Function at 0x140001a30
Capabilities:
Check if file exists
Create directory
Delete file
Enumerate processes
Extract resource via kernel32 functions
Move file
Persist via lnk shortcut
Persist via run registry key
Query environment variable
Set registry value
Terminate process

Disassembly:
sub rsp, 0xb48
mov dword [rsp + 0xb44], 0
mov qword [rsp + 0xb38], rcx
mov qword [rsp + 0xb30], rdx
mov qword [rsp + 0xb28], r8
mov dword [rsp + 0xb24], r9d
mov dword [rsp + 0xb1c], 8
mov dword [rsp + 0xb20], 0x4000
lea rcx, [rsp + 0xb1c]
call qword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0xb18], eax
mov ecx, 0xf
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0xb10], rax
mov dword [rsp + 0x8d8], 0x238
mov rcx, qword [rsp + 0xb10]
lea rdx, [rsp + 0x8d8]
call sub.KERNEL32.dll_Process32FirstW
mov dword [rsp + 0x8d4], eax
cmp dword [rsp + 0x8d4], 0
je 0x140001b8f
mov eax, dword [rsp + 0x8e0]
cmp eax, dword [rsp + 0xb18]
je 0x140001b6e
lea rcx, [rsp + 0x8d8]
add rcx, 0x2c
lea rdx, str.e_wings.exe
call sub.msvcrt.dll_wcscmp
cmp eax, 0
jne 0x140001b6e
mov r8d, dword [rsp + 0x8e0]
mov ecx, 1
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x8c8], rax
cmp qword [rsp + 0x8c8], 0
je 0x140001b69
mov rcx, qword [rsp + 0x8c8]
mov edx, 9
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x8c8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140001b6e
mov rcx, qword [rsp + 0xb10]
lea rdx, [rsp + 0x8d8]
call sub.KERNEL32.dll_Process32NextW
mov dword [rsp + 0x8d4], eax
jmp 0x140001ace
lea rcx, str.USERPROFILE
call sub.msvcrt.dll_getenv
mov qword [rsp + 0x8c0], rax
mov ecx, 0x104
mov edx, 1
call sub.msvcrt.dll_calloc
mov qword [rsp + 0x8b8], rax
mov rcx, qword [rsp + 0x8b8]
mov r8, qword [rsp + 0x8c0]
lea rdx, str._s.e_wings
call fcn.140002690
mov rcx, qword [rsp + 0x8b8]
xor eax, eax
mov edx, eax
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea rcx, [rsp + 0x7b0]
xor edx, edx
mov r8d, 0x104
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x7b0]
mov r8, qword [rsp + 0x8b8]
lea rdx, str._se_wings.exe
call fcn.140002690
lea rcx, [rsp + 0x6a0]
xor edx, edx
mov r8d, 0x104
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0x6a0]
xor eax, eax
mov ecx, eax
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rcx, [rsp + 0x6a0]
lea rdx, [rsp + 0x7b0]
call sub.msvcrt.dll_strcmp
cmp eax, 0
setne al
xor al, 0xff
and al, 1
movzx eax, al
mov dword [rsp + 0x69c], eax
cmp dword [rsp + 0x69c], 0
jne 0x140001ce2
lea rcx, [rsp + 0x7b0]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
cmp eax, 0
je 0x140001ca2
lea rcx, [rsp + 0x7b0]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rcx, [rsp + 0x6a0]
lea rdx, [rsp + 0x7b0]
call qword [sym.imp.KERNEL32.dll_MoveFileA]
cmp eax, 0
jne 0x140001cdd
lea rdx, [rsp + 0x6a0]
lea r8, [rsp + 0x7b0]
lea rcx, str.__s_____s__FAILED_TO_MOVE_FILE__n
call fcn.1400026e0
jmp 0x140001ce2
lea rcx, str.APPDATA
call sub.msvcrt.dll_getenv
mov qword [rsp + 0x690], rax
lea rcx, [rsp + 0x580]
xor edx, edx
mov r8d, 0x104
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x580]
mov r8, qword [rsp + 0x690]
lea rdx, str._sMicrosoftWindowsStart_MenuProgramsStartupe_wings.lnk
call fcn.140002690
lea rcx, [rsp + 0x580]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rcx, [rsp + 0x580]
mov r8, qword [rsp + 0x8c0]
