Function at 0x100007c58
Capabilities:
Create process on windows
Delete file
Get common file path

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x20], rbp
push rsi
push rdi
push r12
sub rsp, 0x530
mov rax, qword [0x10000c110]
xor rax, rsp
mov qword [rsp + 0x520], rax
xor r12d, r12d
lea rax, [0x10000c794]
mov ecx, 0x67727473
mov dword [rsp + 0xf0], ecx
mov dword [rsp + 0xe0], ecx
mov rdi, r8
mov qword [r11 - 0x450], rax
mov qword [r11 - 0x460], rax
xor eax, eax
mov rsi, rdx
lea r8d, [r12 + 0x60]
lea rcx, [rsp + 0x78]
xor edx, edx
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov ebx, r12d
mov qword [rsp + 0x50], r12
mov dword [rsp + 0x70], r12d
call sub.msvcrt.dll_memset
mov ebp, 0x206
lea rcx, [rsp + 0x312]
mov r8, rbp
xor edx, edx
mov word [rsp + 0x310], r12w
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x102]
mov r8, rbp
xor edx, edx
mov word [rsp + 0x100], r12w
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0x310]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov ebp, 0x80070000
cmp eax, r12d
jne 0x100007d4d
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, ebp
cmp eax, r12d
cmovle ebx, eax
cmp ebx, r12d
jl 0x100007ed4
xor r9d, r9d
lea rdx, [rsp + 0x100]
xor ecx, ecx
lea r8d, [r9 + 0x25]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov ecx, 0x80004005
cmp eax, r12d
cmove ebx, ecx
cmp ebx, r12d
jl 0x100007ed4
lea rdx, [0x1000018e0]
lea rcx, [rsp + 0x310]
mov r9, rdi
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
cmp eax, r12d
jne 0x100007da9
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, ebp
cmp eax, r12d
cmovle ebx, eax
cmp ebx, r12d
jl 0x100007ed4
lea r8, [rsp + 0x100]
lea rdx, [0x100001d30]
lea rcx, [rsp + 0xf0]
mov r9, rsi
mov qword [rsp + 0x20], rdi
call fcn.100008ebc
cmp eax, r12d
mov ebx, eax
jl 0x100007ed4
lea rdx, [rsp + 0x100]
lea rcx, [rsp + 0xe0]
call fcn.100008c94
cmp eax, r12d
mov ebx, eax
jl 0x100007ed4
lea rdx, [0x100001d90]
lea rcx, [rsp + 0xe0]
call fcn.100008b6c
cmp eax, r12d
mov ebx, eax
jl 0x100007ed4
mov rdx, qword [rsp + 0xf8]
mov rcx, qword [rsp + 0xe8]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x100]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], r12d
mov dword [rsp + 0x70], 0x68
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, r12d
jne 0x100007e8d
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, ebp
cmp eax, r12d
cmovle ebx, eax
cmp ebx, r12d
jl 0x100007ed4
mov rcx, qword [rsp + 0x50]
mov edx, 0x927c0
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x80
je 0x100007ecf
cmp eax, 0x102
je 0x100007ec8
cmp eax, 0xffffffff
jne 0x100007ed4
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, ebp
cmp eax, r12d
cmovle ebx, eax
jmp 0x100007ed4
mov ebx, 0x80070102
jmp 0x100007ed4
mov ebx, 0x800700cd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp ebx, r12d
jge 0x100007eeb
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rsp + 0x50]
cmp rcx, r12
je 0x100007efb
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
cmp rcx, r12
je 0x100007f0b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0xe0]
call fcn.100008b3c
lea rcx, [rsp + 0xf0]
call fcn.100008b3c
mov eax, ebx
mov rcx, qword [rsp + 0x520]
xor rcx, rsp
call fcn.100009a00
lea r11, [rsp + 0x530]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret