Function at 0x140004a50
Capabilities:
Allocate or change rwx memory
Create process on windows
Create thread
Execute shellcode via indirect call
Inject thread
Query environment variable
Self delete
Spawn thread to rwx shellcode

Disassembly:
mov r11, rsp
push rbp
lea rbp, [r11 - 0x3a8]
sub rsp, 0x4a0
mov rax, qword [0x1402a7638]
xor rax, rsp
mov qword [rbp + 0x350], rax
cmp byte [0x1402a7f40], 0
je 0x14000576c
mov qword [r11 + 8], rbx
mov ecx, 1
mov qword [r11 - 0x18], r15
movaps xmmword [r11 - 0x28], xmm6
movaps xmmword [r11 - 0x38], xmm7
movaps xmmword [r11 - 0x48], xmm8
mov qword [rsp + 0x70], 0
call qword [sym.imp.USER32.dll_GetSystemMetrics]
movss xmm0, dword [0x14011f0f4]
xor ecx, ecx
mulss xmm0, dword [0x1400bde18]
cdq
sub eax, edx
sar eax, 1
movd xmm7, eax
cvtdq2ps xmm7, xmm7
subss xmm7, xmm0
call qword [sym.imp.USER32.dll_GetSystemMetrics]
movss xmm0, dword [0x14011f0f0]
lea r8, [rsp + 0x70]
mulss xmm0, dword [0x1400bde18]
lea rcx, [rsp + 0x68]
cdq
sub eax, edx
movss dword [rsp + 0x6c], xmm7
sar eax, 1
mov edx, 2
movd xmm1, eax
cvtdq2ps xmm1, xmm1
subss xmm1, xmm0
movss dword [rsp + 0x68], xmm1
call fcn.14002cbe0
movss xmm0, dword [0x14011f0f0]
lea rcx, [rsp + 0x70]
movss xmm1, dword [0x14011f0f4]
xor edx, edx
movss dword [rsp + 0x70], xmm0
movss dword [rsp + 0x74], xmm1
call fcn.14002cc80
mov rcx, qword [str.Clout_Client___Aim_Full]
lea rdx, [0x1402a7f40]
mov r8d, Ordinal_46
call fcn.14000bd10
call fcn.1400205b0
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x50], rax
mov rbx, rax
call fcn.1400205e0
lea rcx, [rsp + 0x70]
call fcn.140020600
lea rcx, [rbp + 0xc0]
call fcn.14001fbb0
movss xmm0, dword [rsp + 0x70]
lea r8, [rbp + 0xc0]
movss xmm1, dword [rsp + 0x74]
lea rdx, [rsp + 0x60]
addss xmm0, dword [rsp + 0x68]
addss xmm1, dword [rsp + 0x6c]
lea rcx, [rsp + 0x50]
movss dword [rsp + 0x60], xmm0
movss dword [rsp + 0x64], xmm1
call fcn.140005790
movaps xmm0, xmmword [0x1400bde70]
lea rcx, [rsp + 0x78]
movups xmmword [rsp + 0x78], xmm0
call fcn.140011e60
movss xmm2, dword [rsp + 0x68]
lea r8, [rsp + 0x60]
addss xmm2, dword [0x1400be30c]
movss xmm1, dword [rsp + 0x6c]
lea rdx, [rsp + 0x50]
addss xmm1, dword [0x1400be304]
movss xmm7, dword [0x1400bde24]
mov r9d, eax
movss dword [rsp + 0x20], xmm7
movaps xmm0, xmm2
movss dword [rsp + 0x50], xmm2
addss xmm0, dword [rsp + 0x70]
movss dword [rsp + 0x64], xmm1
movss dword [rsp + 0x54], xmm1
movss dword [rsp + 0x60], xmm0
mov rcx, rbx
call fcn.140035150
movaps xmm0, xmmword [0x1400bde70]
lea rcx, [rsp + 0x78]
movups xmmword [rsp + 0x78], xmm0
call fcn.140011e60
movss xmm1, dword [rsp + 0x6c]
lea r8, [rsp + 0x50]
movss xmm2, dword [rsp + 0x68]
lea rdx, [rsp + 0x60]
addss xmm2, dword [0x1400be30c]
movss xmm0, dword [rsp + 0x74]
mov r9d, eax
addss xmm0, xmm1
movss dword [rsp + 0x64], xmm1
mov rcx, rbx
movss dword [rsp + 0x20], xmm7
movss dword [rsp + 0x50], xmm2
movss dword [rsp + 0x60], xmm2
movss dword [rsp + 0x54], xmm0
call fcn.140035150
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x43750000
mov dword [rsp + 0x54], 0x41400000
