Function at 0x14010cae0
Capabilities:
Create process on windows
Self delete
Set registry value

Disassembly:
sub rsp, 0x28
xor edx, edx
lea rcx, str.reg_delete__HKLMSOFTWAREMICROSOFTTRACING___f
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.cmd__c_del__f__s__q__UserProfile_AppDataLocalMicrosoftWindowsTemporary_Internet_Files.
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.cmd__c_del__f__s__q__UserProfile_AppDataLocalMicrosoftWindowsHistory.
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.cmd__c_del__f__s__q__UserProfile_AppDataRoamingMicrosoftWindowsCookies.
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.cmd__c_del__f__s__q_C:Windows_tracing.
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.cmd__c_del__f__s__q_C:WindowsMinidump.
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.cmd__c_del__f__s__q__userprofile_AppData.dmp
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.cmd__c_del__f__s__q__userprofile_AppDataLocalTemp.tmp
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.cmd__c_del__f__s__q__userprofile_AppDataLocalTemp.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.cmd__c_del__f__s__q__userprofile_AppDataLocalTemp.sys
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.cmd__c_del__f__s__q__userprofile_AppDataLocalTemp.theme
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.cmd__c_del__f__s__q__userprofile_AppDataLocalTslGame.runtime_xml
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.cmd__c_del__f__s__q__userprofile_AppDataLocalTslGame.log
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.reg_add__HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced___v_Start_TrackProgs__t_REG_DWORD__d_0__f
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.reg_add__HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced___v_Start_TrackDocs__t_REG_DWORD__d_0__f
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.reg_delete__HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerUserAssist___f
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.reg_delete__HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerRecentDocs___f
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.reg_delete__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerComDlg32___f
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.reg_delete__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerRunMRU___f
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.reg_delete__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerTypedPaths___f
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.powershell_clear_eventlog__log_application__system__security__Windows_Powershell
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.cmd__c_attrib__s__h_C:WindowsAppCompatPrograms.__S__del__f__s__q_C:WindowsAppCompatPrograms.
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.reg_delete__HKEY_LOCAL_MACHINESoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers___f
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.reg_delete__HKEY_CURRENT_USERSoftwareWinRARDialogEditHistoryArcName___f
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.reg_delete__HKEY_CURRENT_USERSoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsCompatibility_Assistant___f
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.reg_delete__HKEY_CLASSES_ROOTLocal_SettingsSoftwareMicrosoftWindowsShellMuiCache___f
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.reg_delete__HKEY_CURRENT_USERSoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers___f
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.reg_delete__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSession_ManagerAppCompatCache___f
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.reg_delete__HKEY_CURRENT_USERSoftwareClassesLocal_SettingsSoftwareMicrosoftWindowsShell___f
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_WinExec]