Function at 0x14001e8c0
Capabilities:
Create thread
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
jmp 0x14001e8c0
push rbp
push rbx
push rsi
mov rbp, rsp
sub rsp, 0x80
xor esi, esi
lea rcx, str..IBMPmDrv
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], esi
mov edx, 0xc0000000
mov dword [rbp + 0x38], esi
lea r8d, [rsi + 3]
mov dword [rbp + 0x20], esi
mov dword [rbp - 0x30], esi
mov dword [rbp + 0x30], esi
mov dword [rbp + 0x28], esi
mov qword [rbp - 0x20], rsi
mov dword [rbp - 0x2c], esi
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14001f0f2
mov qword [rsp + 0x38], rsi
lea rax, [rbp - 0x30]
mov qword [rsp + 0x30], rax
lea r9d, [rsi + 4]
lea rax, [rbp + 0x20]
mov dword [rsp + 0x28], 4
lea r8, [rbp + 0x38]
mov qword [rsp + 0x20], rax
mov edx, 0x222434
mov qword [rsp + 0x78], rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov edi, dword [rbp + 0x20]
test eax, eax
je 0x14001f049
cmp edi, 0x100
jb 0x14001f049
cmp edi, 0x200
jne 0x14001e97f
mov dword [rbp + 0x38], 1
jmp 0x14001e98e
cmp edi, 0x100
jne 0x14001eadd
mov dword [rbp + 0x38], esi
mov qword [rsp + 0x38], rsi
lea rax, [rbp - 0x30]
mov qword [rsp + 0x30], rax
lea r8, [rbp + 0x38]
lea rax, [rbp + 0x20]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
mov edx, 0x222438
mov dword [rbp + 0x20], esi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov qword [rsp + 0x40], rsi
lea rax, [rbp - 0x20]
mov qword [rsp + 0x38], rax
lea rdx, str.SYSTEMCurrentControlSetServicesIBMPMSVCParametersCapability
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14001eadd
mov rcx, qword [rbp - 0x20]
lea rax, [rbp + 0x20]
mov dword [rsp + 0x28], 4
mov r9d, 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp - 0x20]
lea rax, [rbp + 0x20]
mov dword [rsp + 0x28], 4
lea rdx, str.IsExistPMInternalFunction
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp + 0x20], 0x804
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp - 0x20]
lea rax, [rbp + 0x20]
mov dword [rsp + 0x28], 4
lea rdx, str.OverrideCapability
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp + 0x20], 0x804
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp - 0x20]
lea rax, [rbp + 0x20]
mov dword [rsp + 0x28], 4
lea rdx, str.Type2
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp + 0x28], 4
mov dword [rbp + 0x30], 4
mov dword [rbp + 0x20], 0x7fffffff
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rsi
lea rax, [rbp - 0x20]
mov qword [rsp + 0x38], rax
lea rdx, str.SYSTEMCurrentControlSetServicesIBMPMSVCParametersInterfaceVersion
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14001eb6d
mov rcx, qword [rbp - 0x20]
lea r9d, [rax + 4]
xor r8d, r8d
mov dword [rbp + 0x28], 4
xor edx, edx
mov dword [rbp + 0x30], 4
mov dword [rsp + 0x28], 4
cmp edi, 0x100
je 0x14001eb4d
lea eax, [rdi + 1]
mov dword [rbp + 0x20], eax
jmp 0x14001eb54
mov dword [rbp + 0x20], 0x102
lea rax, [rbp + 0x20]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, 0x200
jne 0x14001ed52
mov qword [rsp + 0x38], rsi
lea rax, [rbp - 0x30]
mov qword [rsp + 0x30], rax
lea r8, [rbp + 0x38]
lea rax, [rbp + 0x20]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
mov edx, 0x22243c
mov dword [rbp + 0x38], 1
mov rcx, rbx
mov dword [rbp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov eax, dword [rbp + 0x20]
lea rdx, str.SYSTEMCurrentControlSetServicesIBMPMSVCParametersCurrentSetting
mov qword [rsp + 0x40], rsi
xor r9d, r9d
mov dword [0x1400d44ac], eax
xor r8d, r8d
lea rax, [0x1400d4508]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov eax, dword [rbp + 0x30]
xor r8d, r8d
mov r9d, dword [rbp + 0x28]
xor edx, edx
mov rcx, qword [0x1400d4508]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x20]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov qword [rsp + 0x40], rsi
lea rax, [0x1400d4510]
mov qword [rsp + 0x38], rax
lea rdx, str.SYSTEMCurrentControlSetServicesIBMPMSVCParametersOverrideSetting
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov rcx, qword [0x1400d4510]
test rcx, rcx
je 0x14001ecdc
lea rax, [rbp + 0x30]
mov dword [rbp + 0x28], 4
mov qword [rsp + 0x28], rax
lea rdi, [0x1400d44b8]
lea r9, [rbp + 0x28]
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov dword [rbp + 0x30], 4
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14001ecdc
mov rcx, qword [0x1400d4510]
mov r9d, 4
mov dword [rsp + 0x28], 4
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rdi
mov dword [0x1400d44b8], esi
mov dword [rbp + 0x28], 4
mov dword [rbp + 0x30], 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov qword [rsp + 0x40], rsi
lea rax, [rbp - 0x20]
