps xmm3, xmmword [rbp + 0x190]
movdqa xmmword [rbp + 0x20], xmm3
xorps xmm4, xmmword [rbp + 0x1a0]
movdqa xmmword [rbp + 0x30], xmm4
xorps xmm5, xmmword [rbp + 0x1b0]
movdqa xmmword [rbp + 0x40], xmm5
xorps xmm6, xmmword [rbp + 0x1c0]
movdqa xmmword [rbp + 0x50], xmm6
lea rcx, [rbp - 0x10]
jmp 0x14001578a
lea r8, [rbp + 0xd0]
cmp qword [rbp + 0xe8], 0xf
cmova r8, qword [rbp + 0xd0]
add r8, qword [rbp + 0xe0]
lea rdx, [rbp + 0xd0]
cmp qword [rbp + 0xe8], 0xf
cmova rdx, qword [rbp + 0xd0]
lea rcx, [rbp + 0x70]
call fcn.140016530
nop
lea r8, [rbp + 0x70]
lea rdx, str.RegistryMachineSystemCurrentControlSetServices_
lea rcx, [rsp + 0x30]
call fcn.14000b230
mov rbx, rax
lea rax, [rbp + 0x70]
cmp rax, rbx
je 0x140015e5b
mov rdx, qword [rbp + 0x88]
cmp rdx, 7
jbe 0x140015e22
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140015e1d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140016012
call fcn.1400198a0
movdqa xmm0, xmmword [0x140054760]
movdqu xmmword [rbp + 0x80], xmm0
xor esi, esi
mov word [rbp + 0x70], si
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x70], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x80], xmm1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 7
mov word [rbx], si
jmp 0x140015e5d
xor esi, esi
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x140015e9f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140015e9a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140016012
call fcn.1400198a0
lea rdx, [rbp + 0x70]
cmp qword [rbp + 0x88], 7
cmova rdx, qword [rbp + 0x70]
lea rcx, [rbp + 0xf0]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rcx, [rbp + 0xf0]
call rdi
mov ebx, eax
movabs rax, 0xc8c77863e98edf41
mov qword [rbp + 0x130], rax
movabs rax, 0xb8e6996691cb9546
mov qword [rbp + 0x138], rax
movabs rax, 0xa12e55cd84a09a0b
mov qword [rbp + 0x140], rax
movabs rax, 0xd27896a83e8b7048
mov qword [rbp + 0x148], rax
movabs rax, 0xa78b0c2dc9d3f41a
mov qword [rbp + 0x100], rax
movabs rax, 0xca83ef0fe38ff127
mov qword [rbp + 0x108], rax
movabs rax, 0x815d20b9e5d4c92b
mov qword [rbp + 0x110], rax
movabs rax, 0xd2789cd052ae0878
mov qword [rbp + 0x118], rax
movups xmm0, xmmword [rbp + 0x100]
movups xmm1, xmmword [rbp + 0x110]
xorps xmm0, xmmword [rbp + 0x130]
movdqa xmmword [rsp + 0x30], xmm0
xorps xmm1, xmmword [rbp + 0x140]
movdqa xmmword [rsp + 0x40], xmm1
mov edx, ebx
lea rcx, [rsp + 0x30]
call fcn.140001280
shr ebx, 0x1f
xor bl, 1
mov rdx, qword [rbp + 0x88]
cmp rdx, 7
jbe 0x140015fc9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140015fc4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140016018
call fcn.1400198a0
movdqa xmm0, xmmword [0x140054760]
movdqu xmmword [rbp + 0x80], xmm0
mov word [rbp + 0x70], si
jmp 0x140015791
call fcn.140023650
nop
call fcn.140001ca0
nop
call fcn.140001ca0
nop
call fcn.140023650
nop
call fcn.140023650
int3
call fcn.140001d40
nop
call fcn.140001d40
int3
call fcn.140023650
nop
call fcn.140023650
nop
call fcn.140023650
nop
call fcn.140023650
int3