Function at 0x14000f2dc
Capabilities:
Create a process with modified i/o handles and window
Create process on windows
Get common file path
Get comspec environment variable
Move file
Query environment variable
Resume thread
Self delete

Disassembly:
push rsi
push rdi
push r12
mov eax, 0x1080
call fcn.14006c5a0
sub rsp, rax
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [rsp + 0x10a8], rbx
mov qword [rsp + 0x10b0], rbp
mov rax, qword [0x140099938]
xor rax, rsp
mov qword [rsp + 0x1070], rax
mov rbx, rcx
lea r8, [0x140077ba0]
lea rsi, str.CDelDrvApp::Suicide
mov rdx, rsi
mov ebp, 5
mov ecx, ebp
call fcn.140009480
mov rax, qword [rbx + 0x528]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbx + 0x520]
lea r8, str.Entered..._pid__0x_1_lx___pExecutable___2_s_._n
mov rdx, rsi
mov ecx, ebp
call fcn.140009480
mov r8d, dword [rbx + 0x520]
xor edx, edx
mov ecx, 0x100400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
xor r12d, r12d
cmp rax, r12
je 0x14000f3a4
lea r8, str.OpenProcess:Parent_process_is_alive._Wait_the_process_exit._n
mov rdx, rsi
mov ecx, ebp
call fcn.140009480
or edx, 0xffffffff
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000f3c1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea r8, str.OpenProcess_failed._0x_1_lx___Parent_process_is_not_alive__Skipped._n
mov rdx, rsi
mov ecx, 2
call fcn.140009480
lea r8, str.Delete_Uninstaller._n
mov rdx, rsi
mov ecx, ebp
call fcn.140009480
xor edx, edx
mov rcx, rbx
call fcn.14000d4e4
cmp eax, r12d
jne 0x14000f40d
lea r8, str.Delete_Uninstaller_failed._n
mov rdx, rsi
mov ecx, 2
call fcn.140009480
lea r8, [0x140077bc0]
mov rdx, rsi
mov ecx, ebp
call fcn.140009480
xor eax, eax
jmp 0x14000f916
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x110], 7
mov qword [rsp + 0x108], r12
mov word [rsp + 0xf8], r12w
lea rcx, [rsp + 0x120]
call fcn.140041fbc
nop
lea rdx, [rsp + 0xa40]
mov ecx, 0x105
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, r12d
je 0x14000f499
lea r9, [rsp + 0xa40]
lea r8, str.szTempW___1_ls_._n
mov rdx, rsi
mov ecx, ebp
call fcn.140009480
lea rcx, [rsp + 0xa40]
call fcn.14005b1c0
mov r8, rax
lea rdx, [rsp + 0xa40]
lea rcx, [rsp + 0xf0]
call fcn.140002280
lea rcx, [rsp + 0x68]
call fcn.14005d470
mov edi, 0x101
mov qword [rsp + 0x40], rdi
lea rax, [rsp + 0xc50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
lea rax, [rsp + 0x830]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x105
lea r9, [rsp + 0xe60]
mov r8d, 4
lea rdx, [rsp + 0x400]
mov rcx, qword [rsp + 0x68]
call fcn.14005cbe4
lea r8, [rsp + 0xc50]
mov rdx, rdi
lea rcx, [rsp + 0x830]
call fcn.14005c0a4
cmp dword [rbx + 0x50c], r12d
je 0x14000f61b
lea r8, str.in_restart_deletion_mode._n
mov rdx, rsi
mov ecx, ebp
call fcn.140009480
lea r8, [0x140078ac4]
mov edi, 0x104
mov rdx, rdi
lea rcx, [rsp + 0x410]
call fcn.14005ceb0
lea r8, [rsp + 0x830]
mov rdx, rdi
lea rcx, [rsp + 0x410]
call fcn.14005c0a4
lea r9, [rsp + 0x410]
lea r8, str.MoveFileEx_delete_after_restart._szSelf___1_s__n
mov rdx, rsi
mov ecx, ebp
call fcn.140009480
lea r9, [rsp + 0xf8]
cmp qword [rsp + 0x110], 8
cmovae r9, qword [rsp + 0xf8]
lea r8, str.MoveFileEx_changeDir_strFilePathW___1_ls_._n
mov rdx, rsi
mov ecx, ebp
call fcn.140009480
lea rdx, [rsp + 0xf8]
cmp qword [rsp + 0x110], 8
cmovae rdx, qword [rsp + 0xf8]
lea rcx, [rsp + 0x120]
call fcn.140041f6c