lea rdx, str._sDesktope_wings.lnk
call fcn.140002690
lea rcx, [rsp + 0x580]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov qword [rsp + 0x578], 0
mov rcx, 0xffffffff80000001
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
lea r8, [rsp + 0x578]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov rax, qword [rsp + 0x578]
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x7b0]
mov qword [rsp + 0x80], rax
lea rcx, [rsp + 0x7b0]
call sub.msvcrt.dll_strlen
mov rcx, qword [rsp + 0x78]
mov r10, qword [rsp + 0x80]
add rax, 1
lea rdx, str.e_Wings
xor r8d, r8d
mov r9d, 1
mov qword [rsp + 0x20], r10
mov dword [rsp + 0x28], eax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea rcx, [rsp + 0x470]
xor edx, edx
mov r8d, 0x104
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x470]
mov r8, qword [rsp + 0x8c0]
lea rdx, str._sDesktop
call fcn.140002690
lea rcx, [rsp + 0x470]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
cmp eax, 0
jne 0x140001e8c
lea rcx, [rsp + 0x470]
mov r8, qword [rsp + 0x8c0]
lea rdx, str._sOneDriveDesktop
call fcn.140002690
lea rcx, [rsp + 0x470]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
cmp eax, 0
jne 0x140001e87
xor eax, eax
mov ecx, eax
lea rdx, str.Unable_to_find_desktop_folder_
lea r8, [0x140033188]
xor r9d, r9d
call qword [sym.imp.USER32.dll_MessageBoxW]
mov dword [rsp + 0xb44], 0xffffffff
jmp 0x14000267c
jmp 0x140001e8c
lea rcx, [rsp + 0x360]
xor edx, edx
mov r8d, 0x104
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x360]
lea r8, [rsp + 0x470]
lea rdx, str._se_wings.exe
call fcn.140002690
lea rcx, [rsp + 0x360]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
cmp eax, 0
jne 0x140001f33
lea rcx, [rsp + 0x360]
lea rdx, [rsp + 0x7b0]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CreateSymbolicLinkA]
cmp al, 0
jne 0x140001f33
lea r8, [rsp + 0x7b0]
xor eax, eax
mov r9d, eax
lea rdx, str.runas
mov rcx, r9
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 1
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0xb44], 0
jmp 0x14000267c
lea rcx, [rsp + 0x298]
xor edx, edx
mov r8d, 0xc8
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x298]
mov qword [0x14003c030], rax
mov rcx, qword [rsp + 0xb38]
mov rax, qword [0x14003c030]
mov qword [rax], rcx
mov ecx, dword [rsp + 0xb24]
mov rax, qword [0x14003c030]
mov dword [rax + 8], ecx
mov ecx, 0x10
xor r9d, r9d
lea rax, str.Arial
mov edx, r9d
mov r8d, r9d
mov dword [rsp + 0x20], 0x190
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x50], 0
mov dword [rsp + 0x58], 0
mov dword [rsp + 0x60], 0
mov qword [rsp + 0x68], rax
call qword [sym.imp.GDI32.dll_CreateFontW]
mov rcx, rax
mov rax, qword [0x14003c030]
mov qword [rax + 0x18], rcx
mov ecx, 0x19
xor r9d, r9d
lea rax, str.Arial
mov edx, r9d
mov r8d, r9d
mov dword [rsp + 0x20], 0x190
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x50], 0
mov dword [rsp + 0x58], 0
mov dword [rsp + 0x60], 0
mov qword [rsp + 0x68], rax
call qword [sym.imp.GDI32.dll_CreateFontW]
mov rcx, rax
mov rax, qword [0x14003c030]
mov qword [rax + 0x20], rcx
mov ecx, 0x14
xor r9d, r9d
lea rax, str.Arial
mov edx, r9d
mov r8d, r9d
mov dword [rsp + 0x20], 0x190
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x50], 0
mov dword [rsp + 0x58], 0
mov dword [rsp + 0x60], 0
mov qword [rsp + 0x68], rax
call qword [sym.imp.GDI32.dll_CreateFontW]
