Function at 0x4015b6
Capabilities:
Create process on windows
Open clipboard
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push rbp
push rdi
sub rsp, 0xe28
lea rbp, [rsp + 0x80]
mov dword [rbp + 0xdc0], ecx
mov qword [rbp + 0xdc8], rdx
call dbg.__main
mov rax, qword [rbp + 0xdc8]
mov rax, qword [rax]
mov qword [rbp + 0xd98], rax
lea rdx, [rbp + 0x40]
mov eax, 0
mov ecx, 0x20
mov rdi, rdx
rep stosq qword [rdi], rax
mov rax, qword [rbp + 0xd98]
mov edx, 0x5c
mov rcx, rax
call sym.strrchr
mov qword [rbp + 0xd90], rax
cmp qword [rbp + 0xd90], 0
jne 0x40164f
mov r9d, 0
lea r8, str.Error
lea rdx, str.Shit
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_MessageBoxA]
call rax
mov eax, 0xffffffff
jmp 0x401ac9
mov rdx, qword [rbp + 0xd90]
mov rax, qword [rbp + 0xd98]
sub rdx, rax
mov rax, rdx
mov rcx, rax
mov rdx, qword [rbp + 0xd98]
lea rax, [rbp + 0x40]
mov r8, rcx
mov rcx, rax
call sym.strncpy
lea rdx, [rbp + 0x140]
mov eax, 0
mov ecx, pe_nt_image_headers64
mov rdi, rdx
rep stosq qword [rdi], rax
lea rdx, [rbp + 0x40]
lea rax, [rbp + 0x140]
mov r8, rdx
lea rdx, str._sguiNConfig.json
mov rcx, rax
call sym.sprintf
lea rax, [rbp + 0x140]
lea rdx, [0x0040501e]
mov rcx, rax
call sym.fopen
mov qword [rbp + 0xd88], rax
mov rax, qword [rbp + 0xd88]
mov rcx, rax
call sym.fclose
cmp qword [rbp + 0xd88], 0
jne 0x401717
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], 0
mov r9d, 0
lea r8, str.https:__niubi_vpn.com
mov edx, 0
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteA]
call rax
mov r9d, 0
lea r8, str.Welcome
lea rdx, [0x00405048]
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_MessageBoxW]
call rax
lea rdx, [rbp + 0x540]
mov eax, 0
mov ecx, pe_nt_image_headers64
mov rdi, rdx
rep stosq qword [rdi], rax
lea rdx, [rbp + 0x40]
lea rax, [rbp + 0x540]
mov r8, rdx
lea rdx, str._s_rocket.dll
mov rcx, rax
call sym.sprintf
lea rax, [rbp + 0xd50]
mov r8d, 0x18
mov edx, 0
mov rcx, rax
call sym.memset
lea rax, [rbp - 0x30]
mov r8d, 0x68
mov edx, 0
mov rcx, rax
call sym.memset
mov eax, 0x68
mov dword [rbp - 0x30], eax
lea rax, [rbp + 0x540]
lea rdx, [rbp + 0xd50]
mov qword [rsp + 0x48], rdx
lea rdx, [rbp - 0x30]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
call rax
mov ecx, 0x8000
call sym.malloc
mov qword [rbp + 0xd80], rax
mov rax, qword [rbp + 0xd50]
lea rdx, [rbp + 0xd4c]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
call rax
mov eax, dword [rbp + 0xd4c]
cmp eax, 0x103
je 0x401843
mov eax, 0
jmp 0x401ac9
call sym.FetchClipBoard__
mov qword [rbp + 0xd78], rax
cmp qword [rbp + 0xd78], 0
je 0x401ab6
mov rax, qword [rbp + 0xd78]
mov r8d, 0x39
lea rdx, str.https:__core.niubi_vpn.com_api_v1_client_subscribe_token
mov rcx, rax
call sym.strncmp
test eax, eax
jne 0x401ab6
lea rdx, [rbp + 0x940]
mov eax, 0
mov ecx, pe_nt_image_headers64
mov rdi, rdx
rep stosq qword [rdi], rax
mov rdx, qword [rbp + 0xd78]
lea rax, [rbp + 0x940]
mov r8, rdx
lea rdx, str._sflagniubirocket
mov rcx, rax
call sym.sprintf
mov rax, qword [rbp + 0xd80]
mov r8d, 0x8000
mov edx, 0
mov rcx, rax
call sym.memset
mov rdx, qword [rbp + 0xd80]
lea rax, [rbp + 0x940]
mov r8d, 0x8000
mov rcx, rax
call sym.winhttp_get_https_requests_char__unsigned_char__unsigned_long_long_
mov rax, qword [rbp + 0xd80]
movzx eax, byte [rax]
test al, al
jne 0x40195c
mov r9d, 1
lea r8, str.Notice
lea rdx, [0x004051a8]
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_MessageBoxW]
call rax
mov byte [rbp + 0xd6f], al
cmp byte [rbp + 0xd6f], 2
jne 0x401956
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_OpenClipboard]
call rax
test eax, eax
setne al
test al, al
je 0x401956
mov rax, qword [sym.imp.USER32.dll_EmptyClipboard]
call rax
mov rax, qword [sym.imp.USER32.dll_CloseClipboard]
call rax
nop
jmp 0x401ac4
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_OpenClipboard]
call rax
test eax, eax
setne al
test al, al
je 0x401985
mov rax, qword [sym.imp.USER32.dll_EmptyClipboard]
call rax
mov rax, qword [sym.imp.USER32.dll_CloseClipboard]
call rax
mov rax, qword [rbp + 0xd50]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_TerminateProcess]
call rax
mov ecx, 0x1f4
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
lea rax, [rbp + 0x140]
lea rdx, [0x004052aa]
mov rcx, rax
call sym.fopen
mov qword [rbp + 0xd70], rax
cmp qword [rbp + 0xd70], 0
je 0x401ab6
mov rax, qword [rbp + 0xd80]
mov rcx, rax
call sym.strlen
mov rcx, rax
mov rdx, qword [rbp + 0xd70]
mov rax, qword [rbp + 0xd80]
mov r9, rdx
mov r8, rcx
mov edx, 1
mov rcx, rax
call sym.fwrite
mov rax, qword [rbp + 0xd70]
mov r9, rax
mov r8d, 1
mov edx, 1
lea rcx, [0x004052ad]
call sym.fwrite
mov rax, qword [rbp + 0xd70]
mov rcx, rax
call sym.fclose
lea rax, [rbp + 0x540]
lea rdx, [rbp + 0xd50]
mov qword [rsp + 0x48], rdx
lea rdx, [rbp - 0x30]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
call rax
mov r9d, 0
lea r8, str.Notice
lea rdx, [0x004052b0]
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_MessageBoxW]
call rax
mov ecx, 0x64
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
jmp 0x401812
add rsp, 0xe28
pop rdi
pop rbp
ret