Function at 0x140004f30
Capabilities:
Create process on windows
Create process suspended
Delete file
Read file via mapping
Resume thread
Terminate thread
Use process replacement

Disassembly:
push rbp
push rbx
push rdi
push r14
push r15
lea rbp, [rsp - 0xa10]
sub rsp, 0xb10
mov r15, rcx
lea rdi, [rbp - 0x20]
xor eax, eax
lea rdx, [rbp - 0x20]
mov ecx, 0x20a
xor ebx, ebx
rep stosb byte [rdi], al
lea rcx, [0x1401918f8]
mov r8d, 0x104
mov r14d, ebx
call fcn.140022160
dec eax
cmp eax, 0x103
ja 0x1400053dc
mov qword [rsp + 0xb40], rsi
lea rdi, [rbp + 0x1f0]
mov rsi, qword [r15 + 0x10]
lea r9, [rbp - 0x20]
xor eax, eax
mov qword [rsp + 0xb50], r12
mov ecx, 0x410
mov qword [rsp + 0xb58], r13
rep stosb byte [rdi], al
lea r13, str.kernelmoduleunloader.exe
mov edx, 0x208
lea rcx, [rbp + 0x1f0]
mov qword [rsp + 0x20], r13
lea r8, [0x140191990]
call fcn.140001c40
test rsi, rsi
je 0x140004fed
mov r8d, 0x3ea
lea rdx, [rbp + 0x1f0]
mov rcx, rsi
call fcn.140012ab0
mov rsi, qword [r15 + 0x10]
lea rdi, [rbp + 0x1f0]
xor eax, eax
lea r9, [rbp - 0x20]
mov ecx, 0x410
lea r8, [0x140191990]
rep stosb byte [rdi], al
lea rax, str.kernelmoduleunloader.exe.sig
mov edx, 0x208
lea rcx, [rbp + 0x1f0]
mov qword [rsp + 0x20], rax
call fcn.140001c40
test rsi, rsi
je 0x140005043
mov r8d, 0x3eb
lea rdx, [rbp + 0x1f0]
mov rcx, rsi
call fcn.140012ab0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdi, [rbp + 0x1f0]
mov ecx, 0x410
mov rsi, rax
lea r9, [rbp - 0x20]
xor eax, eax
lea r8, [0x140191990]
rep stosb byte [rdi], al
lea rax, str.u.dll
mov edx, 0x208
lea rcx, [rbp + 0x1f0]
mov qword [rsp + 0x20], rax
call fcn.140001c40
test rsi, rsi
je 0x1400050a0
mov r8d, 0x7d0
lea rdx, [rbp + 0x1f0]
mov rcx, rsi
call fcn.140012ab0
lea r9, [rbp - 0x20]
mov qword [rsp + 0x20], r13
lea r8, [0x140191990]
mov edx, 0x208
lea rcx, [rbp + 0x600]
call fcn.140001c40
mov qword [rsp + 0x30], rbx
lea rcx, [rbp + 0x600]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 3
mov edx, 0x80000000
mov rdi, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x1400052e0
mov qword [rsp + 0x28], rbx
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], ebx
mov r8d, 0x1000002
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rsi, rax
test rax, rax
je 0x140005148
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
mov edx, 4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rcx, rsi
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rdi, rdi
je 0x1400052e0
movsxd rcx, dword [rdi + 0x3c]
mov edx, 0x14c
add rcx, rdi
movzx eax, word [rcx + 4]
cmp ax, dx
jne 0x14000517a
mov esi, dword [rcx + 0x34]
mov eax, dword [rcx + 0x28]
add rsi, rax
jmp 0x140005190
mov edx, 0x8664
cmp ax, dx
jne 0x14000518d
mov esi, dword [rcx + 0x28]
add rsi, qword [rcx + 0x30]
jmp 0x140005190
mov rsi, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
xor eax, eax
lea rdi, [rsp + 0x70]
mov ecx, 0x68
rep stosb byte [rdi], al
lea rdi, [rsp + 0x50]
mov dword [rsp + 0x70], 0x68
mov ecx, 0x18
rep stosb byte [rdi], al
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rdx, [rbp + 0x600]
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor ecx, ecx
lea rax, [rbp - 0x20]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1400052eb
mov rcx, qword [rsp + 0x50]
lea rax, [rbp + 0xa48]
mov r9d, 0xbf
mov qword [rsp + 0x20], rax
lea r8, [0x1401a2ed0]
mov qword [rbp + 0xa48], rbx
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140005274
mov qword [rsp + 0x20], r15
call fcn.14000e710
mov rcx, qword [rsp + 0x58]
mov r14, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
test r14, r14
je 0x140005274
mov rcx, qword [rsp + 0x50]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [r15 + 0x28], rbx
setne bl
test r14, r14
je 0x1400052eb
mov rcx, qword [r14 + 0x28]
mov edx, 0x7d0
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x1400052b8
mov rcx, qword [r14 + 0x28]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [r14 + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword gs:[0x30]
mov r8, r14
xor edx, edx
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x1400052eb
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov qword [rsp + 0x20], r13
lea rdi, [rbp + 0x1f0]
mov ecx, 0x410
rep stosb byte [rdi], al
lea rcx, [rbp + 0x1f0]
mov edx, 0x208
lea r9, [rbp - 0x20]
lea r8, [0x140191990]
call fcn.140001c40
lea rcx, [rbp + 0x1f0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
lea rdi, [rbp + 0x1f0]
mov ecx, 0x410
lea r9, [rbp - 0x20]
rep stosb byte [rdi], al
lea rax, str.kernelmoduleunloader.exe.sig
mov edx, 0x208
lea rcx, [rbp + 0x1f0]
mov qword [rsp + 0x20], rax
lea r8, [0x140191990]
call fcn.140001c40
lea rcx, [rbp + 0x1f0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
lea rdi, [rbp + 0x1f0]
mov ecx, 0x410
lea r9, [rbp - 0x20]
rep stosb byte [rdi], al
lea rax, str.u.dll
mov edx, 0x208
lea rcx, [rbp + 0x1f0]
mov qword [rsp + 0x20], rax
lea r8, [0x140191990]
call fcn.140001c40
lea rcx, [rbp + 0x1f0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov r13, qword [rsp + 0xb58]
mov eax, ebx
mov r12, qword [rsp + 0xb50]
mov rsi, qword [rsp + 0xb40]
add rsp, 0xb10
pop r15
pop r14
pop rdi
pop rbx
pop rbp
ret
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
add rsp, 0xb10
pop r15
pop r14
pop rdi
pop rbx
pop rbp
ret