Function at 0x180001d80
Capabilities:
Access the windows event log
Enumerate services
Get system information on windows
Persist via run registry key
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xbfd0]
mov eax, 0xc0d0
call fcn.1800197c0
sub rsp, rax
movaps xmmword [rsp + 0xc0c0], xmm6
mov rax, qword [0x180053028]
xor rax, rsp
mov qword [rbp + 0xbfb0], rax
mov r12, rdx
mov r15, rcx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x60], rdx
xor r13d, r13d
mov dword [rsp + 0x40], r13d
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rcx, str.Processor_Architecture:
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180001dfd
lea rcx, str.Processor_Architecture:
call fcn.180001120
movzx eax, word [rbp - 0x80]
test eax, eax
je 0x180001e5d
cmp eax, 5
je 0x180001e43
cmp eax, 9
je 0x180001e29
lea rcx, str.Unknown_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180001e7a
lea rcx, str.Unknown_n
jmp 0x180001e75
lea rcx, str.AMD64_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180001e7a
lea rcx, str.AMD64_n
jmp 0x180001e75
lea rcx, str.ARM_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180001e7a
lea rcx, str.ARM_n
jmp 0x180001e75
lea rcx, str.Intel_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180001e7a
lea rcx, str.Intel_n
call fcn.180001120
lea rcx, str.Number_of_Processors:__u_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180001e9a
mov edx, dword [rbp - 0x60]
lea rcx, str.Number_of_Processors:__u_n
call fcn.180001120
lea rdx, str.Security
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenEventLogA]
mov rdi, rax
test rax, rax
je 0x18000202d
mov ecx, 0x10000
call fcn.180020ffc
mov rbx, rax
test rax, rax
je 0x180002016
mov qword [rsp + 0x30], r13
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x10000
mov r9, rbx
xor r8d, r8d
lea edx, [r8 + 5]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_ReadEventLogA]
test eax, eax
je 0x180002003
nop dword [rax]
lea rcx, str.Event_ID:__lu_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180001f20
mov edx, dword [rbx + 0x14]
lea rcx, str.Event_ID:__lu_n
call fcn.180001120
lea rcx, str.Event_Type:__lu_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180001f41
movzx edx, word [rbx + 0x18]
lea rcx, str.Event_Type:__lu_n
call fcn.180001120
lea rcx, str.Event_Category:__lu_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180001f62
movzx edx, word [rbx + 0x1c]
lea rcx, str.Event_Category:__lu_n
call fcn.180001120
lea rcx, str.Time_Generated:__s_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180001f8b
lea rcx, [rbx + 0xc]
call fcn.180020f88
mov rdx, rax
lea rcx, str.Time_Generated:__s_n
call fcn.180001120
lea rcx, str.Source_Name:__s_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180001fae
mov edx, dword [rbx + 0x24]
add rdx, rbx
lea rcx, str.Source_Name:__s_n
call fcn.180001120
lea rcx, str.Event_String:__s_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180001fd1
mov edx, dword [rbx + 0x34]
add rdx, rbx
lea rcx, str.Event_String:__s_n
call fcn.180001120
mov qword [rsp + 0x30], r13
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x10000
mov r9, rbx
xor r8d, r8d
lea edx, [r8 + 5]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_ReadEventLogA]
test eax, eax
jne 0x180001f00
mov rcx, rbx
call fcn.180020c30
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseEventLog]
jmp 0x180002039
lea rcx, str.Error_allocating_memory_for_event_log_record
call fcn.18001db60
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseEventLog]
jmp 0x180002039
lea rcx, str.Error_opening_event_log
call fcn.18001db60
lea rcx, str.Hello__World__n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180002056
lea rcx, str.Hello__World__n
call fcn.180001120
mov qword [r15], r13
mov qword [r15 + 0x10], r13
mov qword [r15 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r15], 0
mov r14d, 1
mov dword [rsp + 0x40], r14d
lea rcx, str.Square_of__d_is__d_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180002099
lea edx, [r14 + 3]
lea r8d, [r14 + 0xf]
