Function at 0x140078d90
Capabilities:
Check os version
Create process on windows
Delete file
Query environment variable
Self delete

Disassembly:
jmp 0x140078d90
push r13
push r14
push r15
push rbp
sub rsp, 0x598
mov r13, rdx
mov rax, qword [0x14016fb98]
xor ebp, ebp
mov rdx, qword [rcx]
xor rax, rsp
mov qword [rsp + 0x590], rax
test rdx, rdx
je 0x140078dc8
and byte [r13 + 0x27a], 0xc7
mov rdx, qword [rcx]
cmp rdx, 6
ja 0x14007969a
mov edx, edx
lea r8, [0x140000000]
mov byte [rsp + 0x58], 0xa
movzx eax, word [r8 + rdx*2 + 0x14de2c]
lea rax, [r8 + rax + 0x78df3]
jmp rax
mov edx, dword [0x140191994]
test edx, edx
je 0x1400791bc
test byte [r13 + 0x280], 0x80
jne 0x140079509
xor r15d, r15d
mov edx, 0x300
pxor xmm0, xmm0
movq qword [rsp + 0x580], xmm0
movd dword [rsp + 0x588], xmm0
movups xmmword [rsp + rdx + 0x270], xmm0
movups xmmword [rsp + rdx + 0x260], xmm0
movups xmmword [rsp + rdx + 0x250], xmm0
movups xmmword [rsp + rdx + 0x240], xmm0
sub rdx, 0x40
jne 0x1400791da
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0xa0], xmm0
movups xmmword [rsp + 0xb0], xmm0
movq qword [rsp + 0xc0], xmm0
mov r8b, byte [r13 + 0x27a]
mov dword [rsp + 0x60], Ordinal_110
test r8b, 0x20
je 0x140079333
test r8b, 8
jne 0x14007927b
cmp qword [0x14016fbe0], 0
je 0x14007977b
mov r8, qword [0x14016fcc0]
mov rdx, qword [r13 + 0xc8]
lea rcx, [rsp + 0x280]
call r8
jmp 0x1400792b4
cmp qword [0x14016fbe0], 0
je 0x140079851
mov r10, qword [0x14016fcc0]
mov r8, qword [r13 + 0xc8]
lea rcx, [rsp + 0x280]
lea rdx, str._s__DEL__s
mov r9, r8
call r10
and byte [r13 + 0x27a], 0xf7
mov rdx, rsp
xor r10d, r10d
xor ecx, ecx
lea r11, [rsp + 0x60]
xor r8d, r8d
lea r14, [rsp + 0xc8]
xor r9d, r9d
mov dword [rdx + 0x20], 1
mov dword [rdx + 0x28], 0x4000000
mov qword [rdx + 0x30], r10
mov qword [rdx + 0x38], r10
mov qword [rdx + 0x40], r11
mov qword [rdx + 0x48], r14
lea rdx, [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x140079839
mov rcx, qword [rsp + 0xd0]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
je 0x140079821
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8b, byte [r13 + 0x27a]
test r8b, 0x10
jne 0x140079348
test r8b, 8
jne 0x1400794e6
jmp 0x140079501
lea rcx, str.FOR_DEFAULT_PRINT_DEVICE
lea rdx, [rsp + 0xe0]
mov r8d, 0x105
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov eax, eax
test rax, rax
jbe 0x14007937b
cmp rax, 0x105
jae 0x14007937b
mov dl, byte [rsp + 0xe0]
jmp 0x140079385
mov byte [rsp + 0xe0], 0
xor dl, dl
test dl, dl
lea r14, str.PRN_FILE
mov dword [rsp + 0x1e4], 0x94
lea rdx, [rsp + 0xe0]
cmovne r14, rdx
lea rcx, [rsp + 0x1e4]
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rsp + 0x1f4], 1
jne 0x1400793f0
cmp qword [0x14016fbe0], 0
je 0x140079785
mov r10, qword [0x14016fcc0]
lea rdx, str.Command.com__C_COPY___s___s
lea rcx, [rsp + 0x280]
mov r9, r14
mov r8, qword [r13 + 0xc8]
call r10
jmp 0x140079421
cmp qword [0x14016fbe0], 0
je 0x140079817
mov r10, qword [0x14016fcc0]
lea rdx, str.Cmd.exe__C_COPY___s___s
lea rcx, [rsp + 0x280]
mov r9, r14
mov r8, qword [r13 + 0xc8]
call r10
mov rdx, rsp
xor r10d, r10d
xor ecx, ecx
lea r11, [rsp + 0x60]
xor r8d, r8d
lea r14, [rsp + 0xc8]
xor r9d, r9d
mov dword [rdx + 0x20], 1
mov dword [rdx + 0x28], 0x4000000
mov qword [rdx + 0x30], r10
mov qword [rdx + 0x38], r10
mov qword [rdx + 0x40], r11
mov qword [rdx + 0x48], r14
lea rdx, [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x1400797ef
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x1400797d7
mov rcx, qword [rsp + 0xc8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
je 0x1400797bf
