Function at 0x14001a160
Capabilities:
Create thread
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
jmp 0x14001a160
push rbp
push rbx
mov rbp, rsp
sub rsp, 0x78
mov qword [rsp + 0x68], rdi
lea rcx, str..IBMPmDrv
xor edi, edi
xor r9d, r9d
mov qword [rsp + 0x30], rdi
mov edx, 0xc0000000
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 3
lea r8d, [rdi + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14001aa57
mov qword [rsp + 0x40], rdi
lea rax, [rbp - 0x20]
mov qword [rsp + 0x38], rax
lea rdx, str.SYSTEMCurrentControlSetServicesIBMPMSVCParameters2Type20Capability
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x14001a26b
mov rcx, qword [rbp - 0x20]
lea rax, [rbp + 0x18]
mov dword [rsp + 0x28], 4
lea r9d, [rdi + 4]
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.Type21
mov dword [rbp + 0x20], 4
mov dword [rbp + 0x28], 4
mov dword [rbp + 0x18], edi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp - 0x20]
lea rax, [rbp + 0x18]
mov dword [rsp + 0x28], 4
lea r9d, [rdi + 4]
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.Type22
mov dword [rbp + 0x20], 4
mov dword [rbp + 0x28], 4
mov dword [rbp + 0x18], 0xffff
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rdi
lea rax, [rbp - 0x20]
mov qword [rsp + 0x38], rax
lea rdx, str.SYSTEMCurrentControlSetServicesIBMPMSVCParameters2Type20Notification
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x14001a32e
mov rcx, qword [rbp - 0x20]
lea rax, [rbp + 0x18]
mov dword [rsp + 0x28], 4
lea rdx, str.Type21
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp + 0x20], 4
mov dword [rbp + 0x28], 4
mov dword [rbp + 0x18], edi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp - 0x20]
lea rax, [rbp + 0x18]
mov dword [rsp + 0x28], 4
lea rdx, str.Type22
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp + 0x20], 4
mov dword [rbp + 0x28], 4
mov dword [rbp + 0x18], edi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x38], rdi
lea rax, [rbp - 0x28]
mov qword [rsp + 0x30], rax
lea r8, [rbp + 0x30]
lea rax, [rbp + 0x18]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
mov edx, 0x222434
mov dword [rbp + 0x30], edi
mov rcx, rbx
mov dword [rbp + 0x18], edi
mov dword [rbp + 0x28], edi
mov dword [rbp + 0x20], edi
mov dword [rbp - 0x24], edi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x14001a9d1
cmp dword [rbp + 0x18], 0x200
jb 0x14001a9d1
mov qword [rsp + 0x38], rdi
lea rax, [rbp - 0x28]
mov qword [rsp + 0x30], rax
lea r8, [rbp + 0x30]
lea rax, [rbp + 0x18]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
mov edx, 0x222438
mov dword [rbp + 0x30], 2
mov rcx, rbx
mov dword [rbp + 0x18], edi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov qword [rsp + 0x40], rdi
lea rax, [rbp - 0x20]
mov qword [rsp + 0x38], rax
lea rdx, str.SYSTEMCurrentControlSetServicesIBMPMSVCParameters2Type10Capability
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x14001a4c8
mov rcx, qword [rbp - 0x20]
lea rax, [rbp + 0x18]
mov dword [rsp + 0x28], 4
lea rdx, str.Type12
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp + 0x20], 4
mov dword [rbp + 0x28], 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov qword [rsp + 0x38], rdi
lea rax, [rbp - 0x28]
mov qword [rsp + 0x30], rax
lea r8, [rbp + 0x30]
lea rax, [rbp + 0x18]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
mov edx, 0x222438
mov dword [rbp + 0x30], 3
mov rcx, rbx
mov dword [rbp + 0x18], edi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rcx, qword [rbp - 0x20]
lea rax, [rbp + 0x18]
mov dword [rsp + 0x28], 4
lea rdx, str.Type13
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp + 0x20], 4
mov dword [rbp + 0x28], 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x38], rdi
lea rax, [rbp - 0x28]
mov qword [rsp + 0x30], rax
lea r8, [rbp + 0x30]
lea rax, [rbp + 0x18]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
mov edx, 0x22243c
mov dword [rbp + 0x30], 2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov eax, dword [rbp + 0x18]
lea rdx, str.SYSTEMCurrentControlSetServicesIBMPMSVCParameters2Type10CurrentSetting
mov qword [rsp + 0x40], rdi
xor r9d, r9d
mov dword [0x1400b879c], eax
xor r8d, r8d
lea rax, [0x1400b84e0]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x14001a663
mov rcx, qword [0x1400b84e0]
lea rax, [rbp + 0x18]
mov dword [rsp + 0x28], 4
lea rdx, str.Type11
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp + 0x20], 4
mov dword [rbp + 0x28], 4
mov dword [rbp + 0x18], edi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [0x1400b879c]
lea rdx, str.Type12
mov rcx, qword [0x1400b84e0]
mov r9d, 4
mov dword [rbp + 0x18], eax
xor r8d, r8d
lea rax, [rbp + 0x18]
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
mov dword [rbp + 0x20], 4
mov dword [rbp + 0x28], 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov qword [rsp + 0x38], rdi
lea rax, [rbp - 0x28]
mov qword [rsp + 0x30], rax
lea r8, [rbp + 0x30]
lea rax, [rbp + 0x18]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
mov edx, 0x22243c
mov dword [rbp + 0x30], 3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov eax, dword [rbp + 0x18]
lea rdx, str.Type13
mov rcx, qword [0x1400b84e0]
mov r9d, 4
mov dword [0x1400b84f0], eax
xor r8d, r8d
mov eax, dword [0x1400b879c]
mov dword [rbp + 0x18], eax
lea rax, [rbp + 0x18]
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
mov dword [rbp + 0x20], 4
mov dword [rbp + 0x28], 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov qword [rsp + 0x40], rdi
lea rax, [0x1400b84e8]
mov qword [rsp + 0x38], rax
lea rdx, str.SYSTEMCurrentControlSetServicesIBMPMSVCParameters2Type10OverrideSetting
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x14001a72c
mov rcx, qword [0x1400b84e8]
test rcx, rcx
je 0x14001a72c
lea rax, [rbp + 0x28]
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x28], rax
lea rsi, [0x1400b87a0]
lea r9, [rbp + 0x20]
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov dword [rbp + 0x20], 4
xor edx, edx
mov dword [rbp + 0x28], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x14001a727
mov rcx, qword [0x1400b84e8]
mov r9d, 4
mov dword [rsp + 0x28], 4
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rsi
mov dword [0x1400b87a0], edi
mov dword [rbp + 0x20], 4
mov dword [rbp + 0x28], 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rsi, qword [rsp + 0x70]
mov qword [rsp + 0x40], rdi
lea rax, [rbp - 0x20]
mov qword [rsp + 0x38], rax
lea rdx, str.SYSTEMCurrentControlSetServicesIBMPMSVCParameters2Type10Notification
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x14001a837
mov rcx, qword [rbp - 0x20]
lea rax, [rbp + 0x18]
mov dword [rsp + 0x28], 4
lea rdx, str.Type11
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp + 0x20], 4
mov dword [rbp + 0x28], 4
mov dword [rbp + 0x18], edi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [0x1400b879c]
lea rdx, str.Type12
mov rcx, qword [rbp - 0x20]
mov r9d, 4
mov dword [rbp + 0x18], eax
xor r8d, r8d
lea rax, [rbp + 0x18]
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
mov dword [rbp + 0x20], 4
mov dword [rbp + 0x28], 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [0x1400b84f0]
lea rdx, str.Type13
mov rcx, qword [rbp - 0x20]
mov r9d, 4
mov dword [rbp + 0x18], eax
xor r8d, r8d
lea rax, [rbp + 0x18]
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
mov dword [rbp + 0x20], 4
mov dword [rbp + 0x28], 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rbx, rbx
je 0x14001a848
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, rdi
lea r9, str.PHType12Thread
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov rcx, qword [0x1400b84e0]
xor edx, edx
mov r9, rax
mov qword [0x1400b87d8], rax
mov dword [rsp + 0x20], 1
lea r8d, [rdx + 4]
call qword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
lea rax, [rbp - 0x24]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea r8, [0x1400024eb]
xor edx, edx
mov dword [rsp + 0x20], edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea r9, str.PHType12OverrideThread
xor r8d, r8d
xor edx, edx
mov qword [0x1400b87c8], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov rcx, qword [0x1400b84e8]
xor edx, edx
mov r9, rax
mov qword [0x1400b87e0], rax
mov dword [rsp + 0x20], 1
lea r8d, [rdx + 4]
call qword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
lea rax, [rbp - 0x24]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea r8, [0x1400038f0]
xor edx, edx
mov dword [rsp + 0x20], edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea r9, str.PHType13Thread
xor r8d, r8d
xor edx, edx
mov qword [0x1400b87d0], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov rcx, qword [0x1400b8528]
xor edx, edx
mov r9, rax
mov qword [0x1400b8508], rax
mov dword [rsp + 0x20], 1
lea r8d, [rdx + 4]
call qword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
lea rax, [rbp - 0x24]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea r8, [0x140002257]
xor edx, edx
mov dword [rsp + 0x20], edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea r9, str.PHType13OverrideThread
xor r8d, r8d
xor edx, edx
mov qword [0x1400b84f8], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov rcx, qword [0x1400b8530]
xor edx, edx
mov r9, rax
mov qword [0x1400b8510], rax
mov dword [rsp + 0x20], 1
lea r8d, [rdx + 4]
call qword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
lea rax, [rbp - 0x24]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea r8, [0x140001974]
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x1400b8500], rax
jmp 0x14001aa57
mov qword [rsp + 0x40], rdi
lea rax, [rbp - 0x20]
mov qword [rsp + 0x38], rax
lea rdx, str.SYSTEMCurrentControlSetServicesIBMPMSVCParameters2Type10Capability
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], edi
mov dword [0x1400b879c], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov eax, dword [0x1400b879c]
mov r9d, 4
mov rcx, qword [rbp - 0x20]
xor r8d, r8d
mov dword [rbp + 0x18], eax
xor edx, edx
lea rax, [rbp + 0x18]
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
mov dword [rbp + 0x20], 4
mov dword [rbp + 0x28], 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, qword [rsp + 0x68]
test rbx, rbx
je 0x14001aa6a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x78
pop rbx
pop rbp
ret