Function at 0x14004d290
Capabilities:
Delete registry key
Persist via windows service
Set registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x9c0]
sub rsp, 0xac0
mov rax, qword [0x1401222f0]
xor rax, rsp
mov qword [rbp + 0x9b0], rax
mov rsi, rcx
lea rcx, str.SeLoadDriverPrivilege
mov rdi, r8
mov rbx, rdx
call fcn.140005190
lea rdx, str.SystemCurrentControlSetServices_s
lea rcx, [rsp + 0x60]
mov r8, rsi
call fcn.14002d7d0
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x60]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x14004d504
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
lea rdx, [0x1400d79d0]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x40], 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
lea rdx, str.ErrorControl
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x40], 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
lea rdx, str.Start
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x40], 3
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rdx, str.___s
lea rcx, [rbp + 0x590]
mov r8, rbx
call fcn.14002d7d0
lea rcx, [rbp + 0x590]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x14004d3c0
mov rcx, qword [rsp + 0x48]
add eax, eax
lea rdx, str.ImagePath
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x590]
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.NtLoadDriver
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RegistryMachineSystemCurrentControlSetServices_s
lea rcx, [rbp + 0x7a0]
mov r8, rsi
mov rbx, rax
call fcn.14002d7d0
mov rax, qword [0x140126518]
test rax, rax
jne 0x14004d468
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x1400e45b0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140126518], rax
lea rdx, [rbp + 0x7a0]
lea rcx, [rsp + 0x50]
call rax
lea rcx, [rsp + 0x50]
call rbx
lea r8, [rsp + 0x60]
lea rdx, str._sEnum
lea rcx, [rbp + 0x380]
mov ebx, eax
call fcn.14002d7d0
lea rdx, [rbp + 0x380]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea r8, [rsp + 0x60]
lea rdx, str._sSecurity
lea rcx, [rbp + 0x380]
call fcn.14002d7d0
lea rdx, [rbp + 0x380]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea rdx, [rsp + 0x60]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test ebx, ebx
je 0x14004d50b
cmp ebx, 0xc000010e
je 0x14004d50b
mov ecx, ebx
call fcn.14004d180
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x14004d5a8
lea rdx, str.._s
lea rcx, [rbp + 0x170]
mov r8, rsi
call fcn.14002d7d0
xor ebx, ebx
lea rcx, [rbp + 0x170]
mov qword [rsp + 0x30], rbx
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rdi], rax
cmp rax, 0xffffffffffffffff
jne 0x14004d59f
lea rdx, str..Global_s
lea rcx, [rbp + 0x170]
mov r8, rsi
call fcn.14002d7d0
mov qword [rsp + 0x30], rbx
lea rcx, [rbp + 0x170]
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rdi], rax
cmp qword [rdi], 0xffffffffffffffff
setne bl
invalid