Function at 0x14001131c
Capabilities:
Disable system features via registry on windows
Persist via windows service
Set registry value

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0xd8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x50], 0xfffffffffffffffe
mov rbx, rcx
lea rsi, [rbp - 0x40]
mov rcx, rsi
call section..text
lea rdx, str.SYSTEMCurrentControlSetServices_
lea rdi, [rbp - 0x20]
mov rcx, rdi
mov r8, rsi
call fcn.1400117a6
lea rdx, str.___
mov rsi, rbp
mov rcx, rsi
mov r8, rbx
call fcn.1400117a6
cmp qword [rbp - 8], 7
jbe 0x14001137c
mov rdi, qword [rbp - 0x20]
lea r8, [rbp + 0x40]
mov rcx, 0xffffffff80000002
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x1400113b4
lea rcx, [0x140060d00]
lea rdx, str.____Cant_create_service_key
call fcn.1400013b4
mov rcx, rax
call fcn.14000165c
jmp 0x140011465
mov eax, dword [rbp + 0x10]
add eax, eax
cmp qword [rbp + 0x18], 7
jbe 0x1400113c4
mov rsi, qword [rbp]
mov rcx, qword [rbp + 0x40]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
lea r8, str.ImagePath
xor edx, edx
mov r9d, 2
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov rcx, qword [rbp + 0x40]
test eax, eax
je 0x140011411
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [0x140060d00]
lea rdx, str.____Cant_create_ImagePath_registry_value
call fcn.1400013b4
mov rcx, rax
call fcn.14000165c
jmp 0x140011465
lea rax, [0x1400448f8]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 4
lea r8, str.Type
xor edx, edx
mov r9d, 4
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov esi, eax
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x1400114c6
lea rcx, [0x140060d00]
lea rdx, str.____Cant_create_Type_registry_value
call fcn.1400013b4
mov rcx, rax
call fcn.14000165c
xor esi, esi
mov rax, qword [rbp + 0x18]
cmp rax, 8
jb 0x140011482
mov rcx, qword [rbp]
lea rdx, [rax + rax]
add rdx, 2
call fcn.14000703b
mov rax, qword [rbp - 8]
cmp rax, 8
jb 0x14001149d
mov rcx, qword [rbp - 0x20]
lea rdx, [rax + rax]
add rdx, 2
call fcn.14000703b
mov rax, qword [rbp - 0x28]
cmp rax, 8
jb 0x1400114b8
mov rcx, qword [rbp - 0x40]
lea rdx, [rax + rax]
add rdx, 2
call fcn.14000703b
mov eax, esi
add rsp, 0xd8
pop rbx
pop rdi
pop rsi
pop rbp
ret
lea rcx, [0x14004f9b2]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x140011465
mov rsi, rax
lea rdx, str.RtlAdjustPrivilege
mov rbx, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call rbx
mov rdi, rax
lea rdx, str.NtLoadDriver
mov rcx, rsi
call rbx
mov rsi, rax
lea r9, [rbp + 0x4f]
mov ecx, 0xa
mov dl, 1
xor r8d, r8d
call rdi
test eax, eax
js 0x140011602
lea rdx, str.RegistryMachineSystemCurrentControlSetServices_
lea rdi, [rbp + 0x20]
lea r8, [rbp - 0x40]
mov rcx, rdi
call fcn.1400117a6
cmp qword [rbp + 0x38], 7
jbe 0x14001153a
mov rdi, qword [rbp + 0x20]
lea rbx, [rbp - 0x50]
mov rcx, rbx
mov rdx, rdi
call sub.ntdll.dll_RtlInitUnicodeString
mov rcx, rbx
call rsi
mov esi, eax
lea rcx, [0x140060d00]
lea rdx, str.___NtLoadDriver_Status_0x
call fcn.1400013b4
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
mov edx, 0xfffff1ff
and edx, dword [rax + rcx + 0x18]
or edx, 0x800
mov dword [rax + rcx + 0x18], edx
mov rcx, rax
mov edx, esi
call fcn.14000fc96
mov rcx, rax
call fcn.14000165c
cmp esi, 0xc000010d
jg 0x140011622
cmp esi, 0xc0000022
je 0x1400115af
cmp esi, 0xc000009a
jne 0x140011683
lea rcx, [0x140060d00]
lea rdx, str.____Access_Denied_or_Insufficient_Resources__0x
call fcn.1400013b4
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
mov edx, 0xfffff1ff
and edx, dword [rax + rcx + 0x18]
or edx, 0x800
mov dword [rax + rcx + 0x18], edx
mov rcx, rax
mov edx, esi
call fcn.14000fc96
lea rdx, str.___Probably_some_anticheat_or_antivirus_running_blocking_the_load_of_vulnerable_driver
mov rcx, rax
call fcn.1400013b4
mov rcx, rax
call fcn.14000165c
jmp 0x140011683
lea rcx, [0x140060d00]
lea rdx, str.Fatal_error:_failed_to_acquire_SE_LOAD_DRIVER_PRIVILEGE._Make_sure_you_are_running_as_administrator.
call fcn.1400013b4
mov rcx, rax
call fcn.14000165c
jmp 0x140011465
cmp esi, 0xc000010e
je 0x14001168b
cmp esi, 0xc0000603
jne 0x140011683
lea rcx, [0x140060d00]
lea rdx, str.____Your_vulnerable_driver_list_is_enabled_and_have_blocked_the_driver_loading__you_must_disable_vulnerable_driver_list_to_use_kdmapper_with_intel_driver
call fcn.1400013b4
mov rcx, rax
call fcn.14000165c
lea rcx, [0x140060d00]
lea rdx, str.____Registry_path_to_disable_vulnerable_driver_list:_HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlCIConfig
call fcn.1400013b4
mov rcx, rax
call fcn.14000165c
lea rcx, [0x140060d00]
lea rdx, str.____Set_VulnerableDriverBlocklistEnable_as_dword_to_0
call fcn.1400013b4
mov rcx, rax
call fcn.14000165c
test esi, esi
setns sil
jmp 0x14001168e
mov sil, 1
mov rax, qword [rbp + 0x38]
cmp rax, 8
jb 0x140011467
mov rcx, qword [rbp + 0x20]
lea rdx, [rax + rax]
add rdx, 2
call fcn.14000703b
jmp 0x140011467