Function at 0x140015790
Capabilities:
Create process on windows
Delete file

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x230]
sub rsp, 0x330
mov rax, qword [0x140087080]
xor rax, rsp
mov qword [rbp + 0x220], rax
mov r15, rdx
mov r14, rcx
xor ebx, ebx
lea rcx, str.TF_THREAD_RunAgentExe_Start
call fcn.14000bcf0
mov word [rbp + 0x10], bx
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp + 0x12]
call fcn.14006b260
mov edx, 6
lea rcx, [rbp - 0x40]
call fcn.14000a5e0
nop
mov r8d, 4
lea rdx, str..exe
lea rcx, [rbp - 0x40]
call fcn.140002ad0
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [r14 + rbx], 0
jne 0x140015815
mov r13, qword [rbp - 0x30]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r13
cmp rax, rbx
jb 0x140015c23
lea rax, [rbp - 0x40]
cmp qword [rbp - 0x28], 0xf
cmova rax, qword [rbp - 0x40]
mov qword [rbp - 0x20], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
lea r12, [rbx + r13]
mov edi, 0xf
lea rsi, [rsp + 0x30]
cmp r12, rdi
jbe 0x1400158e3
mov rdi, r12
or rdi, 0xf
cmp rdi, rcx
jbe 0x1400158a5
mov rdi, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.14003c6e0
test rax, rax
je 0x140015c2f
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x1400158de
mov eax, 0x16
cmp rdi, rax
cmovb rdi, rax
lea rcx, [rdi + 1]
test rcx, rcx
jne 0x1400158be
xor esi, esi
jmp 0x1400158de
cmp rcx, 0x1000
jb 0x1400158d6
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140015c1d
jmp 0x140015886
call fcn.14003c6e0
mov rsi, rax
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], rdi
mov r8, rbx
mov rdx, r14
mov rcx, rsi
call fcn.14006abc0
lea rcx, [rsi + rbx]
mov r8, r13
mov rdx, qword [rbp - 0x20]
call fcn.14006abc0
mov byte [rsi + r12], 0
mov rdx, qword [rbp - 0x28]
cmp rdx, 0xf
jbe 0x14001594b
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140015946
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140015c2f
call fcn.14003c71c
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rbp - 0x40], xmm0
movups xmm1, xmmword [rsp + 0x40]
movups xmmword [rbp - 0x30], xmm1
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
mov r8d, 0x1d
lea rdx, str.C:WindowsSystem32datax.dat
lea rcx, [rsp + 0x30]
call fcn.140002dc0
nop
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x30]
call fcn.14000c070
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x1400159d2
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400159cd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140015c29
call fcn.14003c71c
lea rcx, str.TF_THREAD_RunAgentExe_CopyFileA_done
call fcn.14000bcf0
lea r8, [rbp - 0x40]
cmp qword [rbp - 0x28], 0xf
cmova r8, qword [rbp - 0x40]
xor edi, edi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
xor edx, edx
mov ecx, 0xfde9
mov r9d, 0xffffffff
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 8], xmm1
mov r8, rbx
xor edx, edx
lea rcx, [rbp - 0x18]
call fcn.140002b60
lea rdx, [rbp - 0x18]
cmp qword [rbp], 7
cmova rdx, qword [rbp - 0x18]
lea r8, [rbp - 0x40]
cmp qword [rbp - 0x28], 0xf
cmova r8, qword [rbp - 0x40]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rdx
xor edx, edx
mov ecx, 0xfde9
mov r9d, 0xffffffff
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
nop
lea rcx, [rbp - 0x40]
cmp qword [rbp - 0x28], 0xf
cmova rcx, qword [rbp - 0x40]
lea rdx, [0x14007b72c]
call fcn.1400475bc
test rax, rax
je 0x140015a91
mov rcx, rax
call fcn.1400425f0
mov eax, 1
jmp 0x140015a93
mov eax, edi
lea rdx, str.TF_THREAD_RunAgentExe_CopyFileA_Faild
lea rcx, str.TF_THREAD_RunAgentExe_CopyFileA_OK
test eax, eax
cmove rcx, rdx
call fcn.14000bcf0
cmp qword [r15 + 0x18], 7
jbe 0x140015ab6
mov r15, qword [r15]
lea r8, [rbp - 0x18]
cmp qword [rbp], 7
cmova r8, qword [rbp - 0x18]
mov r9, r15
lea rdx, str._C__s__s
lea rcx, [rbp + 0x10]
call fcn.1400012c0
mov dword [rsp + 0x50], 0x70
mov dword [rsp + 0x54], 0x40
mov qword [rsp + 0x58], rdi
lea rax, [0x14007b500]
mov qword [rsp + 0x60], rax
lea rax, str.cmd.exe
mov qword [rsp + 0x68], rax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rdi
mov dword [rbp - 0x80], edi
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x140015b44
mov edx, 0xffffffff
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rbp - 0x20], edi
lea rdx, [rbp - 0x20]
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
lea rcx, [rbp - 0x40]
cmp qword [rbp - 0x28], 0xf
cmova rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rcx, str.TF_THREAD_RunAgentExe_End
call fcn.14000bcf0
nop
mov rdx, qword [rbp]
cmp rdx, 7
jbe 0x140015ba5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140015ba0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140015c2f
call fcn.14003c71c
movdqa xmm0, xmmword [0x14007c1c0]
movdqu xmmword [rbp - 8], xmm0
mov word [rbp - 0x18], di
mov rdx, qword [rbp - 0x28]
cmp rdx, 0xf
jbe 0x140015bed
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140015be8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140015c17
call fcn.14003c71c
mov rcx, qword [rbp + 0x220]
xor rcx, rsp
call fcn.14003c6c0
mov rbx, qword [rsp + 0x380]
add rsp, 0x330
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140047984
nop
call fcn.140001420
nop
call fcn.1400014c0
int3
call fcn.140047984
int3
call fcn.140047984
int3