call fcn.14002c810
movaps xmm0, xmmword [0x1400be390]
lea rdx, str.Clout_Trick
lea rcx, [rsp + 0x78]
movups xmmword [rsp + 0x78], xmm0
call fcn.140055e50
call fcn.140020100
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x40c00000
mov dword [rsp + 0x54], 0x428c0000
call fcn.14002c810
movss xmm1, dword [0x14011f01c]
xor ecx, ecx
call fcn.1400288f0
call fcn.14000fd20
cmp dword [0x1402a7bec], 0
lea rcx, str.legit
mov rdx, qword [0x1402a82b8]
sete r8b
call fcn.1400565b0
xor r15d, r15d
test al, al
je 0x140004d2e
mov dword [0x1402a7bec], r15d
movaps xmm0, xmmword [0x1400be350]
lea rcx, [rsp + 0x78]
movups xmmword [rsp + 0x78], xmm0
call fcn.140011e60
movss xmm2, dword [rsp + 0x68]
lea r8, [rsp + 0x50]
movss xmm1, dword [rsp + 0x6c]
lea rdx, [rsp + 0x60]
addss xmm1, dword [0x1400be314]
movaps xmm0, xmm2
movss dword [rsp + 0x20], xmm7
addss xmm0, dword [0x1400be308]
addss xmm2, dword [0x1400bde3c]
mov r9d, eax
mov rcx, rbx
movss dword [rsp + 0x54], xmm1
movss dword [rsp + 0x64], xmm1
movss dword [rsp + 0x50], xmm0
movss dword [rsp + 0x60], xmm2
call fcn.140035150
cmp dword [0x1402a7bec], 2
lea rcx, str.settings
mov rdx, qword [0x1402a82c0]
sete r8b
call fcn.1400565b0
test al, al
je 0x140004dca
mov dword [0x1402a7bec], 2
call fcn.14001d250
mov ecx, 1
call fcn.140028190
mov ecx, 0x80
call fcn.140021720
test al, al
je 0x140004df1
mov ecx, 7
call fcn.14002cb00
cmp byte [0x1402a8327], r15b
jne 0x140004e07
xorps xmm1, xmm1
movss dword [0x14011f01c], xmm1
jmp 0x140004e0f
movss xmm1, dword [0x14011f01c]
cmp byte [0x1402a8326], r15b
movss xmm6, dword [0x1400bde2c]
movss xmm8, dword [0x1400bdf8c]
movss xmm7, dword [0x1400bde34]
jne 0x140004eaf
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x43a00000
mov dword [rsp + 0x54], 0x43430000
call fcn.14002c810
movss xmm1, dword [0x14011f108]
xor ecx, ecx
call fcn.1400288f0
movaps xmm0, xmmword [0x1400be3a0]
lea r9, [rsp + 0x78]
movss xmm1, dword [0x1400bde38]
lea rcx, str.fodase
mov dword [rsp + 0x38], 1
movaps xmm2, xmm6
movss dword [rsp + 0x30], xmm6
movss dword [rsp + 0x28], xmm8
movss dword [rsp + 0x20], xmm7
movups xmmword [rsp + 0x78], xmm0
call fcn.140007b40
mov ecx, 1
call fcn.140028190
movss xmm1, dword [0x14011f01c]
mov eax, dword [0x1402a8328]
movaps xmm8, xmmword [rsp + 0x460]
inc eax
mov dword [0x1402a8328], eax
cmp eax, 0x3e8
jg 0x140004efe
movss xmm0, dword [0x14011f108]
addss xmm0, dword [0x1400be2ec]
addss xmm1, dword [0x1400be2e4]
mov byte [0x1402a8327], 1
movss dword [0x14011f108], xmm0
movss dword [0x14011f01c], xmm1
jmp 0x140004f05
mov byte [0x1402a8326], 1
mov eax, dword [0x1402a7bec]
test eax, eax
jne 0x140004fbe
xor ecx, ecx
call fcn.1400288f0
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x42a00000
mov dword [rsp + 0x54], 0x42960000
call fcn.14002c810
xor r9d, r9d
mov dword [rsp + 0x50], 0x43520000
xor r8d, r8d
mov dword [rsp + 0x54], 0x43898000
lea rdx, [rsp + 0x50]
lea rcx, str.Trick
call fcn.1400025f0
call fcn.14001c4f0
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x43a00000
mov dword [rsp + 0x54], 0x42960000
call fcn.14002c810
xor r9d, r9d
mov dword [rsp + 0x50], 0x43520000
xor r8d, r8d
mov dword [rsp + 0x54], 0x43898000
lea rdx, [rsp + 0x50]
lea rcx, str.More
call fcn.1400025f0
call fcn.14001c4f0
mov ecx, 1
call fcn.140028190
movss xmm1, dword [0x14011f01c]
mov eax, dword [0x1402a7bec]
cmp eax, 2
jne 0x140005554
xor ecx, ecx
call fcn.1400288f0
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x42a00000
mov dword [rsp + 0x54], 0x42960000
call fcn.14002c810
xor r9d, r9d
mov dword [rsp + 0x50], 0x43700000
xor r8d, r8d
mov dword [rsp + 0x54], 0x43520000
lea rdx, [rsp + 0x50]
lea rcx, str.Config
call fcn.1400025f0
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x41200000
mov dword [rsp + 0x54], 0x41200000
call fcn.14002c810
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x40400000
mov ecx, 0xa
mov dword [rsp + 0x54], 0x40400000
call fcn.140028810
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x40a00000
mov ecx, reloc.WS2_32.dll_ntohl
mov dword [rsp + 0x54], 0x40a00000
call fcn.140028810
lea rdx, [0x1402a82f3]
lea rcx, str.Stream_Mode
call fcn.140001980
mov ecx, 1
call fcn.140028190
mov ecx, 1
call fcn.140028190
movaps xmm0, xmm7
call fcn.14002c890
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x40400000
mov ecx, 0xa
mov dword [rsp + 0x54], 0x40400000
call fcn.140028810
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x40a00000
mov ecx, reloc.WS2_32.dll_ntohl
mov dword [rsp + 0x54], 0x40a00000
call fcn.140028810
lea rdx, [0x1402a82f4]
lea rcx, str.Hide_From_TaskBar
call fcn.140001980
mov ecx, 1
call fcn.140028190
mov ecx, 1
call fcn.140028190
movaps xmm0, xmm7
call fcn.14002c890
xor r8d, r8d
mov dword [rsp + 0x50], 0x43340000
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x54], 0x420c0000
lea rcx, str.Bypass_Clear
call fcn.14004ca60
test al, al
je 0x1400054ab
xorps xmm0, xmm0
lea rdx, [rbp - 0x70]
xor eax, eax
mov r8d, 0x104
xor ecx, ecx
mov qword [rbp + 0x130], rax
movups xmmword [rbp + 0xd0], xmm0
mov qword [rbp - 0x78], rax
movups xmmword [rbp + 0xe0], xmm0
movups xmmword [rbp + 0xf0], xmm0
movups xmmword [rbp + 0x100], xmm0
movups xmmword [rbp + 0x110], xmm0
movups xmmword [rbp + 0x120], xmm0
movups xmmword [rsp + 0x78], xmm0
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea r9, [rbp - 0x70]
mov edx, 0x208
lea r8, str.cmd.exe__C_ping_1.1.1.1__n_1__w_3000___Nul__Del__f__q___s_
lea rcx, [rbp + 0x140]
call fcn.1400084b0
lea rax, [rsp + 0x78]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rdx, [rbp + 0x140]
lea rax, [rbp + 0xd0]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor ecx, ecx
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], r15d
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
mov dword [rbp + 0xd0], WSAGetLastError
lea rax, [rsp + 0x78]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rdx, str.explorer.exe
lea rax, [rbp + 0xd0]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor ecx, ecx
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x8000044
mov dword [rsp + 0x20], r15d
movups xmmword [rbp + 0xd8], xmm0