mov rcx, rax
mov rax, qword [0x14003c030]
mov qword [rax + 0x28], rcx
mov ecx, 0x18
xor r9d, r9d
lea rax, str.Arial
mov edx, r9d
mov r8d, r9d
mov dword [rsp + 0x20], 0x2bc
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x50], 0
mov dword [rsp + 0x58], 0
mov dword [rsp + 0x60], 0
mov qword [rsp + 0x68], rax
call qword [sym.imp.GDI32.dll_CreateFontW]
mov rcx, rax
mov rax, qword [0x14003c030]
mov qword [rax + 0x30], rcx
mov ecx, 0x19
xor r9d, r9d
lea rax, str.Arial
mov edx, r9d
mov r8d, r9d
mov dword [rsp + 0x20], 0x2bc
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x50], 0
mov dword [rsp + 0x58], 0
mov dword [rsp + 0x60], 0
mov qword [rsp + 0x68], rax
call qword [sym.imp.GDI32.dll_CreateFontW]
mov rcx, rax
mov rax, qword [0x14003c030]
mov qword [rax + 0x38], rcx
mov ecx, 0x23
xor r9d, r9d
lea rax, str.Arial
mov edx, r9d
mov r8d, r9d
mov dword [rsp + 0x20], 0x2bc
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x50], 0
mov dword [rsp + 0x58], 0
mov dword [rsp + 0x60], 0
mov qword [rsp + 0x68], rax
call qword [sym.imp.GDI32.dll_CreateFontW]
mov rcx, rax
mov rax, qword [0x14003c030]
mov qword [rax + 0x40], rcx
mov ecx, 0x19
xor r9d, r9d
lea rax, str.Arial
mov edx, r9d
mov r8d, r9d
mov dword [rsp + 0x20], 0x2bc
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x50], 0
mov dword [rsp + 0x58], 0
mov dword [rsp + 0x60], 0
mov qword [rsp + 0x68], rax
call qword [sym.imp.GDI32.dll_CreateFontW]
mov rcx, rax
mov rax, qword [0x14003c030]
mov qword [rax + 0x48], rcx
mov ecx, 1
mov edx, 0x88
call sub.msvcrt.dll_calloc
mov rcx, rax
mov rax, qword [0x14003c030]
mov qword [rax + 0x10], rcx
mov rax, qword [0x14003c030]
cmp qword [rax + 0x10], 0
jne 0x1400022f3
mov dword [rsp + 0xb44], 0xffffffff
jmp 0x14000267c
mov rax, qword [0x14003c030]
mov rcx, qword [rax + 0x10]
mov rdx, qword [rsp + 0x8b8]
call fcn.140013730
cmp eax, 0
je 0x14000233f
xor eax, eax
mov ecx, eax
lea rdx, str.Init_failed_
lea r8, [0x140033188]
xor r9d, r9d
call qword [sym.imp.USER32.dll_MessageBoxW]
mov dword [rsp + 0xb44], 0xffffffff
jmp 0x14000267c
mov rcx, qword [rsp + 0x8b8]
mov rax, qword [0x14003c030]
mov rax, qword [rax + 0x10]
mov qword [rax + 0x30], rcx
mov rax, qword [0x14003c030]
mov rax, qword [rax + 0x10]
lea rcx, str.0.3.1
mov qword [rax + 0x38], rcx
mov dword [rsp + 0x294], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x294]
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp dword [rsp + 0x294], 1
sete al
and al, 1
movzx eax, al
mov cx, ax
mov rax, qword [0x14003c030]
mov rax, qword [rax + 0x10]
mov word [rax + 0x48], cx
mov rax, qword [0x14003c030]
mov rax, qword [rax + 0x10]
lea rcx, [0x1400331c6]
mov qword [rax + 0x40], rcx
call fcn.140008b00
mov rax, qword [0x14003c030]
mov rax, qword [rax + 0x10]
cmp qword [rax], 0
jne 0x14000241e
call fcn.140008f50
cmp eax, 0
je 0x140002419
xor eax, eax
mov ecx, eax
lea rdx, [0x1400331ca]
lea r8, [0x140033188]
xor r9d, r9d
call qword [sym.imp.USER32.dll_MessageBoxW]
mov dword [rsp + 0xb44], 0xffffffff
jmp 0x14000267c
jmp 0x14000241e
mov rax, qword [0x14003c030]
mov rcx, qword [rax + 0x10]
mov edx, 1
call fcn.140014210
mov dword [rsp + 0x290], eax
cmp dword [rsp + 0x290], 0xffffffff
jne 0x14000244d
jmp 0x1400024d2
cmp dword [rsp + 0x290], 1
jne 0x1400024cd
lea rcx, [rsp + 0x90]
xor edx, edx
