Function at 0x140063c20
Capabilities:
Create thread
Delete file
Read file via mapping
Set file attributes

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov word [rsp + 8], cx
sub rsp, 0x188
mov dword [rsp + 0x30], 0
movzx ecx, word [rsp + 0x190]
call fcn.140061930
cmp dword [rsp + 0x198], 0
je 0x140063ebc
cmp qword [rsp + 0x1a8], 0
je 0x140063ebc
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x50], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x1a8]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x1b0]
mov qword [rsp + 0x70], rax
lea rax, str.GlobalShadowDefenderSharedMemory
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x1000
xor r9d, r9d
mov r8d, 4
xor edx, edx
mov rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x140063d23
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 6
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x60], 0
je 0x140063d23
mov rax, qword [rsp + 0x60]
mov dword [rax], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x50]
lea r8, [0x140061540]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x48], rax
call fcn.140061820
mov r9, qword [rsp + 0x50]
mov r8d, dword [rsp + 0x1a0]
mov edx, dword [rsp + 0x198]
movzx ecx, word [rsp + 0x190]
call fcn.140060cb0
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jne 0x140063da5
mov r9, qword [rsp + 0x50]
mov r8d, dword [rsp + 0x1a0]
mov edx, dword [rsp + 0x198]
movzx ecx, word [rsp + 0x190]
call fcn.1400603c0
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jne 0x140063dd1
mov r9, qword [rsp + 0x50]
mov r8d, dword [rsp + 0x1a0]
mov edx, dword [rsp + 0x198]
movzx ecx, word [rsp + 0x190]
call fcn.140060cb0
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jne 0x140063dfd
mov r9, qword [rsp + 0x50]
mov r8d, dword [rsp + 0x1a0]
mov edx, dword [rsp + 0x198]
movzx ecx, word [rsp + 0x190]
call fcn.1400603c0
mov dword [rsp + 0x30], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x40], eax
call fcn.140061710
cmp dword [rsp + 0x30], 0
je 0x140063e64
movzx eax, word [rsp + 0x190]
lea rcx, str.diskpt0.sys
mov qword [rsp + 0x20], rcx
mov r9d, eax
lea r8, str._c:_s
mov edx, 0x80
lea rcx, [rsp + 0x80]
call fcn.140003410
mov edx, 0x80
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rsp + 0x60], 0
je 0x140063e9d
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
cmp qword [rsp + 0x38], 0
je 0x140063eb0
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140063edf
xor r9d, r9d
mov r8d, dword [rsp + 0x1a0]
mov edx, dword [rsp + 0x198]
movzx ecx, word [rsp + 0x190]
call fcn.140060cb0
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
add rsp, 0x188
ret