Function at 0x14000e4c0
Capabilities:
Create process on windows
Delete file
Set file attributes

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
sub rsp, 0x940
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
mov rax, qword [0x140074c00]
xor rax, rsp
mov qword [rsp + 0x930], rax
mov esi, edx
mov rdi, rcx
call fcn.140015e30
mov rcx, rax
xor r12d, r12d
mov edx, r12d
test rax, rax
setne dl
test edx, edx
jne 0x14000e519
mov ecx, 0x80004005
call fcn.140003b20
int3
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x40], rbx
mov word [rsp + 0x510], r12w
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x512]
call fcn.14003ea70
mov word [rsp + 0xf0], r12w
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0xf2]
call fcn.14003ea70
mov word [rsp + 0x300], r12w
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x302]
call fcn.14003ea70
mov word [rsp + 0x70], r12w
xor edx, edx
lea r8d, [rdx + 0x7e]
lea rcx, [rsp + 0x72]
call fcn.14003ea70
mov word [rsp + 0x720], r12w
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x722]
call fcn.14003ea70
lea rcx, [rdi + 0x618]
mov edi, 0x104
mov dword [rsp + 0x20], edi
lea r9, [rsp + 0x510]
xor r8d, r8d
mov edx, esi
call fcn.140021a78
mov r9d, 1
lea r8, [0x140062300]
lea edx, [r9 + 0x7f]
lea rcx, [rsp + 0x70]
call fcn.140004960
mov esi, 5
nop dword [rax + rax]
lea r9, [0x14007b800]
lea r8, [rsp + 0x70]
lea rdx, str.RunMode
lea rcx, [rsp + 0x510]
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
test eax, eax
jne 0x14000e66a
sub esi, 1
jne 0x14000e600
mov edx, 0x80
lea rcx, [0x14007b800]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [0x14007b800]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea r9, [0x14007b800]
lea r8, [rsp + 0x70]
lea rdx, str.RunMode
lea rcx, [rsp + 0x510]
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov rdx, rdi
lea rcx, [rsp + 0x300]
lea r8, [rsp + 0x510]
lea rax, [rsp + 0x300]
sub r8, rax
nop dword [rax + rax]
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x14000e6b5
movzx eax, word [r8 + rcx]
test ax, ax
je 0x14000e6b5
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14000e690
jmp 0x14000e6ba
test rdx, rdx
jne 0x14000e6be
sub rcx, 2
mov word [rcx], r12w
mov ecx, 0x3f6
call fcn.140016780
test rax, rax
je 0x14000e6e9
mov r8d, 0x3f6
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.1400039d0
mov rbx, qword [rsp + 0x40]
cmp dword [rbx - 8], 1
jle 0x14000e701
mov edx, dword [rbx - 0x10]
lea rcx, [rsp + 0x40]
call fcn.140003860
mov rbx, qword [rsp + 0x40]
mov rcx, rdi
lea rax, [rsp + 0x300]
nop dword [rax]
cmp word [rax], 0
je 0x14000e722
add rax, 2
sub rcx, 1
jne 0x14000e710
jmp 0x14000e780
test rcx, rcx
je 0x14000e780
mov rdx, rdi
sub rdx, rcx
mov qword [rsp + 0x58], rdx
mov rcx, rdi
sub rcx, rdx
lea rax, [rsp + rdx*2 + 0x300]
je 0x14000e778
lea rdx, [rcx + rdx + 0x7ffffefb]
mov r9, rbx
sub r9, rax
test rdx, rdx
je 0x14000e773
movzx r8d, word [r9 + rax]
test r8w, r8w
je 0x14000e773
mov word [rax], r8w
add rax, 2
dec rdx
sub rcx, 1
jne 0x14000e750
jmp 0x14000e778
test rcx, rcx
jne 0x14000e77c
sub rax, 2
mov word [rax], r12w
lea rdx, [rsp + 0x300]
lea rcx, str.ShowDlg
call qword [sym.imp.USER32.dll_FindWindowW]
mov rbp, rax
or rsi, 0xffffffffffffffff
test rax, rax
jne 0x14000e918
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbp, rax
mov r8d, edi
lea rdx, [rsp + 0xf0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [rsi + 0x5d]
lea rcx, [rsp + 0xf0]
call fcn.14003e11c
mov word [rax + 2], r12w
test rbp, rbp
je 0x14000e7e7
mov rcx, rbp
call qword [sym.imp.GDI32.dll_DeleteObject]
lea rcx, [rsp + 0x720]
call fcn.140008340
mov r11, rdi
lea rax, [rsp + 0xf0]
nop
cmp word [rax], 0
je 0x14000e812
add rax, 2
sub r11, 1
jne 0x14000e800
jmp 0x14000e875
test r11, r11
je 0x14000e875
mov rdx, rdi
sub rdx, r11
mov qword [rsp + 0x50], rdx
mov rcx, rdi
sub rcx, rdx
lea rax, [rsp + rdx*2 + 0xf0]
je 0x14000e86d
lea rdx, [rcx + rdx + 0x7ffffefb]
lea r9, [rsp + 0x720]
sub r9, rax
test rdx, rdx
je 0x14000e868
movzx r8d, word [r9 + rax]
test r8w, r8w
je 0x14000e868
mov word [rax], r8w
add rax, 2
dec rdx
sub rcx, 1
jne 0x14000e845
jmp 0x14000e86d
test rcx, rcx
jne 0x14000e871
sub rax, 2
mov word [rax], r12w
mov rcx, rdi
lea rax, [rsp + 0xf0]
cmp word [rax], 0
je 0x14000e892
add rax, 2
sub rcx, 1
jne 0x14000e880
jmp 0x14000e8ef
test rcx, rcx
je 0x14000e8ef
mov rdx, rdi
sub rdx, rcx
mov qword [rsp + 0x48], rdx
sub rdi, rdx
lea rax, [rsp + rdx*2 + 0xf0]
je 0x14000e8e7
lea rcx, [rdi + rdx + 0x7ffffefb]
lea r8, str.sd.exe
sub r8, rax
test rcx, rcx
je 0x14000e8e2
movzx edx, word [r8 + rax]
test dx, dx
je 0x14000e8e2
mov word [rax], dx
add rax, 2
dec rcx
sub rdi, 1
jne 0x14000e8c1
jmp 0x14000e8e7
test rdi, rdi
jne 0x14000e8eb
sub rax, 2
mov word [rax], r12w
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x510]
lea r8, [rsp + 0xf0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x14000e962
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.USER32.dll_SetWindowPos]
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
lea rdx, [r9 - 2]
mov rcx, rbp
call qword [sym.imp.USER32.dll_SetWindowPos]
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], esi
dec esi
test esi, esi
jg 0x14000e97a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rcx, qword [rsp + 0x930]
xor rcx, rsp
call fcn.14003d6d0
lea r11, [rsp + 0x940]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret