Function at 0x140026ec0
Capabilities:
Delete file
Delete registry key
Delete registry value
Persist via windows service
Query environment variable
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x200]
sub rsp, 0x300
mov rax, qword [0x14013d0a8]
xor rax, rsp
mov qword [rbp + 0x1f0], rax
movzx esi, r8b
movzx r14d, dl
mov r13, rcx
mov dword [rsp + 0x40], r9d
xor r12d, r12d
mov dword [rsp + 0x68], r12d
test dl, dl
je 0x140027754
mov dl, 1
lea rcx, [rsp + 0x50]
call fcn.1400278e0
nop
lea edi, [r12 - 1]
mov rbx, qword [rsp + 0x50]
test rbx, rbx
je 0x14002747c
mov rcx, qword [rbx]
test rcx, rcx
je 0x14002747c
call qword [sym.imp.OLEAUT32.dll_VariantInit]
test eax, eax
je 0x14002747c
lea r8, [rsp + 0x48]
lea rdx, str.SystemCurrentControlSetServicesPROCMON24
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x140027406
mov dword [rsp + 0x30], r12d
cmp byte [0x14014330b], al
je 0x140026fd6
test sil, sil
jne 0x14002711b
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [0x1400a25e0]
mov r8, r13
lea rdx, [0x1400f7fb8]
mov rcx, qword [0x140143520]
call qword [sym.imp.USER32.dll_DialogBoxParamW]
test rax, rax
jne 0x14002711b
lea rdx, str.SystemCurrentControlSetServicesPROCMON24
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14002770c
mov r8d, 0x104
lea rdx, [rbp - 0x20]
lea rcx, str._SYSTEMROOT_Procmon.Pmb
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.1400b5680
mov rbx, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x140027027
mov qword [rax + 8], r12
mov dword [rax + 0x10], 1
lea rcx, [rbp - 0x20]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x140027792
jmp 0x14002702a
mov rbx, r12
mov qword [rbp - 0x70], rbx
test rbx, rbx
je 0x1400277c9
test sil, sil
jne 0x1400270df
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.1400b5680
mov rsi, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x14002707d
mov qword [rax + 8], r12
mov dword [rax + 0x10], 1
lea rcx, str.Process_Monitor_is_configured_to_log_activity_during_the_next_boot.
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rsi], rax
test rax, rax
je 0x14002779d
jmp 0x140027080
mov rsi, r12
test rsi, rsi
je 0x1400277d4
mov r9d, 0x40
lea r8, [0x1400f7478]
mov rdx, qword [rsi]
mov rcx, r13
call qword [sym.imp.USER32.dll_MessageBoxW]
mov eax, edi
lock xadd dword [rsi + 0x10], eax
cmp eax, 1
jne 0x1400270df
mov rcx, qword [rsi]
test rcx, rcx
je 0x1400270bf
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rsi], r12
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x1400270d1
call fcn.1400b56bc
mov qword [rsi + 8], r12
mov edx, reloc.OLEAUT32.dll_SafeArrayGetElement
mov rcx, rsi
call fcn.1400b56bc
nop
mov eax, edi
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x14002711b
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400270fc
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14002710e
call fcn.1400b56bc
mov qword [rbx + 8], r12
mov edx, reloc.OLEAUT32.dll_SafeArrayGetElement
mov rcx, rbx
call fcn.1400b56bc
movups xmm0, xmmword [str.FSFilter_Activity_Monitor]
movups xmmword [rbp - 0x60], xmm0
movups xmm1, xmmword [0x1400f8078]
movups xmmword [rbp - 0x50], xmm1
movups xmm0, xmmword [0x1400f8088]
movups xmmword [rbp - 0x40], xmm0
mov eax, dword [0x1400f8098]
mov dword [rbp - 0x30], eax
mov dword [rsp + 0x60], r12d
mov dword [rsp + 0x64], 1
lea rdx, str.DeleteFlag
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, [0x1400f7c38]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x28], reloc.WS2_32.dll_gethostbyname
lea rax, [rbp - 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.Group
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x64]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Type
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.1400b5680