lea rcx, str.Square_of__d_is__d_n
call fcn.180001120
mov dword [rsp + 0x78], r13d
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rsi, rax
test rax, rax
jne 0x1800020c7
lea rcx, str.Error_opening_service_control_manager
call fcn.18001db60
jmp 0x1800021e9
lea rax, [rsp + 0x78]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xc000
lea r9, [rbp - 0x50]
mov edx, 0x30
lea r8d, [rdx - 0x2d]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
test eax, eax
jne 0x180002120
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
je 0x180002120
lea rcx, str.Error_enumerating_services
call fcn.18001db60
mov edi, r13d
cmp dword [rsp + 0x68], r13d
jbe 0x1800021e0
nop
mov ebx, edi
lea rcx, str.Service_Name:__s_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000215b
lea rdx, [rbx + rbx*2]
add rdx, rdx
mov rdx, qword [rbp + rdx*8 - 0x50]
lea rcx, str.Service_Name:__s_n
call fcn.180001120
lea rcx, str.Display_Name:__s_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180002184
lea rdx, [rbx + rbx*2]
add rdx, rdx
mov rdx, qword [rbp + rdx*8 - 0x48]
lea rcx, str.Display_Name:__s_n
call fcn.180001120
lea rcx, str.Service_Type:__lu_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800021ac
lea rax, [rbx + rbx*2]
add rax, rax
mov edx, dword [rbp + rax*8 - 0x40]
lea rcx, str.Service_Type:__lu_n
call fcn.180001120
lea rcx, str.Service_State:__lu_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800021d4
lea rax, [rbx + rbx*2]
add rax, rax
mov edx, dword [rbp + rax*8 - 0x3c]
lea rcx, str.Service_State:__lu_n
call fcn.180001120
inc edi
cmp edi, dword [rsp + 0x68]
jb 0x180002130
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea rcx, str.Character:__c_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000220b
mov edx, 0x41
lea rcx, str.Character:__c_n
call fcn.180001120
mov qword [rsp + 0x58], r13
lea rcx, str.Array_sum:__d_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180002232
mov edx, reloc.WS2_32.dll_ntohs
lea rcx, str.Array_sum:__d_n
call fcn.180001120
lea rcx, str.String:__s_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180002256
lea rdx, str.This_is_a_string
lea rcx, str.String:__s_n
call fcn.180001120
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call fcn.180014bf0
movzx edx, word [rbp - 0x80]
test edx, edx
je 0x1800022e4
sub edx, 5
je 0x1800022ca
sub edx, r14d
je 0x1800022b0
cmp edx, 3
je 0x180002296
lea rcx, str.Unknown_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180002301
lea rcx, str.Unknown_n
jmp 0x1800022fc
lea rcx, str.x64_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180002301
lea rcx, str.x64_n
jmp 0x1800022fc
lea rcx, str.IA64_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180002301
lea rcx, str.IA64_n
jmp 0x1800022fc
lea rcx, str.ARM_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180002301
lea rcx, str.ARM_n
jmp 0x1800022fc
lea rcx, str.x86_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180002301
lea rcx, str.x86_n
call fcn.180001120
lea rcx, str.Number_of_Processors:__d_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180002321
mov edx, dword [rbp - 0x60]
lea rcx, str.Number_of_Processors:__d_n
call fcn.180001120
lea rcx, str.Processor_Type:__d_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180002341
mov edx, dword [rbp - 0x5c]
lea rcx, str.Processor_Type:__d_n
call fcn.180001120
lea rcx, str.Processor_Level:__d_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180002362
movzx edx, word [rbp - 0x54]
lea rcx, str.Processor_Level:__d_n
call fcn.180001120
lea rcx, str.Processor_Revision:__d_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x180002383
movzx edx, word [rbp - 0x52]
lea rcx, str.Processor_Revision:__d_n
call fcn.180001120
mov dword [rsp + 0x50], r13d
mov esi, r13d
mov edi, 9
lea ebx, [r14 + rsi]
lea esi, [r14]
mov r14d, ebx
lea rcx, [0x18004c408]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800023b9
mov edx, ebx
lea rcx, [0x18004c408]
call fcn.180001120
sub rdi, 1
jne 0x180002390
lea rcx, [0x18004bd68]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800023dc
lea rcx, [0x18004bd68]
call fcn.180001120
lea rcx, str.Hexadecimal_integer:_0x_X_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800023fe
mov edx, 0xabcd
lea rcx, str.Hexadecimal_integer:_0x_X_n
call fcn.180001120
xor ecx, ecx
call fcn.180020884
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x70]
call fcn.180020be0
mov r9, rax
lea r8, str._Y__m__d__H:_M:_S
mov edx, 0x14
lea rcx, [rbp - 0x80]
call fcn.18001e084
lea rcx, str.Current_Time_3:__s_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000244d
lea rdx, [rbp - 0x80]
lea rcx, str.Current_Time_3:__s_n
call fcn.180001120
mov r8, r12
cmp qword [r12 + 0x18], 0x10
jb 0x18000245c
mov r8, qword [r12]
mov r9d, dword [r12 + 0x10]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x58]
call fcn.180001990
test al, al
je 0x1800026bb
mov r8d, dword [rsp + 0x50]
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x68], reloc.WS2_32.dll_ntohs
mov rdx, qword [rsp + 0x58]
lea rcx, [rbp - 0x80]
call fcn.1800149b0
lea rax, [rbp - 0x80]
cmp r15, rax
je 0x1800024fd
mov rdx, qword [r15 + 0x18]
cmp rdx, 0x10
jb 0x1800024de
mov rcx, qword [r15]
inc rdx
cmp rdx, 0x1000
jb 0x1800024d9
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18000273b
mov rcx, r8
call fcn.180018cc0
mov qword [r15 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r15], 0
movups xmm0, xmmword [rbp - 0x80]
movups xmmword [r15], xmm0
movups xmm1, xmmword [rbp - 0x70]
movups xmmword [r15 + 0x10], xmm1
jmp 0x180002538
mov rdx, qword [rbp - 0x68]
cmp rdx, 0x10
jb 0x180002538
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180002533
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000273b
call fcn.180018cc0
lea rcx, str.The_value_of_pi_is:__lf_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
movsd xmm6, qword [0x18004d240]
test eax, eax
jns 0x180002565
movaps xmm1, xmm6
movq rdx, xmm6
lea rcx, str.The_value_of_pi_is:__lf_n
call fcn.180001120
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1800025fb
mov ebx, r13d
mov r9d, 0x100
lea r8, [rbp - 0x50]
xor edx, edx
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x1800025ee
nop
inc ebx
lea rcx, str.Startup_Item:__s_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800025d3
lea rdx, [rbp - 0x50]
lea rcx, str.Startup_Item:__s_n
call fcn.180001120
mov r9d, 0x100
lea r8, [rbp - 0x50]
mov edx, ebx
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x1800025b0
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x180002607
lea rcx, str.Error_opening_registry_key
call fcn.18001db60
lea rcx, str.Pi:__lf_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000262c
movaps xmm1, xmm6
movq rdx, xmm6
lea rcx, str.Pi:__lf_n
call fcn.180001120
mov rcx, qword [rsp + 0x58]
call fcn.180020c30
lea rcx, str.Eulers_Number:__lf_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
movsd xmm6, qword [0x18004d210]
test eax, eax
jns 0x18000266b
movaps xmm0, xmm6
call fcn.180039fa0
movaps xmm1, xmm0
movq rdx, xmm0
lea rcx, str.Eulers_Number:__lf_n
call fcn.180001120
lea rcx, str._c_is_a_lowercase_letter._n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x18000268d
mov edx, 0x65
lea rcx, str._c_is_a_lowercase_letter._n
call fcn.180001120
lea rcx, str.The_volume_of_the_cube_with_side__lf_is:__lf_n
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jns 0x1800026bb
movaps xmm2, xmm6
movq r8, xmm6
movaps xmm1, xmm6
movq rdx, xmm6
lea rcx, str.The_volume_of_the_cube_with_side__lf_is:__lf_n
call fcn.180001120
nop
mov rdx, qword [r12 + 0x18]
cmp rdx, 0x10
jb 0x1800026f3
inc rdx
mov rcx, qword [r12]
cmp rdx, 0x1000
jb 0x1800026ee
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180002741
mov rcx, r8
call fcn.180018cc0
mov qword [r12 + 0x10], r13
mov qword [r12 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r12], 0
mov rax, r15
mov rcx, qword [rbp + 0xbfb0]
xor rcx, rsp
call fcn.180018ca0
mov rbx, qword [rsp + 0xc120]
movaps xmm6, xmmword [rsp + 0xc0c0]
add rsp, 0xc0d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.18001e488
nop
call fcn.18001e488
int3