Function at 0x140028cf0
Capabilities:
Check if file exists
Create directory
Create process on windows
Delete file
Enumerate processes
Extract resource via kernel32 functions
Get common file path
Move file
Persist via lnk shortcut
Persist via run registry key
Query environment variable
Set registry value
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xaf8
mov rax, qword [0x14002a328]
lea rbp, [0x14002a0a8]
mov dword [rsp + 0xb58], r9d
mov r14, rcx
lea rcx, [rsp + 0x80]
lea rdi, [rsp + 0x8b0]
mov qword [rsp + 0x80], rax
lea r12, [rsp + 0x8dc]
call qword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
mov ecx, 0xf
mov esi, eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rdx, rdi
mov dword [rsp + 0x8b0], 0x238
mov rcx, rax
mov rbx, rax
call sub.KERNEL32.dll_Process32FirstW
mov r15, qword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
jne 0x140001a3f
jmp 0x140001aa8
mov rdx, rdi
mov rcx, rbx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x140001aa8
cmp dword [rsp + 0x8b8], esi
je 0x140001a30
mov rdx, rbp
mov rcx, r12
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x140001a30
mov r8d, dword [rsp + 0x8b8]
xor edx, edx
mov ecx, 1
call r15
mov r13, rax
test rax, rax
je 0x140001a30
mov edx, 9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rdx, rdi
mov rcx, rbx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x140001a3f
nop word [rax + rax]
lea rcx, str.USERPROFILE
xor r12d, r12d
lea rdi, [rsp + 0x170]
call sub.msvcrt.dll_getenv
mov edx, 1
mov ecx, 0x104
lea rbp, str._se_wings.exe
mov rsi, rax
call sub.msvcrt.dll_calloc
mov r8, rsi
lea rdx, str._s.e_wings
lea rsi, [rsp + 0x160]
mov rbx, rax
mov rcx, rax
call fcn.140001920
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov rax, r12
mov ecx, 0x1e
mov r8, rbx
rep stosq qword [rdi], rax
mov rdx, rbp
mov rcx, rsi
mov qword [rsp + 0x160], 0
mov qword [rsp + 0x168], 0
mov dword [rdi], 0
lea rdi, [rsp + 0x280]
call fcn.140001920
mov rax, r12
mov ecx, 0x1e
mov qword [rsp + 0x270], 0
rep stosq qword [rdi], rax
mov r8d, 0x104
mov qword [rsp + 0x278], 0
mov dword [rdi], 0
lea rdi, [rsp + 0x270]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov rdx, rsi
mov rcx, rdi
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x140002340
xor r12d, r12d
mov ecx, 0x1e
xor r9d, r9d
xor r8d, r8d
lea rdi, [rsp + 0x390]
mov rax, r12
lea r15, [rsp + 0x380]
mov qword [rsp + 0x380], 0
rep stosq qword [rdi], rax
mov rdx, r15
mov qword [rsp + 0x388], 0
mov dword [rdi], 0
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x140002421
lea rcx, str.APPDATA
lea rdi, [rsp + 0x4a0]
call sub.msvcrt.dll_getenv
mov ecx, 0x1e
lea rdx, str._sMicrosoftWindowsStart_MenuProgramsStartupe_wings.lnk
mov qword [rsp + 0x490], 0
mov qword [rsp + 0x498], 0
mov r8, rax
mov rax, r12
rep stosq qword [rdi], rax
mov dword [rdi], 0
lea rdi, [rsp + 0x490]
mov rcx, rdi
call fcn.140001920
mov rcx, rdi
mov r13, qword [sym.imp.KERNEL32.dll_DeleteFileA]
call r13
mov r8, r15
lea rdx, str._se_wings.lnk
mov rcx, rdi
call fcn.140001920
mov rcx, rdi
lea rdi, [rsp + 0x5b0]
call r13
lea r8, [rsp + 0x88]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x88], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov rcx, rsi
call sub.msvcrt.dll_strlen
xor r8d, r8d
mov rcx, qword [rsp + 0x88]
mov r9d, 1
add eax, 1
lea rdx, str.e_Wings
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x28], eax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rax, r12
mov ecx, 0x1e
mov r8, r15
rep stosq qword [rdi], rax
mov rdx, rbp
mov qword [rsp + 0x5a0], 0
mov qword [rsp + 0x5a8], 0
mov dword [rdi], 0
lea rdi, [rsp + 0x5a0]
mov rcx, rdi
call fcn.140001920
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x140002288
xor eax, eax
lea rdi, [rsp + 0xa0]
xor r9d, r9d
xor r8d, r8d
mov ecx, 0x17
lea rbp, [rsp + 0x90]
xor edx, edx
mov qword [rsp + 0x9c], 0
mov qword [rsp + 0x150], 0
mov rsi, qword [sym.imp.GDI32.dll_CreateFontW]
rep stosq qword [rdi], rax
lea rdi, str.Arial
mov ecx, 0x10
mov qword [0x1400340a0], rbp
mov qword [rsp + 0x90], r14
mov eax, dword [rsp + 0xb58]
mov qword [rsp + 0x68], rdi
mov dword [rsp + 0x60], 0
mov dword [rsp + 0x98], eax
mov dword [rsp + 0x58], 0
mov dword [rsp + 0x50], 0
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x190
call rsi
mov r12, qword [0x1400340a0]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x19
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0x68], rdi
mov dword [rsp + 0x60], 0
mov dword [rsp + 0x58], 0
mov dword [rsp + 0x50], 0
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x190
call rsi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [r12 + 0x20], rax
mov r12, qword [0x1400340a0]
mov ecx, 0x14
mov qword [rsp + 0x68], rdi
mov dword [rsp + 0x60], 0
mov dword [rsp + 0x58], 0
mov dword [rsp + 0x50], 0
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x190
call rsi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [r12 + 0x28], rax
mov r12, qword [0x1400340a0]
mov ecx, 0x18
mov qword [rsp + 0x68], rdi
mov dword [rsp + 0x60], 0
mov dword [rsp + 0x58], 0
mov dword [rsp + 0x50], 0
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x2bc
call rsi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [r12 + 0x30], rax
mov r12, qword [0x1400340a0]
mov ecx, 0x19
mov qword [rsp + 0x68], rdi
mov dword [rsp + 0x60], 0
mov dword [rsp + 0x58], 0
mov dword [rsp + 0x50], 0
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x2bc
call rsi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [r12 + 0x38], rax
mov r12, qword [0x1400340a0]
mov ecx, 0x23
mov qword [rsp + 0x68], rdi
mov dword [rsp + 0x60], 0
mov dword [rsp + 0x58], 0
mov dword [rsp + 0x50], 0
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x2bc
call rsi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [r12 + 0x40], rax
mov r12, qword [0x1400340a0]
mov ecx, 0x19
mov qword [rsp + 0x68], rdi
mov dword [rsp + 0x60], 0
mov dword [rsp + 0x58], 0
mov dword [rsp + 0x50], 0
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x2bc
call rsi
mov rsi, qword [0x1400340a0]
mov ecx, 1
mov edx, 0x98
mov qword [r12 + 0x48], rax
call sub.msvcrt.dll_calloc
mov qword [rsi + 0x10], rax
mov rcx, rax
test rax, rax
je 0x14000243a
mov rdx, rbx
call fcn.14000dedc
test eax, eax
jne 0x140002448
mov rax, qword [0x1400340a0]
mov dword [rsp + 0x78], 0
mov rax, qword [rax + 0x10]
mov qword [rax + 0x38], rbx
lea rbx, str.0.3.3
mov qword [rax + 0x40], rbx
lea rbx, [0x14002a206]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0x78]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
mov rax, qword [0x1400340a0]
xor edx, edx
cmp dword [rsp + 0x78], 1
sete dl
mov rax, qword [rax + 0x10]
mov word [rax + 0x50], dx
mov qword [rax + 0x48], rbx
call fcn.140006a30
mov rax, qword [0x1400340a0]
mov rcx, qword [rax + 0x10]
cmp qword [rcx], 0
je 0x140002380
mov edx, 1
call fcn.14000e25f
cmp eax, 1
je 0x1400023ab
mov rcx, rbp
call fcn.1400028e0
mov ebx, eax
test eax, eax
jne 0x140002463
mov rax, qword [0x1400340a0]
lea rdx, str.notification
lea r8, str.WAVE
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdx, rax
test rax, rax
je 0x140002499
mov rsi, qword [0x1400340a0]
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rsi + 0xb8], rax
mov rsi, qword [0x1400340a0]
mov rcx, qword [rsi + 0xb8]
test rcx, rcx
je 0x140002499
call qword [sym.imp.KERNEL32.dll_LockResource]
lea rdx, [0x140001900]
mov qword [rsi + 0xc0], rax
mov rax, qword [0x1400340a0]
lea rsi, [0x1400018f0]
movq xmm1, rdx