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x1400797a7
mov r8b, byte [r13 + 0x27a]
test r8b, 8
je 0x140079501
cmp dword [r13 + 0x1a0], 0
je 0x1400794e6
and r8b, 0xf7
mov r15d, 5
mov byte [r13 + 0x27a], r8b
xor dl, dl
test dl, dl
je 0x140079506
test r8b, 4
jne 0x140079501
mov rcx, qword [r13 + 0xc8]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x14007978f
test r15d, r15d
je 0x140079509
mov ebp, r15d
mov rcx, qword [r13 + 0xc8]
call fcn.14000231f
test eax, eax
je 0x14007951d
mov ebp, eax
jmp 0x140079536
lea rdx, str._Unknown_
xor r8d, r8d
mov qword [r13 + 0xc8], rdx
mov word [r13 + 0x262], r8w
mov rcx, qword [r13 + 0x70]
call fcn.14000231f
test eax, eax
je 0x140079547
mov ebp, eax
jmp 0x14007954f
mov qword [r13 + 0x70], 0
test byte [r13 + 0x27a], 0x40
je 0x140079578
mov rcx, qword [r13 + 0xb8]
call fcn.14000231f
test eax, eax
je 0x14007956d
mov ebp, eax
jmp 0x140079578
mov qword [r13 + 0xb8], 0
test byte [r13 + 0x27d], 0x80
jne 0x14007966d
mov r14, qword [r13 + 0x50]
mov r11, qword [r13 + 0x58]
mov r9d, dword [r13 + 0x48]
mov r10b, byte [r13 + 0x285]
test byte [r13 + 0x279], 0x18
je 0x140079607
mov r8d, dword [r13 + 0x1d0]
mov edx, 0x240
pxor xmm0, xmm0
movups xmmword [r13 + 0x270], xmm0
movups xmmword [r13 + 0x280], xmm0
movq qword [r13 + 0x290], xmm0
movups xmmword [r13 + rdx + 0x20], xmm0
movups xmmword [r13 + rdx + 0x10], xmm0
movups xmmword [r13 + rdx], xmm0
movups xmmword [r13 + rdx - 0x10], xmm0
sub rdx, 0x40
jne 0x1400795cc
mov dl, byte [r13 + 0x279]
and dl, 0xe7
add dl, 8
mov byte [r13 + 0x279], dl
mov dword [r13 + 0x1d0], r8d
jmp 0x140079647
mov edx, 0x240
pxor xmm0, xmm0
movups xmmword [r13 + 0x270], xmm0
movups xmmword [r13 + 0x280], xmm0
movq qword [r13 + 0x290], xmm0
movups xmmword [r13 + rdx + 0x20], xmm0
movups xmmword [r13 + rdx + 0x10], xmm0
movups xmmword [r13 + rdx], xmm0
movups xmmword [r13 + rdx - 0x10], xmm0
sub rdx, 0x40
jne 0x140079629
mov dl, byte [r13 + 0x285]
and r10b, 2
and dl, 0xfd
or dl, r10b
mov qword [r13 + 0x50], r14
mov qword [r13 + 0x58], r11
mov byte [r13 + 0x285], dl
mov dword [r13 + 0x48], r9d
jmp 0x140079675
and byte [r13 + 0x279], 0xdf
mov rcx, qword [rsp + 0x590]
xor rcx, rsp
cmp rcx, qword [0x14016fb98]
jne 0x1400796c2
mov eax, ebp
add rsp, 0x598
pop rbp
pop r15
pop r14
pop r13
ret
mov rcx, qword [rsp + 0x590]
xor rcx, rsp
cmp rcx, qword [0x14016fb98]
jne 0x1400796c2
mov eax, 0x30
add rsp, 0x598
pop rbp
pop r15
pop r14
pop r13
ret
call fcn.140003bcf
call fcn.1400019fb
movzx edx, byte [r13 + 0x27a]
mov ecx, eax
not edx
and edx, 8
shr edx, 3
call fcn.140002121
cmp eax, 0xffffffff
jne 0x1400791a4
and byte [r13 + 0x27a], 0xf7
mov edx, dword [0x140191994]
jmp 0x1400791aa
call fcn.140002eb4
jmp 0x140079260
call fcn.140002eb4
jmp 0x1400793cb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [r13 + 0x1a0], eax
mov r15d, 0x1c
jmp 0x140079506
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [r13 + 0x1a0], eax
mov r15d, 0x1c
jmp 0x1400794b8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [r13 + 0x1a0], eax
mov r15d, 0x1c
jmp 0x1400794a2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [r13 + 0x1a0], eax
mov r15d, 0x1c
jmp 0x140079486
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8b, byte [r13 + 0x27a]
mov dl, r8b
and dl, 8
mov r15d, 0x1c
mov dword [r13 + 0x1a0], eax
shr dl, 3
jmp 0x1400794e2
call fcn.140002eb4
jmp 0x1400793fe
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [r13 + 0x1a0], eax
mov r15d, 0x1c
jmp 0x14007931e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [r13 + 0x1a0], eax
mov r15d, 0x1c
jmp 0x140079303
call fcn.140002eb4
jmp 0x140079289