xor edx, edx
lea r8d, [rdx + 4]
lea rcx, [rsp + 0x410]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ebx, eax
lea rcx, [rsp + 0x120]
call fcn.140041dd0
nop
lea rcx, [rsp + 0x120]
call fcn.140041f14
nop
cmp qword [rsp + 0x110], 8
jb 0x14000f614
mov rcx, qword [rsp + 0xf8]
call fcn.14005ab0c
mov eax, ebx
jmp 0x14000f916
lea r8, str.in_standard_deletion_mode._n
mov rdx, rsi
mov ecx, ebp
call fcn.140009480
mov r11d, dword [0x14009b9ec]
neg r11d
sbb ebx, ebx
and ebx, 0xfffffff8
add ebx, 0xc
mov edi, 0x104
mov r8d, edi
lea rdx, [rsp + 0x620]
lea rcx, str._COMSPEC_
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea r8, [0x140078ac4]
mov rdx, rdi
lea rcx, [rsp + 0x410]
call fcn.14005ceb0
lea r8, [rsp + 0x830]
mov rdx, rdi
lea rcx, [rsp + 0x410]
call fcn.14005c0a4
lea r8, str.__c_del
mov rdx, rdi
lea rcx, [rsp + 0x620]
call fcn.14005c0a4
lea r8, [rsp + 0x410]
mov rdx, rdi
lea rcx, [rsp + 0x620]
call fcn.14005c0a4
lea r8, str.___nul
mov rdx, rdi
lea rcx, [rsp + 0x620]
call fcn.14005c0a4
mov edi, 0x68
mov r8, rdi
xor edx, edx
lea rcx, [rsp + 0x80]
call fcn.14005bb90
xor edx, edx
lea r8d, [rdi - 0x50]
lea rcx, [rsp + 0x50]
call fcn.14005bb90
mov dword [rsp + 0x80], edi
mov edi, 1
mov dword [rsp + 0xbc], edi
mov word [rsp + 0xc0], r12w
lea r9, [rsp + 0x620]
lea r8, str.szCommandLine___1_s_._n
mov rdx, rsi
mov ecx, ebp
call fcn.140009480
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0x100
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
lea edx, [rdi + 0xe]
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
lea r9, [rsp + 0xf8]
cmp qword [rsp + 0x110], 8
cmovae r9, qword [rsp + 0xf8]
lea r8, str.CreateProcess_changeDir_strFilePathW___1_ls_._n
mov rdx, rsi
mov ecx, ebp
call fcn.140009480
lea rdx, [rsp + 0xf8]
cmp qword [rsp + 0x110], 8
cmovae rdx, qword [rsp + 0xf8]
lea rcx, [rsp + 0x120]
call fcn.140041f6c
lea r11, [rsp + 0x50]
mov qword [rsp + 0x48], r11
lea rax, [rsp + 0x80]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x620]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, r12d
je 0x14000f8aa
lea r8, str.CreateProcess_succeeded._n
mov rdx, rsi
mov ecx, ebp
call fcn.140009480
lea edx, [rdi + 0x3f]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
lea edx, [rdi - 0x10]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
mov r9d, ebx
lea r8, str.CreateProcess_Thread_Suspend_count___1_d___GetLastError_0x_2_lx__._n
mov rdx, rsi
lea ecx, [rdi + 3]
call fcn.140009480
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r9d, r9d
lea r8, [rsp + 0x410]
mov edx, ebp
lea ecx, [rdi + 3]
call qword [sym.imp.SHELL32.dll_SHChangeNotify]
lea rcx, [rsp + 0x120]
call fcn.140041dd0
nop
lea rcx, [rsp + 0x120]
call fcn.140041f14
nop
cmp qword [rsp + 0x110], 8
jb 0x14000f8a6
mov rcx, qword [rsp + 0xf8]
call fcn.14005ab0c
mov eax, edi
jmp 0x14000f916
lea r8, str.ShellExecuteEx_failed._n
mov rdx, rsi
mov ecx, ebp
call fcn.140009480
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0x20
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
lea rcx, [rsp + 0x120]
call fcn.140041dd0
nop
lea rcx, [rsp + 0x120]
call fcn.140041f14
nop
cmp qword [rsp + 0x110], 8
jb 0x14000f914
mov rcx, qword [rsp + 0xf8]
call fcn.14005ab0c
xor eax, eax
mov rcx, qword [rsp + 0x1070]
xor rcx, rsp
call fcn.14005bad0
lea r11, [rsp + 0x1080]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret