Function at 0x140003bd8
Capabilities:
Create process on windows
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x70]
sub rsp, 0x170
mov r12, r8
mov rsi, rdx
mov ebx, ecx
xor r13d, r13d
xor edx, edx
lea rcx, [rbp - 0x10]
mov r8d, 0x80
mov r15d, r13d
call fcn.14003a5c0
xor edx, edx
lea r8d, [r13 + 0x40]
lea rcx, [rbp - 0x50]
call fcn.14003a5c0
lea edi, [r13 + 0xf]
mov qword [rbp - 0x80], r13
mov rcx, r12
mov qword [rbp - 0x78], rdi
mov byte [rsp + 0x70], r13b
call fcn.140004e8c
mov r8, qword [0x1400c5200]
lea rdx, [0x14009d4f0]
mov r9d, ebx
lea rcx, [rbp - 0x50]
call fcn.1400055a4
lea rcx, [rbp - 0x50]
call fcn.14001fcc0
test eax, eax
jne 0x140003dc1
mov rax, qword [rsi + 8]
sub rax, qword [rsi]
sar rax, 2
mov qword [rsp + 0x48], rdi
mov edi, r13d
mov qword [rsp + 0x40], r13
mov byte [rsp + 0x30], r13b
test rax, rax
je 0x140003d70
mov r14d, r13d
mov rax, qword [rsi]
lea rcx, [rbp - 0x70]
mov edx, dword [r14 + rax]
call fcn.14001bc88
lea rcx, [0x14009d500]
mov rbx, rax
call fcn.140045e50
mov r8, rax
lea rdx, [0x14009d500]
mov rcx, rbx
call fcn.140004b2c
mov ebx, reloc.WSOCK32.dll_ntohs
mov qword [rsp + 0x60], r13
mov rdx, rax
mov qword [rsp + 0x68], rbx
lea rcx, [rsp + 0x50]
mov byte [rsp + 0x50], r13b
call fcn.140004354
or r9, 0xffffffffffffffff
lea rdx, [rsp + 0x50]
xor r8d, r8d
lea rcx, [rsp + 0x30]
call fcn.140004a10
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x140003d1b
mov rcx, qword [rsp + 0x50]
lea r8d, [rbx - 0xe]
inc rdx
call fcn.140004554
mov rdx, qword [rbp - 0x58]
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x60], r13
mov byte [rsp + 0x50], r13b
cmp rdx, 0x10
jb 0x140003d46
mov rcx, qword [rbp - 0x70]
inc rdx
mov r8d, 1
call fcn.140004554
mov rcx, qword [rsi + 8]
inc edi
sub rcx, qword [rsi]
add r14, 4
sar rcx, 2
movsxd rax, edi
cmp rax, rcx
jb 0x140003c97
cmp qword [rsp + 0x48], 0x10
mov r9, qword [rsp + 0x30]
jae 0x140003d75
lea r9, [rsp + 0x30]
mov r8, qword [0x1400c5200]
lea rdx, str._s_sppsvc.exe__pid:_s
lea rcx, [rbp - 0x10]
call fcn.1400055a4
xor edx, edx
lea rcx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_WinExec]
mov ecx, 0xaf0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140003dc1
mov rcx, qword [rsp + 0x30]
inc rdx
mov r8d, 1
call fcn.140004554
xor r8d, r8d
lea rcx, [rbp - 0x50]
xor edx, edx
call fcn.140019348
mov ecx, eax
mov edi, eax
call fcn.140037e70
mov r8d, edi
xor edx, edx
mov rcx, rax
mov r14, rax
call fcn.14003a5c0
xor r9d, r9d
mov dword [rsp + 0x20], r13d
mov r8d, edi
lea rcx, [rbp - 0x50]
mov rdx, r14
call fcn.140021484
test eax, eax
jne 0x140003e21
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, 1
lea rdx, str.ZCCM:_GetAllModuleOfProcess_FromGPAM:_fReadFile_Buf_failed___error_d__n
mov r8d, eax
mov ecx, ebx
call fcn.1400191e0
jmp 0x140003e90
cmp byte [r14], r13b
jne 0x140003e2b
mov rax, r13
jmp 0x140003e33
mov rcx, r14
call fcn.140045e50
mov r8, rax
lea rcx, [rsp + 0x70]
mov rdx, r14
call fcn.140004d8c
lea rcx, [0x14009d568]
mov qword [rsp + 0x48], reloc.WSOCK32.dll_ntohs
mov qword [rsp + 0x40], r13
mov byte [rsp + 0x30], r13b
call fcn.140045e50
mov r8, rax
lea rdx, [0x14009d568]
lea rcx, [rsp + 0x30]
call fcn.140004d8c
lea r8, [rsp + 0x30]
mov rdx, r12
lea rcx, [rsp + 0x70]
call fcn.14001d854
mov ebx, 1
mov r15d, ebx
mov rdx, rbx
mov rcx, r14
call fcn.140037e68
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x140003ebf
mov rcx, qword [rsp + 0x70]
inc rdx
mov r8, rbx
call fcn.140004554
mov rcx, qword [rsi]
mov qword [rbp - 0x78], reloc.WSOCK32.dll_ntohs
mov qword [rbp - 0x80], r13
mov byte [rsp + 0x70], r13b
test rcx, rcx
je 0x140003ef9
mov rdx, qword [rsi + 0x10]
mov r8d, 4
sub rdx, rcx
sar rdx, 2
call fcn.140004554
mov qword [rsi], r13
mov qword [rsi + 8], r13
mov qword [rsi + 0x10], r13
lea r11, [rsp + 0x170]
mov eax, r15d
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret