Function at 0x140001300
Capabilities:
Acquire debug privileges
Delete registry value
Schedule task via itaskscheduler
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x140017008]
xor rax, rsp
mov qword [rsp + 0x58], rax
xor ecx, ecx
call fcn.1400037e0
mov rcx, rax
call fcn.1400037c8
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
mov ecx, 0x410
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor edi, edi
mov rbx, rax
test rax, rax
je 0x1400013cc
lea r8, [rsp + 0x30]
mov rcx, rax
lea edx, [rdi + 0x28]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1400013c3
lea r8, [rsp + 0x40]
xor ecx, ecx
lea rdx, str.SeDebugPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x1400013c3
mov rax, qword [rsp + 0x40]
lea r9d, [rdi + 0x10]
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x48]
mov qword [rsp + 0x28], rdi
xor edx, edx
mov qword [rsp + 0x4c], rax
mov dword [rsp + 0x48], 1
mov dword [rsp + 0x54], 2
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x1400013c3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x38]
mov r9d, 0xf013f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWARE
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140001409
mov rcx, qword [rsp + 0x38]
lea rdx, str._fbybcexlstager
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
js 0x140001465
xor edx, edx
mov qword [rsp + 0x40], rdi
lea rax, [rsp + 0x40]
lea r9, [0x140014730]
mov qword [rsp + 0x20], rax
lea rcx, [0x140014720]
lea r8d, [rdx + 1]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x14000145f
mov rcx, qword [rsp + 0x40]
lea rdx, str._fbybcexl0x98c236
mov rax, qword [rcx]
call qword [rax + 0x38]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, 0x3e80
call fcn.1400015f8
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x3e8
mov rcx, rax
mov rbp, rax
call section..text
test eax, eax
je 0x1400014e9
mov ecx, dword [rsp + 0x40]
test ecx, ecx
je 0x1400014e9
mov qword [rsp + 0x70], r14
mov rbx, rbp
mov r14d, 0x7273
mov esi, ecx
cmp word [rbx + 4], r14w
jne 0x1400014da
mov r8d, dword [rbx]
cmp r8d, 0xffffffff
je 0x1400014da
xor edx, edx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x1400014da
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 0x10
sub rsi, 1
jne 0x1400014a3
mov r14, qword [rsp + 0x70]
mov rcx, rbp
call fcn.1400015b4
mov ecx, 0x3e80
call fcn.1400015f8
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x3e8
mov rcx, rax
mov rsi, rax
call section..text
test eax, eax
je 0x140001548
mov ecx, dword [rsp + 0x40]
test ecx, ecx
je 0x140001548
mov rbx, rsi
mov edi, ecx
mov ebp, 0x7277
nop dword [rax]
cmp word [rbx + 4], bp
jne 0x14000153e
mov rcx, rbx
call fcn.140001200
add rbx, 0x10
sub rdi, 1
jne 0x140001530
mov rcx, rsi
call fcn.1400015b4
xor eax, eax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140001590
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret