Function at 0x140003400
Capabilities:
Create process on windows
Persist via run registry key
Set registry value
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x360
mov rax, qword [0x140019040]
xor rax, rsp
mov qword [rsp + 0x358], rax
mov r13, rdx
mov rdi, rcx
xor r15d, r15d
mov dword [rsp + 0x110], r15d
mov r8d, 0x104
lea rdx, [rsp + 0x240]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x1400040fd
lea rax, [rsp + 0x240]
mov rbx, 0xffffffffffffffff
nop word [rax + rax]
inc rbx
cmp byte [rax + rbx], r15b
jne 0x140003470
call fcn.1400101cc
lea rcx, [rsp + 0x240]
mov qword [rsp + 0x130], rcx
mov qword [rsp + 0x138], rbx
lea r8, [rsp + 0x130]
mov edx, eax
lea rcx, [rsp + 0x50]
call fcn.140001ca0
mov dword [rsp + 0x110], 3
mov qword [rsp + 0x130], r15
lea rsi, [0x1400190f0]
mov qword [rsp + 0x138], rsi
lea r8, [rsp + 0x130]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x150]
call fcn.140002e00
mov dword [rsp + 0x110], 7
cmp dword [rsp + 0x130], 0
jne 0x14000412a
lea rax, [rsp + 0x150]
cmp qword [rsp + 0x168], 7
cmova rax, qword [rsp + 0x150]
mov qword [rsp + 0x130], rax
mov rax, qword [rsp + 0x160]
mov qword [rsp + 0x138], rax
call fcn.1400101cc
movaps xmm0, xmmword [rsp + 0x130]
movdqa xmmword [rsp + 0x130], xmm0
lea r8, [rsp + 0x130]
mov edx, eax
lea rcx, [rsp + 0x190]
call fcn.14000ab70
nop
mov rdx, qword [rsp + 0x168]
cmp rdx, 7
jbe 0x1400035aa
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x150]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400035a5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400035a5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400110e4
movdqa xmm0, xmmword [0x140013f60]
movdqu xmmword [rsp + 0x160], xmm0
mov word [rsp + 0x150], r15w
mov rdx, qword [rsp + 0x68]
cmp rdx, 7
jbe 0x140003611
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003604
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003604
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400110e4
movdqa xmm0, xmmword [0x140013f60]
movdqu xmmword [rsp + 0x60], xmm0
mov word [rsp + 0x50], r15w
mov rbx, qword [rdi + 0x10]
cmp qword [rdi + 0x18], 0xf
jbe 0x14000362b
mov rdi, qword [rdi]
call fcn.1400101cc
mov qword [rsp + 0x130], rdi
mov qword [rsp + 0x138], rbx
lea r8, [rsp + 0x130]
mov edx, eax
lea rcx, [rsp + 0xd0]
call fcn.140001ca0
mov dword [rsp + 0x110], 0xfb
mov qword [rsp + 0x130], r15
mov qword [rsp + 0x138], rsi
lea r8, [rsp + 0x130]
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x70]
call fcn.140002e00
mov dword [rsp + 0x110], 0x1fb
cmp dword [rsp + 0x130], 0
jne 0x140004144
lea rax, [rsp + 0x70]
cmp qword [rsp + 0x88], 7
cmova rax, qword [rsp + 0x70]
mov qword [rsp + 0x130], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x138], rax
call fcn.1400101cc
movaps xmm0, xmmword [rsp + 0x130]
movdqa xmmword [rsp + 0x130], xmm0
lea r8, [rsp + 0x130]
mov edx, eax
lea rcx, [rsp + 0x170]
call fcn.14000ab70
nop
mov rdx, qword [rsp + 0x88]
cmp rdx, 7
jbe 0x140003747
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003742
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003742
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400110e4
movdqa xmm0, xmmword [0x140013f60]
movdqu xmmword [rsp + 0x80], xmm0
mov word [rsp + 0x70], r15w
mov rdx, qword [rsp + 0xe8]
cmp rdx, 7
jbe 0x1400037b1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400037a4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400037a4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400110e4
movdqa xmm0, xmmword [0x140013f60]
movdqu xmmword [rsp + 0xe0], xmm0
mov word [rsp + 0xd0], r15w
lea rdx, [rsp + 0x170]
mov rdi, qword [rsp + 0x170]
mov r14, qword [rsp + 0x188]
cmp r14, 0xf
cmova rdx, rdi
lea rcx, [rsp + 0x190]
mov rbx, qword [rsp + 0x190]
mov rsi, qword [rsp + 0x1a8]
cmp rsi, 0xf
cmova rcx, rbx
mov r8, qword [rsp + 0x1a0]
cmp r8, qword [rsp + 0x180]
jne 0x1400038d9
test r8, r8
je 0x140003830
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
sete al
test al, al
je 0x1400038d9
cmp r14, 0xf
jbe 0x14000387a
lea rdx, [r14 + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140003862
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003862
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.1400110e4