movups xmmword [rbp + 0xe8], xmm0
movups xmmword [rbp + 0xf8], xmm0
movups xmmword [rbp + 0x108], xmm0
movups xmmword [rbp + 0x118], xmm0
movups xmmword [rbp + 0x128], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x140005400
mov rcx, qword [rbp - 0x80]
mov qword [rsp + 0x4b8], rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x78]
test rsi, rsi
je 0x1400053f8
xor edx, edx
mov qword [rsp + 0x498], r14
mov r9d, 0x3000
mov dword [rsp + 0x20], 0x40
mov r8d, 0x1b0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r14, rax
test rax, rax
jne 0x1400052cb
mov rcx, rsi
jmp 0x1400053ea
mov qword [rsp + 0x4c0], rdi
lea rcx, str.kernel32.dll
lea rdi, [rax + 0x80]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.WaitForSingleObject
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1400be0f0]
mov rcx, rbx
mov qword [rbp - 0x70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.ExitProcess
mov rcx, rbx
mov qword [rbp - 0x68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.DeleteFileA
mov rcx, rbx
mov qword [rbp - 0x58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp - 0x60], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x30], 2
lea r9, [rbp - 0x50]
mov rdx, rax
mov dword [rsp + 0x28], r15d
mov rcx, rax
mov dword [rsp + 0x20], r15d
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov r8d, 0x104
lea rdx, [rbp - 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov r9d, 0x80
mov qword [rsp + 0x20], r15
lea r8, [0x1400068e0]
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r9d, 0x130
mov qword [rsp + 0x20], r15
lea r8, [rbp - 0x70]
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x60], r15d
mov qword [rsp + 0x30], rax
mov r9, r14
mov dword [rsp + 0x28], r15d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rdi, qword [rsp + 0x4c0]
test rax, rax
je 0x1400053f0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r14, qword [rsp + 0x498]
mov rsi, qword [rsp + 0x4b8]
mov r8d, 0x104
lea rdx, [rbp + 0x140]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x1400054ab
mov r8d, 0x104
lea rdx, [rbp + 0x140]
lea rcx, [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test eax, eax
je 0x1400054ab
lea rdx, str._c_del
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rdx, [rbp + 0x140]
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rdx, str.____NUL
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov r8d, 0x104
lea rdx, [rbp + 0x140]
lea rcx, str.ComSpec
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x1400054ab
mov dword [rsp + 0x28], r15d
lea r9, [rbp - 0x70]
lea r8, [rbp + 0x140]
mov qword [rsp + 0x20], r15
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
movaps xmm0, xmm7
call fcn.14002c890
lea rcx, str.Hide_Process_Key:
call fcn.140055e20
movss xmm6, dword [0x1400bde50]
xorps xmm0, xmm0
movaps xmm1, xmm6
call fcn.14002bec0
movss xmm0, dword [0x1400be318]
call fcn.14002c890
movaps xmm2, xmmword [0x1400be3b0]
lea rdx, str.INSERT
lea rcx, [rsp + 0x78]
movups xmmword [rsp + 0x78], xmm2
call fcn.140055e50
movaps xmm0, xmm7
call fcn.14002c890
lea rcx, str.Close_Process:
call fcn.140055e20
movaps xmm1, xmm6
xorps xmm0, xmm0
call fcn.14002bec0
movss xmm0, dword [0x1400be310]
call fcn.14002c890
movaps xmm0, xmmword [0x1400be3b0]
lea rdx, [0x1400be2e0]
lea rcx, [rsp + 0x78]
movups xmmword [rsp + 0x78], xmm0
call fcn.140055e50
call fcn.14001c4f0
mov ecx, 1
call fcn.140028190
cmp byte [0x1402a82f9], r15b
movaps xmm7, xmmword [rsp + 0x470]
movaps xmm6, xmmword [rsp + 0x480]
je 0x140005653
call sub.MSVCP140.dll__Xtime_get_ticks
call sub.MSVCP140.dll__Xtime_get_ticks
mov rcx, rax
mov qword [rsp + 0x50], r15
movabs rax, 0xd6bf94d5e57a42bd
mov dword [rsp + 0x60], 0x41700000
imul rcx
lea r8, [rsp + 0x50]
mov dword [rsp + 0x64], 0x41700000
add rdx, rcx
lea rcx, [rsp + 0x60]
sar rdx, 0x17
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov qword [rsp + 0x78], rdx
xor edx, edx
call fcn.14002cbe0
xor edx, edx
mov dword [rsp + 0x50], 0x43d48000
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x54], 0x420c0000
call fcn.14002cc80
xor edx, edx
lea rcx, str.WaterMark
lea r8d, [rdx + 0x27]
call fcn.14000bd10
movaps xmm0, xmmword [0x1400be380]
lea rdx, [rsp + 0x50]
mov ecx, 4
movups xmmword [rsp + 0x50], xmm0
call fcn.1400286e0
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x41200000
mov dword [rsp + 0x54], 0x41000000
call fcn.14002c810
lea rcx, [rsp + 0x78]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__ctime64]
mov rdx, rax
lea rcx, str.CLOUT_CLIENT___AIM__s
call fcn.140055e20
mov ecx, 1
call fcn.1400280e0
call fcn.14001bfd0
xor ecx, ecx
mov qword [rsp + 0x60], r15
cmp byte [0x1402a82f4], r15b
je 0x14000569f
call qword [sym.imp.ole32.dll_CoInitialize]
xor edx, edx
lea rax, [rsp + 0x60]
lea r9, [0x1400ff150]
mov qword [rsp + 0x20], rax
lea rcx, [0x1400ff160]
lea r8d, [rdx + 1]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jne 0x1400056f4
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax]
mov rbx, qword [rcx + 0x28]
jmp 0x1400056d9
call qword [sym.imp.ole32.dll_CoInitialize]
xor edx, edx
lea rax, [rsp + 0x60]
lea r9, [0x1400ff150]
mov qword [rsp + 0x20], rax
lea rcx, [0x1400ff160]
lea r8d, [rdx + 1]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jne 0x1400056f4
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax]
mov rbx, qword [rcx + 0x20]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rcx, qword [rsp + 0x60]
mov rdx, rax
call rbx
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
call qword [sym.imp.ole32.dll_CoUninitialize]
cmp byte [0x1402a82f3], 0
mov r15, qword [rsp + 0x490]
mov rbx, qword [rsp + 0x4b0]
je 0x140005720
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov edx, reloc.WS2_32.dll_recvfrom
jmp 0x140005728
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_SetWindowDisplayAffinity]
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x42a00000
mov dword [rsp + 0x54], 0x43d48000
call fcn.14002c810
cmp qword [0x1402a8298], 0x10
lea rcx, [0x1402a8280]
cmovae rcx, qword [0x1402a8280]
call fcn.140055e20
call fcn.14001bfd0
mov rcx, qword [rbp + 0x350]
xor rcx, rsp
call fcn.1400ba060
add rsp, 0x4a0
pop rbp
ret