mov rax, qword [rax + 0x10]
mov qword [rax + 0x88], rsi
lea rsi, [0x140001880]
movq xmm0, rsi
punpcklqdq xmm0, xmm1
movups xmmword [rax + 0x78], xmm0
call fcn.140005c00
mov rax, qword [0x1400340a0]
mov rax, qword [rax + 0x10]
mov rsi, qword [rax + 0x30]
test rsi, rsi
je 0x140002258
xor eax, eax
lea rdi, [rsp + 0x6b0]
mov ecx, 0x40
rep stosq qword [rdi], rax
mov rcx, rsi
lea rdi, [rsp + 0x6b0]
call sub.msvcrt.dll_strlen
mov r8, rsi
xor edx, edx
mov ecx, 0xfde9
mov r9d, eax
mov dword [rsp + 0x28], 0xff
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rcx, [rsp + 0x7c]
mov dword [rsp + 0x7c], 0
call fcn.1400017d0
mov rsi, rax
mov eax, dword [rsp + 0x7c]
test eax, eax
jle 0x140002258
mov rcx, qword [rsi + 0x18]
mov rdx, rdi
call sub.msvcrt.dll_wcscmp
test eax, eax
je 0x1400022d0
add ebx, 1
add rsi, 0x88
cmp dword [rsp + 0x7c], ebx
jg 0x14000222d
nop dword [rax]
call fcn.140004660
test eax, eax
jne 0x14000247e
call qword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
add rsp, 0xaf8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
xor r8d, r8d
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateSymbolicLinkA]
test al, al
jne 0x140001d13
mov dword [rsp + 0x28], 1
xor r9d, r9d
mov r8, rsi
xor ecx, ecx
mov qword [rsp + 0x20], 0
lea rdx, str.runas
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x14000226b
mov rax, qword [0x1400340a0]
mov edx, 1
mov ecx, 0x100
mov rbx, qword [rax + 0x10]
call sub.msvcrt.dll_calloc
mov r8, qword [rsi + 8]
xor edx, edx
mov ecx, 0xfde9
mov qword [rbx + 0x28], rax
mov r9d, 0xffffffff
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xff
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rax, qword [0x1400340a0]
mov rcx, qword [rax + 0x10]
call fcn.14000dcd1
jmp 0x140002258
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x1400023a0
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x140001b92
mov r8, rsi
mov rdx, rdi
lea rcx, str.__s_____s__FAILED_TO_MOVE_FILE__n
call fcn.140001950
jmp 0x140001b92
call fcn.140006b10
test eax, eax
jne 0x1400024b4
mov rax, qword [0x1400340a0]
mov rcx, qword [rax + 0x10]
jmp 0x1400020ee
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x14000234d
xor eax, eax
lea rdi, [rsp + 0x6c0]
mov ecx, 0x3e
mov qword [rsp + 0x6b0], 0
lea rbx, [rsp + 0x6b0]
lea rdx, str._se_wings_new.exe
mov qword [rsp + 0x6b8], 0
rep stosq qword [rdi], rax
mov rax, qword [0x1400340a0]
mov rcx, rbx
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x38]
call fcn.140001920
xor r9d, r9d
mov r8, rbx
xor edx, edx
mov dword [rsp + 0x28], 1
xor ecx, ecx
mov qword [rsp + 0x20], 0
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x14000226b
xor r9d, r9d
lea r8, [0x14002a0c0]
lea rdx, str.Unable_to_find_desktop_directory_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
or eax, 0xffffffff
jmp 0x14000226d
xor r9d, r9d
lea r8, [0x14002a0c0]
lea rdx, str.Init_failed_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x14000243a
xor r9d, r9d
lea r8, [0x14002a0c0]
lea rdx, str.Failed_to_register_ew_controls
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x14000243a
xor r9d, r9d
lea r8, [0x14002a0c0]
lea rdx, str.Failed_to_show_dashboard
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x14000243a
xor r9d, r9d
lea r8, [0x14002a0c0]
lea rdx, str.Failed_to_load_notification_sound__n
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x14000243a
xor r9d, r9d
lea r8, [0x14002a0c0]
lea rdx, [0x14002a20a]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x14000243a
sub rsp, 0x28
call fcn.140016d10
mov rax, qword [0x14002d9a0]
xor edx, edx
mov r9d, dword [rax]
mov rax, qword [0x14002d990]
mov r8, qword [rax]
mov rax, qword [0x14002d980]
mov rcx, qword [rax]
add rsp, 0x28
jmp 0x1400019a0