mov rbx, rax
mov qword [rbp - 0x78], rax
test rax, rax
je 0x140027226
mov qword [rax + 8], r12
mov dword [rax + 0x10], 1
lea rcx, str.PROCMON24.SYS
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x1400277a8
jmp 0x140027229
mov rbx, r12
mov qword [rbp - 0x78], rbx
test rbx, rbx
je 0x1400277df
lea r8, [rbp - 0x78]
lea rdx, [0x1400f80c8]
lea rcx, [rsp + 0x78]
call fcn.1400268f0
nop
mov eax, edi
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x140027288
mov rcx, qword [rbx]
test rcx, rcx
je 0x140027269
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14002727b
call fcn.1400b56bc
mov qword [rbx + 8], r12
mov edx, reloc.OLEAUT32.dll_SafeArrayGetElement
mov rcx, rbx
call fcn.1400b56bc
mov rax, qword [rsp + 0x78]
test rax, rax
je 0x1400272a9
mov rcx, qword [rax]
test rcx, rcx
je 0x1400272a9
call qword [sym.imp.OLEAUT32.dll_VariantInit]
mov ecx, eax
mov rax, qword [rsp + 0x78]
jmp 0x1400272ac
mov ecx, r12d
lea edx, [rcx + rcx]
test rax, rax
je 0x1400272b9
mov rcx, qword [rax]
jmp 0x1400272bc
mov rcx, r12
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x20], rcx
mov r9d, 2
xor r8d, r8d
lea rdx, str.ImagePath
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp dword [rsp + 0x30], 0
jne 0x1400272f2
cmp dword [rsp + 0x40], 0xffffffff
je 0x14002739d
lea r8, [rsp + 0x70]
lea rdx, [0x1400f7e50]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x14002739d
mov ecx, dword [rsp + 0x30]
test ecx, ecx
je 0x140027353
xor edx, edx
mov eax, 0x989680
div ecx
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, [0x1400f80f0]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [rsp + 0x40]
test eax, eax
je 0x140027392
imul eax, eax, 0x989680
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, [0x1400f8110]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edx, edx
mov rcx, qword [rsp + 0x48]
call fcn.140026a90
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x78]
test rbx, rbx
je 0x1400273ff
mov eax, edi
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x1400273ff
test rbx, rbx
je 0x1400273ff
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400273e0
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400273f2
call fcn.1400b56bc
mov qword [rbx + 8], r12
mov edx, reloc.OLEAUT32.dll_SafeArrayGetElement
mov rcx, rbx
call fcn.1400b56bc
mov rbx, qword [rsp + 0x50]
jmp 0x140027434
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test sil, sil
jne 0x140027431
mov r9d, reloc.WS2_32.dll_recv
lea r8, [0x1400f7478]
lea rdx, str.Error_configuring_boot_logging
mov rcx, r13
call qword [sym.imp.USER32.dll_MessageBoxW]
xor r14b, r14b
lock xadd dword [rbx + 0x10], edi
cmp edi, 1
jne 0x140027759
mov rbx, qword [rsp + 0x50]
mov rcx, qword [rbx]
test rcx, rcx
je 0x140027458
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14002746a
call fcn.1400b56bc
mov qword [rbx + 8], r12
mov edx, reloc.OLEAUT32.dll_SafeArrayGetElement
mov rcx, rbx
call fcn.1400b56bc
jmp 0x140027759
test sil, sil
jne 0x14002770c
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.1400b5680
mov rbx, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x1400274c2
mov qword [rax + 8], r12
mov dword [rax + 0x10], 1
lea rcx, str.PROCMON24.SYS
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x1400277b3
jmp 0x1400274c5
mov rbx, r12
mov qword [rbp - 0x70], rbx
test rbx, rbx
je 0x1400277ea
lea r8, [rbp - 0x70]
lea rdx, str.Unable_to_write
lea rcx, [rbp - 0x80]
call fcn.1400268f0
mov r15, rax
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.1400b5680
mov rsi, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x140027526
mov qword [rax + 8], r12
mov dword [rax + 0x10], 1
lea rcx, str.._n_nMake_sure_that_you_have_permission_to_nwrite_to_the___SystemRoot__System32Drivers_directory.
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rsi], rax
test rax, rax
je 0x1400277be
jmp 0x140027529
mov rsi, r12
mov qword [rbp - 0x68], rsi
test rsi, rsi
je 0x1400277f5
mov r15, qword [r15]
mov qword [rsp + 0x58], r15
test r15, r15
je 0x140027548
lock inc dword [r15 + 0x10]
mov dword [rsp + 0x68], 1
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.1400b5680
mov qword [rsp + 0x38], rax
test rax, rax
je 0x14002757a
lea r8, [rbp - 0x68]
lea rdx, [rsp + 0x58]
mov rcx, rax
call fcn.140026700
mov r14, rax
jmp 0x14002757d
xor r14d, r14d
test r14, r14
je 0x140027787
test r15, r15
je 0x1400275d1
mov eax, edi
lock xadd dword [r15 + 0x10], eax
cmp eax, 1
jne 0x1400275d1
mov rcx, qword [r15]
test rcx, rcx
je 0x1400275ad
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [r15], 0
mov rcx, qword [r15 + 8]
test rcx, rcx
je 0x1400275c3
call fcn.1400b56bc
mov qword [r15 + 8], 0
mov edx, reloc.OLEAUT32.dll_SafeArrayGetElement
mov rcx, r15
call fcn.1400b56bc
nop
mov eax, edi
lock xadd dword [rsi + 0x10], eax
cmp eax, 1
jne 0x140027616
mov rcx, qword [rsi]
test rcx, rcx
je 0x1400275f2
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rsi], 0
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x140027608
call fcn.1400b56bc
mov qword [rsi + 8], 0
mov edx, reloc.OLEAUT32.dll_SafeArrayGetElement
mov rcx, rsi
call fcn.1400b56bc
nop
mov rsi, qword [rbp - 0x80]
test rsi, rsi
je 0x140027671
mov eax, edi
lock xadd dword [rsi + 0x10], eax
cmp eax, 1
jne 0x140027668
test rsi, rsi
je 0x140027668
mov rcx, qword [rsi]
test rcx, rcx
je 0x140027645
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rsi], 0
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x14002765b
call fcn.1400b56bc
mov qword [rsi + 8], 0
mov edx, reloc.OLEAUT32.dll_SafeArrayGetElement
mov rcx, rsi
call fcn.1400b56bc
xor r12d, r12d
mov qword [rbp - 0x80], r12
jmp 0x140027674
xor r12d, r12d
mov eax, edi
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x1400276b0
mov rcx, qword [rbx]
test rcx, rcx
je 0x140027691
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400276a3
call fcn.1400b56bc
mov qword [rbx + 8], r12
mov edx, reloc.OLEAUT32.dll_SafeArrayGetElement
mov rcx, rbx
call fcn.1400b56bc
mov r9d, reloc.WS2_32.dll_recv
lea r8, [0x1400f7478]
mov rdx, qword [r14]
mov rcx, r13
call qword [sym.imp.USER32.dll_MessageBoxW]
nop
mov eax, edi
lock xadd dword [r14 + 0x10], eax
cmp eax, 1
jne 0x140027707
mov rcx, qword [r14]
test rcx, rcx
je 0x1400276e8
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [r14], r12
mov rcx, qword [r14 + 8]
test rcx, rcx
je 0x1400276fa
call fcn.1400b56bc
mov qword [r14 + 8], r12
mov edx, reloc.OLEAUT32.dll_SafeArrayGetElement
mov rcx, r14
call fcn.1400b56bc
mov rbx, qword [rsp + 0x50]
test rbx, rbx
je 0x140027750
lock xadd dword [rbx + 0x10], edi
cmp edi, 1
jne 0x140027750
mov rbx, qword [rsp + 0x50]
mov rcx, qword [rbx]
test rcx, rcx
je 0x140027731
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r12
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140027743
call fcn.1400b56bc
mov qword [rbx + 8], r12
mov edx, reloc.OLEAUT32.dll_SafeArrayGetElement
mov rcx, rbx
call fcn.1400b56bc
xor al, al
jmp 0x14002775d
call fcn.140026bd0
movzx eax, r14b
mov rcx, qword [rbp + 0x1f0]
xor rcx, rsp
call fcn.1400b5660
mov rbx, qword [rsp + 0x348]
add rsp, 0x300
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x8007000e
call fcn.1400b6f00
nop
mov ecx, 0x8007000e
call fcn.1400b6f00
nop
mov ecx, 0x8007000e
call fcn.1400b6f00
nop
mov ecx, 0x8007000e
call fcn.1400b6f00
nop
mov ecx, 0x8007000e
call fcn.1400b6f00
nop
mov ecx, 0x8007000e
call fcn.1400b6f00
nop
mov ecx, 0x8007000e
call fcn.1400b6f00
nop
mov ecx, 0x8007000e
call fcn.1400b6f00
nop
mov ecx, 0x8007000e
call fcn.1400b6f00
int3
mov ecx, 0x8007000e
call fcn.1400b6f00
nop
mov ecx, 0x8007000e
call fcn.1400b6f00
int3