mov r8d, 0x200
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x90]
mov rax, qword [0x14003c030]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
lea rdx, str._se_wings_new.exe
call fcn.140002690
lea r8, [rsp + 0x90]
xor eax, eax
mov r9d, eax
mov rcx, r9
mov rdx, r9
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 1
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0xb44], 0
jmp 0x14000267c
jmp 0x1400024d2
lea rcx, [rsp + 0x298]
call fcn.140002d90
cmp eax, 0
je 0x140002513
xor eax, eax
mov ecx, eax
lea rdx, str.Failed_to_register_ew_controls
lea r8, [0x140033188]
xor r9d, r9d
call qword [sym.imp.USER32.dll_MessageBoxW]
mov dword [rsp + 0xb44], 0xffffffff
jmp 0x14000267c
mov rax, qword [0x14003c030]
mov rcx, qword [rax]
lea rdx, str.notification
lea r8, str.WAVE
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov qword [rsp + 0x88], rax
cmp qword [rsp + 0x88], 0
jne 0x140002573
xor eax, eax
mov ecx, eax
lea rdx, str.Failed_to_load_notification_sound__n
lea r8, [0x140033188]
xor r9d, r9d
call qword [sym.imp.USER32.dll_MessageBoxW]
mov dword [rsp + 0xb44], 0xffffffff
jmp 0x14000267c
mov rax, qword [0x14003c030]
mov rcx, qword [rax]
mov rdx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
mov rax, qword [0x14003c030]
mov qword [rax + 0xb8], rcx
mov rax, qword [0x14003c030]
cmp qword [rax + 0xb8], 0
jne 0x1400025dc
xor eax, eax
mov ecx, eax
lea rdx, str.Failed_to_load_notification_sound__n
lea r8, [0x140033188]
xor r9d, r9d
call qword [sym.imp.USER32.dll_MessageBoxW]
mov dword [rsp + 0xb44], 0xffffffff
jmp 0x14000267c
mov rax, qword [0x14003c030]
mov rcx, qword [rax + 0xb8]
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rcx, rax
mov rax, qword [0x14003c030]
mov qword [rax + 0xc0], rcx
mov rax, qword [0x14003c030]
mov rax, qword [rax + 0x10]
lea rcx, [0x140002730]
mov qword [rax + 0x70], rcx
mov rax, qword [0x14003c030]
mov rax, qword [rax + 0x10]
lea rcx, [0x140002760]
mov qword [rax + 0x78], rcx
call fcn.140007560
call fcn.140004c70
cmp eax, 0
je 0x14000266b
xor eax, eax
mov ecx, eax
lea rdx, str.Failed_to_show_dashboard
lea r8, [0x140033188]
xor r9d, r9d
call qword [sym.imp.USER32.dll_MessageBoxW]
mov dword [rsp + 0xb44], 0xffffffff
jmp 0x14000267c
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov dword [rsp + 0xb44], 0
mov eax, dword [rsp + 0xb44]
add rsp, 0xb48
ret
push rdi
push rsi
push rbx
sub rsp, 0x90
xor esi, esi
call fcn.14001f860
call fcn.14002b530
mov rbx, qword [rax]
test rbx, rbx
jne 0x140031b5b
jmp 0x140031bd1
test cl, cl
je 0x140031b88
and esi, 1
je 0x140031b70
mov esi, 1
call sub.msvcrt.dll__ismbblead
test eax, eax
je 0x140031b57
cmp byte [rbx + 1], 1
sbb rbx, 0xffffffffffffffff
add rbx, 1
movsx ecx, byte [rbx]
cmp cl, 0x20
jle 0x140031b38
mov eax, esi
xor eax, 1
cmp cl, 0x22
cmove esi, eax
jmp 0x140031b46
test cl, cl
je 0x140031b88
nop dword [rax]
movzx eax, byte [rbx + 1]
add rbx, 1
test al, al
je 0x140031b88
cmp al, 0x20
jle 0x140031b78
lea rdx, [rsp + 0x20]
xor eax, eax
mov ecx, 0xd
mov rdi, rdx
rep stosq qword [rdi], rax
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov r9d, 0xa
test byte [rsp + 0x5c], 1
je 0x140031bb6
movzx r9d, word [rsp + 0x60]
mov rcx, qword [0x1400365e0]
mov r8, rbx
xor edx, edx
add rsp, 0x90
pop rbx
pop rsi
pop rdi
jmp 0x140001a30
lea rbx, [0x140035930]
jmp 0x140031b88