mov rsi, qword [rsp + 0x1a8]
mov rbx, qword [rsp + 0x190]
mov qword [rsp + 0x180], r15
mov qword [rsp + 0x188], 0xf
mov byte [rsp + 0x170], 0
cmp rsi, 0xf
jbe 0x1400040fd
lea rdx, [rsi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x1400038cc
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400038cc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.1400110e4
jmp 0x1400040fd
mov rdi, qword [rsp + 0x180]
lea rbx, [rsp + 0x170]
cmp qword [rsp + 0x188], 0xf
cmova rbx, qword [rsp + 0x170]
call fcn.1400101cc
mov qword [rsp + 0x130], rbx
mov qword [rsp + 0x138], rdi
lea r8, [rsp + 0x130]
mov edx, eax
lea rcx, [rsp + 0x50]
call fcn.140001ca0
nop
mov rdi, qword [rsp + 0x1a0]
lea rbx, [rsp + 0x190]
cmp qword [rsp + 0x1a8], 0xf
cmova rbx, qword [rsp + 0x190]
call fcn.1400101cc
mov qword [rsp + 0x130], rbx
mov qword [rsp + 0x138], rdi
lea r8, [rsp + 0x130]
mov edx, eax
lea rcx, [rsp + 0x150]
call fcn.140001ca0
nop
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 7
cmova rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x150]
cmp qword [rsp + 0x168], 7
cmova rcx, qword [rsp + 0x150]
mov r8d, 2
call fcn.14001042c
mov rdx, rax
shr rax, 0x20
test eax, eax
jne 0x140004161
mov rdx, qword [rsp + 0x168]
cmp rdx, 7
jbe 0x140003a04
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x150]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400039ff
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400039ff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400110e4
movdqa xmm0, xmmword [0x140013f60]
movdqu xmmword [rsp + 0x160], xmm0
mov word [rsp + 0x150], r15w
mov rdx, qword [rsp + 0x68]
cmp rdx, 7
jbe 0x140003a63
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003a5e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003a5e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400110e4
lea rax, [rsp + 0x110]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
movabs rsi, 0x7fffffffffffffff
test eax, eax
jne 0x140003cf0
mov rax, rsi
mov rcx, qword [rsp + 0x180]
sub rax, rcx
cmp rax, 1
jb 0x140004178
lea rax, [rsp + 0x170]
cmp qword [rsp + 0x188], 0xf
cmova rax, qword [rsp + 0x170]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 1
lea r9, [0x14001385c]
lea rcx, [rsp + 0xf0]
call fcn.1400086f0
nop
mov r8d, 2
lea rdx, [0x140013858]
lea rcx, [rsp + 0xf0]
call fcn.140006530
xorps xmm0, xmm0
movups xmmword [rsp + 0x130], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x140], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x130], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x140], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, r13
lea rcx, [rsp + 0x130]
call fcn.140006070
xorps xmm0, xmm0
movups xmmword [rsp + 0x150], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x160], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x150], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x160], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x148]
cmp rdx, 0xf
jbe 0x140003be3
inc rdx
mov rcx, qword [rsp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003bde
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003bde
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400110e4
movdqa xmm0, xmmword [0x140013f70]
movdqu xmmword [rsp + 0x140], xmm0
mov byte [rsp + 0x130], 0
mov rdx, qword [rsp + 0x108]
cmp rdx, 0xf
jbe 0x140003c42
inc rdx
mov rcx, qword [rsp + 0xf0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003c3d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003c3d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400110e4
mov eax, dword [rsp + 0x160]
inc eax
lea rcx, [rsp + 0x150]
cmp qword [rsp + 0x168], 0xf
cmova rcx, qword [rsp + 0x150]
lea rdx, str.TcMwDrive
cmp qword [0x1400190e8], 0xf
cmova rdx, qword [str.TcMwDrive]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rsp + 0x168]
cmp rdx, 0xf
jbe 0x140003cf0
inc rdx
mov rcx, qword [rsp + 0x150]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003ceb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003ceb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400110e4
mov dword [rsp + 0x1d0], 0x68
xorps xmm0, xmm0
movups xmmword [rsp + 0x1d8], xmm0
movups xmmword [rsp + 0x1e8], xmm0
movups xmmword [rsp + 0x1f8], xmm0
movups xmmword [rsp + 0x208], xmm0
movups xmmword [rsp + 0x218], xmm0
movups xmmword [rsp + 0x228], xmm0
mov r14, qword [rsp + 0x180]
mov rax, rsi
sub rax, r14
cmp rax, 1
jb 0x14000417d
lea r12, [rsp + 0x170]
cmp qword [rsp + 0x188], 0xf
cmova r12, qword [rsp + 0x170]
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
lea r15, [r14 + 1]
mov ebx, 0xf
lea rdi, [rsp + 0x50]
cmp r15, rbx
jbe 0x140003e11
mov rbx, r15
or rbx, 0xf
cmp rbx, rsi
jbe 0x140003dc8
mov rbx, rsi
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140010e60
test rax, rax
je 0x140004034
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
xor esi, esi
mov qword [rsp + 0x50], rdi
jmp 0x140003e13
mov eax, 0x16
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x140003de8
xor esi, esi
mov edi, esi
mov qword [rsp + 0x50], rsi
jmp 0x140003e13
cmp rcx, 0x1000
jb 0x140003e00
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140004182
jmp 0x140003da2
call fcn.140010e60
mov rdi, rax
xor esi, esi
mov qword [rsp + 0x50], rax
jmp 0x140003e13
xor esi, esi
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], rbx
mov r8, r14
mov rdx, r12
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r14], 0x20
mov byte [rdi + r15], 0
mov rdx, r13
lea rcx, [rsp + 0x50]
call fcn.140006070
xorps xmm0, xmm0
movups xmmword [rsp + 0xb0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0xc0], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0xb0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0xc0], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r8d, 1
lea rdx, [0x140013860]
lea rcx, [rsp + 0xb0]
call fcn.140006530
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0xa0], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x90], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0xa0], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rsp + 0x190]
cmp qword [rsp + 0x1a8], 0xf
cmova rdx, qword [rsp + 0x190]
mov r8, qword [rsp + 0x1a0]
lea rcx, [rsp + 0x90]
call fcn.140006530
xorps xmm0, xmm0
movups xmmword [rsp + 0x1b0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x1c0], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x1b0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x1c0], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0xa8]
cmp rdx, 0xf
jbe 0x140003f88
inc rdx
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003f83
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003f83
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400110e4
movdqa xmm0, xmmword [0x140013f70]
movdqu xmmword [rsp + 0xa0], xmm0
mov byte [rsp + 0x90], 0
mov rdx, qword [rsp + 0xc8]
cmp rdx, 0xf
jbe 0x140003fef
inc rdx
mov rcx, qword [rsp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003fe2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003fe2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400110e4
movdqa xmm0, xmmword [0x140013f70]
movdqu xmmword [rsp + 0xc0], xmm0
mov byte [rsp + 0xb0], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140004040
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000403b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000403b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400110e4
lea rdx, [rsp + 0x1b0]
cmp qword [rsp + 0x1c8], 0xf
cmova rdx, qword [rsp + 0x1b0]
lea rcx, [rsp + 0x170]
cmp qword [rsp + 0x188], 0xf
cmova rcx, qword [rsp + 0x170]
lea rax, [rsp + 0x118]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x1d0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x1400040d9
mov rcx, qword [rsp + 0x118]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x120]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
lea rcx, [rsp + 0x170]
call fcn.140006110
nop
lea rcx, [rsp + 0x190]
call fcn.140006110
mov rcx, qword [rsp + 0x358]
xor rcx, rsp
call fcn.140010d20
lea r11, [rsp + 0x360]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x130]
lea rcx, str.absolute
call fcn.140002da0
nop
lea r8, [rsp + 0xd0]
lea rdx, [rsp + 0x130]
lea rcx, str.absolute
call fcn.140002da0
nop
shr rdx, 0x20
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x150]
call fcn.140002d20
nop
call fcn.140001270
call fcn.140001270
call fcn.1400011d0
int3