mov qword [rsp + 0x38], rax
lea rdx, str.SYSTEMCurrentControlSetServicesIBMPMSVCParametersNotification
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14001ef6e
mov rcx, qword [rbp - 0x20]
lea rax, [rbp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x28]
lea rax, [rbp - 0x28]
mov dword [rbp - 0x28], esi
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14001ef28
jmp 0x14001eef4
cmp edi, 0x100
jne 0x14001ef6e
mov qword [rsp + 0x38], rsi
lea rax, [rbp - 0x30]
mov qword [rsp + 0x30], rax
lea r8, [rbp + 0x38]
lea rax, [rbp + 0x20]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
mov edx, 0x22243c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov eax, dword [rbp + 0x20]
lea rdx, str.SYSTEMCurrentControlSetServicesIBMPMSVCParametersCurrentSetting
mov qword [rsp + 0x40], rsi
xor r9d, r9d
mov dword [0x1400d44ac], eax
xor r8d, r8d
lea rax, [0x1400d4508]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov eax, dword [rbp + 0x30]
xor r8d, r8d
mov r9d, dword [rbp + 0x28]
xor edx, edx
mov rcx, qword [0x1400d4508]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x20]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov qword [rsp + 0x40], rsi
lea rax, [0x1400d4510]
mov qword [rsp + 0x38], rax
lea rdx, str.SYSTEMCurrentControlSetServicesIBMPMSVCParametersOverrideSetting
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov rcx, qword [0x1400d4510]
test rcx, rcx
je 0x14001eeb7
lea rax, [rbp + 0x30]
mov dword [rbp + 0x28], 4
mov qword [rsp + 0x28], rax
lea rdi, [0x1400d44b8]
lea r9, [rbp + 0x28]
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov dword [rbp + 0x30], 4
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14001eeb7
mov rcx, qword [0x1400d4510]
mov r9d, 4
mov dword [rsp + 0x28], 4
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rdi
mov dword [0x1400d44b8], esi
mov dword [rbp + 0x28], 4
mov dword [rbp + 0x30], 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov qword [rsp + 0x40], rsi
lea rax, [rbp - 0x20]
mov qword [rsp + 0x38], rax
lea rdx, str.SYSTEMCurrentControlSetServicesIBMPMSVCParametersNotification
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14001ef6e
mov rcx, qword [rbp - 0x20]
lea rax, [rbp + 0x20]
mov dword [rsp + 0x28], 4
mov r9d, 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
mov dword [rbp + 0x28], 4
mov dword [rbp + 0x30], 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp - 0x20]
lea rax, [rbp + 0x20]
mov dword [rsp + 0x28], 4
lea rdx, str.Type2
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp + 0x28], 4
mov dword [rbp + 0x30], 4
mov dword [rbp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, str.PHThread
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rcx, qword [0x1400d4508]
xor edx, edx
mov r9, rax
mov qword [0x1400d44d8], rax
mov dword [rsp + 0x20], 1
lea r8d, [rdx + 4]
call qword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
lea rax, [rbp - 0x2c]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea r8, [0x140004255]
xor edx, edx
mov dword [rsp + 0x20], esi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea r9, str.PHOverrideThread
xor r8d, r8d
xor edx, edx
mov qword [0x1400d44c8], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rcx, qword [0x1400d4510]
xor edx, edx
mov r9, rax
mov qword [0x1400d44e0], rax
mov dword [rsp + 0x20], 1
lea r8d, [rdx + 4]
call qword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
lea rax, [rbp - 0x2c]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea r8, [0x140002b3a]
xor edx, edx
mov dword [rsp + 0x20], esi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, qword [rsp + 0x78]
mov qword [0x1400d44d0], rax
add rsp, 0x80
pop rsi
pop rbx
pop rbp
ret
mov qword [rsp + 0x40], rsi
lea rax, [rbp - 0x20]
mov qword [rsp + 0x38], rax
lea rdx, str.SYSTEMCurrentControlSetServicesIBMPMSVCParametersCapability
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], esi
mov dword [0x1400d44ac], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov rcx, qword [rbp - 0x20]
test eax, eax
je 0x14001f098
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14001f0e4
mov eax, dword [0x1400d44ac]
mov r9d, 4
mov dword [rbp + 0x20], eax
xor r8d, r8d
lea rax, [rbp + 0x20]
mov dword [rsp + 0x28], 4
xor edx, edx
mov qword [rsp + 0x20], rax
mov dword [rbp + 0x28], 4
mov dword [rbp + 0x30], 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp - 0x20]
test eax, eax
jne 0x14001f090
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rbx, rbx
je 0x14001f0ed
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x78]
add rsp, 0x80
pop rsi
pop rbx
pop rbp
ret