Function at 0x14000a570
Capabilities:
Create process on windows
Get comspec environment variable
Query environment variable
Self delete
Terminate process

Disassembly:
push rbp
sub rsp, 0x4a0
lea rbp, [rsp + 0x40]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x1400f10c0]
xor rax, rsp
mov qword [rbp + 0x450], rax
call fcn.140009cb0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rbp + 0x20]
movabs rax, 0x4b2dd19ebdde5a8c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
movabs rax, 0x330e0b39a3d26604
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0x78fbedb481a683e9
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
movabs rax, 0x35ba48a34e1f37a1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
movabs rax, 0x6037870520fe5829
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
movabs rax, 0xdfc57e1135fd85ca
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
movabs rax, 0x384895f8d1bb09d7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xe0], rax
movabs rax, 0x1e2e564dc0a71470
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xe8], rax
movabs rax, 0x58a6a2f2cfefd8c9
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xf0], rax
movabs rax, 0x41c92dc7287352f2
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xf8], rax
movabs rax, 0x4e50e96c549d2d5b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x100], rax
movabs rax, 0xdfc57e1135fdabe4
mov qword [rbp], rax
mov rax, qword [rbp]
movdqa xmm2, xmmword [rbp + 0x40]
vmovdqu ymm0, ymmword [rbp + 0xe0]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
mov qword [rbp + 0x108], rax
vxorps xmm2, xmm2, xmmword [rbp + 0x100]
vmovdqa ymmword [rbp + 0x20], ymm1
vmovdqa xmmword [rbp + 0x40], xmm2
vzeroupper
call fcn.140005c50
lea rdx, [0x140005e20]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov r8d, 0x104
lea rdx, [rbp + 0x120]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x14000a873
mov r8d, 0x104
lea rdx, [rbp + 0x120]
lea rcx, [rbp + 0x120]
call qword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test eax, eax
je 0x14000a873
mov r8d, 0x104
lea rdx, [rbp + 0x340]
lea rcx, str.COMSPEC
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x14000a873
lea rdx, str._c_del
lea rcx, [rbp + 0x230]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rdx, [rbp + 0x120]
lea rcx, [rbp + 0x230]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rdx, str.___nul
lea rcx, [rbp + 0x230]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
xor ecx, ecx
mov dword [rbp + 0x60], reloc.WS2_32.dll_WSASetLastError
lea rax, str.Open
mov qword [rbp + 0x68], rcx
mov qword [rbp + 0x70], rax
lea rax, [rbp + 0x340]
mov qword [rbp + 0x78], rax
lea rax, [rbp + 0x230]
mov qword [rbp + 0x80], rax
mov qword [rbp + 0x88], rcx
mov dword [rbp + 0x90], ecx
mov dword [rbp + 0x64], 0x40
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0x100
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov edx, reloc.WS2_32.dll_ntohs
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
lea rcx, [rbp + 0x60]
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x14000a84e
mov rcx, qword [rbp + 0xc8]
mov edx, 0x40
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov rcx, qword [rbp + 0xc8]
mov edx, 1
call qword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
xor r9d, r9d
lea r8, [rbp + 0x120]
lea edx, [r9 + 1]
lea ecx, [rdx + 3]
call qword [sym.imp.SHELL32.dll_SHChangeNotify]
jmp 0x14000a873
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, reloc.WLDAP32.dll_Ordinal_32
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3