Function at 0x14020b800
Capabilities:
Delete volume shadow copies
Execute command
Persist via windows service
Self delete
Set registry value

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rax, qword [0x14038c0c0]
xor rax, rsp
mov qword [rbp + 0x47], rax
lea rcx, [rbp + 0x27]
call fcn.14020abf0
nop
lea rax, [rbp - 9]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
lea rdx, str.ComputerHKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlIDConfigDBHardware_Profiles0001
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14020b8c6
mov eax, dword [rbp + 0x37]
inc eax
lea rcx, [rbp + 0x27]
cmp qword [rbp + 0x3f], 0xf
cmova rcx, qword [rbp + 0x27]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
lea rdx, str.HwProfileGuid
mov rcx, qword [rbp - 9]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor ecx, ecx
test eax, eax
jne 0x14020b8a2
mov r9d, 0x40
lea r8, str.Success
lea rdx, str.HwProfileGuid_successfully_updated_
jmp 0x14020b8b6
mov r9d, reloc.WS2_32.dll_recv
lea r8, str.Error
lea rdx, str.Could_not_set_registry_value.
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rcx, qword [rbp - 9]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rbp + 7]
call fcn.14020b2f0
lea rax, [rbp - 1]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
lea rdx, str.ComputerHKEY_LOCAL_MACHINESOFTWAREMicrosoftCryptography
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14020b96f
mov eax, dword [rbp + 0x17]
inc eax
lea rcx, [rbp + 7]
cmp qword [rbp + 0x1f], 0xf
cmova rcx, qword [rbp + 7]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
lea rdx, str.MachineGuid
mov rcx, qword [rbp - 1]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor ecx, ecx
test eax, eax
jne 0x14020b94b
mov r9d, 0x40
lea r8, str.Success
lea rdx, str.MachineGuid_successfully_updated_
jmp 0x14020b95f
mov r9d, reloc.WS2_32.dll_recv
lea r8, str.Error
lea rdx, str.Could_not_set_registry_value.
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rcx, qword [rbp - 9]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp - 1]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
lea rdx, str.ComputerHKEY_LOCAL_MACHINESOFTWAREMicrosoftCryptography
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14020ba0f
mov eax, dword [rbp + 0x17]
inc eax
lea rcx, [rbp + 7]
cmp qword [rbp + 0x1f], 0xf
cmova rcx, qword [rbp + 7]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
lea rdx, str.GUID
mov rcx, qword [rbp - 1]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor ecx, ecx
test eax, eax
jne 0x14020b9eb
mov r9d, 0x40
lea r8, str.Success
lea rdx, str.GUID_successfully_updated_
jmp 0x14020b9ff
mov r9d, reloc.WS2_32.dll_recv
lea r8, str.Error
lea rdx, str.Could_not_set_registry_value.
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rcx, qword [rbp - 9]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, str.START__B_cmd__c_REG_ADD_HKLMSYSTEMCurrentControlSetControlComputerNameComputerName__v_ComputerName__t_REG_SZ__d__Random___f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.START__B_cmd__c_REG_ADD_HKLMSYSTEMCurrentControlSetControlComputerNameActiveComputerName__v_ComputerName__t_REG_SZ__d__Random___f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.START__B_cmd__c_REG_ADD_HKLMSYSTEMCurrentControlSetControlSystemInformation__v_ComputerHardwareId__t_REG_SZ__d__Random__Random___Random__Random___Random__Random___f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.START__B_cmd__c_REG_ADD_HKLMSYSTEMCurrentControlSetControlIDConfigDBHardware___Profiles0001__v_HwProfileGuid__t_REG_SZ__d__Random__Random___Random__Random___Random__Random___f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.START__B_cmd__c_REG_ADD_HKLMSOFTWAREMicrosoftSQMClient__v_MachineId__t_REG_SZ__d__Random__Random___Random__Random___Random__Random___f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.START__B_cmd__c_REG_ADD_HKLMSOFTWAREMicrosoftWindows___NTCurrentVersion__v_InstallTime__t_REG_QWORD__d__Random__Random___Random__Random___Random__Random___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.START__B_cmd__c_REG_ADD_HKLMSOFTWAREMicrosoftWindows___NTCurrentVersion__v_InstallDate__t_REG_QWORD__d__Random__Random___Random__Random___Random__Random___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.START__B_cmd__c_REG_ADD_HKLMSOFTWAREMicrosoftCryptography__v_MachineGuid__t_REG_SZ__d__Random__Random___Random__Random___Random__Random___f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.START__B_cmd__c_REG_ADD_HKLMSOFTWAREMicrosoftCryptography__v_GUID__t_REG_SZ__d__Random__Random___Random__Random___Random__Random___f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.START__B_cmd__c_REG_ADD_HKLMSOFTWARENVIDIA___CorporationGlobal__v_ClientUUID__t_REG_SZ__d__Random__Random___Random__Random___Random__Random___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.START__B_cmd__c_REG_ADD_HKLMHARDWAREDEVICEMAPScsiScsi___Port___0Scsi___Bus___0Target___Id___0Logical___Unit___Id___0__v_Identifier__t_REG_SZ__d__Random__Random___Random__Random___Random__Random___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.START__B_cmd__c_REG_ADD_HKLMHARDWAREDEVICEMAPScsiScsi___Port___1Scsi___Bus___0Target___Id___0Logical___Unit___Id___0__v_Identifier__t_REG_SZ__d__Random__Random___Random__Random___Random__Random___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.START__B_cmd__c_REG_ADD_HKLMHARDWAREDESCRIPTIONSystemMultifunctionAdapter0DiskController0DiskPeripheral0__v_Identifier__t_REG_SZ__d__Random__Random___Random__Random___Random__Random___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.START__B_cmd__c_REG_ADD_HKLMHARDWAREDESCRIPTIONSystemMultifunctionAdapter0DiskController0DiskPeripheral1__v_Identifier__t_REG_SZ__d__Random__Random___Random__Random___Random__Random___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.START__B_cmd__c_REG_ADD_HKLMSYSTEMControlSet001ServicesBasicDisplayVideo__v_VideoID__t_REG_SZ__d__Random__Random___Random__Random___Random__Random___f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.START__B_cmd__c_REG_ADD_HKLMSYSTEMCurrentControlSetServicesTcpipParameters__v_Hostname__t_REG_SZ__d__Random__Random___Random__Random___Random__Random___f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.START__B_cmd__c_REG_ADD_HKLMSystemCurrentControlSetServicesTcpipParameters__v_Domain__t_REG_SZ__d__Random__Random___Random__Random___Random__Random___f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.START__B_cmd__c_REG_ADD_HKLMSystemCurrentControlSetControlDevQuery6__v_UUID__t_REG_SZ__d_Random__Random___Random__Random___Random__Random___f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.START__B_cmd__c_REG_ADD_HKLMSYSTEMCurrentControlSetServicesTcpipParameters__v_NV___Hostname__t_REG_SZ__d__Random__Random___Random__Random___Random__Random___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.START__B_cmd__c_REG_ADD_HKLMSOFTWAREMicrosoftWindows___NTCurrentVersion__v_ProductId__t_REG_SZ__d__Random__Random___Random__Random___Random__Random___f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.START__B_cmd__c_REG_ADD_HKLMSOFTWAREMicrosoftWindows___NTCurrentVersion__v_BuildGUID__t_REG_SZ__d__Random__Random___Random__Random___Random__Random___f__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.START__B_cmd__c_sc_stop_winmgmt__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.START__B_cmd__c_sc_start_winmgmt__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.START__B_cmd__c_net_stop_winmgmt__y__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.START__B_cmd__c_net_start_winmgmt__y__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.START__B_cmd__c_powershell_vssadmin_delete_shadows__all__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.START__B_cmd__c_powershell_Reset_PhysicalDisk___nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.START__B_cmd__c_fsutil_usn_deletejournal__n_C:__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.START__B_cmd__c_fsutil_usn_deletejournal__n_D:__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.START__B_cmd__c_fsutil_usn_deletejournal__n_E:__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.START__B_cmd__c_fsutil_usn_deletejournal__n_F:__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.START__B_cmd__c_del__s__f__q_C:WindowsSystem32_restoreMachineGuid.txt__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.START__B_cmd__c_del__s__f__q_C:System_Volume_InformationIndexerVolumeGuid__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.START__B_cmd__c_del__s__f__q_C:System_Volume_Information_tracking.log__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.START__B_cmd__c_del__s__f__q_C:WindowsINF_setupapi.dev.log__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.START__B_cmd__c_del__s__f__q_C:WindowsINF_setupapi.setup.log__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.START__B_cmd__c_rmdir__s__q_C:Windows_temp__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.START__B_cmd__c_rmdir__s__q_C:Users_username_AppDataLocalTemp__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.START__B_cmd__c_rmdir__s__q_C:WindowsPrefetch__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0xf
jbe 0x14020bc48
inc rdx
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14020bc43
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14020bc43
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1402f7b14
movdqa xmm0, xmmword [0x14036ebe0]
movdqu xmmword [rbp + 0x17], xmm0
mov byte [rbp + 7], 0
mov rdx, qword [rbp + 0x3f]
cmp rdx, 0xf
jbe 0x14020bc97
inc rdx
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14020bc92
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14020bc92
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1402f7b14
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1402f73e0
add rsp, 0x90
pop rbp
ret