Function at 0x140005070
Capabilities:
Copy file
Create process on windows
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x10], rdx
push rbp
lea rbp, [rsp - 0x1ffe0]
mov eax, 0x200e0
call fcn.1400111e0
sub rsp, rax
xor ebx, ebx
lea rcx, [rbp - 0x20]
mov dword [rbp + 0x1fff8], ebx
sub rcx, 2
mov word [rbp - 0x20], bx
nop dword [rax]
cmp word [rcx + 2], bx
lea rcx, [rcx + 2]
jne 0x1400050b0
lea rdi, [0x140045d10]
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rdi + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x1400050d0
lea rcx, [rbp - 0x20]
mov rax, 0xffffffffffffffff
nop dword [rax]
cmp word [rcx + rax*2 + 2], bx
lea rax, [rax + 1]
jne 0x1400050f0
cmp word [rbp + rax*2 - 0x22], 0x5c
je 0x140005122
lea rcx, [rbp - 0x20]
sub rcx, 2
nop dword [rax + rax]
cmp word [rcx + 2], bx
lea rcx, [rcx + 2]
jne 0x140005110
mov eax, dword [0x140019c88]
mov dword [rcx], eax
lea rcx, [rbp - 0x20]
sub rcx, 2
nop word [rax + rax]
cmp word [rcx + 2], bx
lea rcx, [rcx + 2]
jne 0x140005130
movups xmm0, xmmword [str.MSASCuiI.exe]
lea rdx, [rbp - 0x20]
movzx eax, word [0x14001a4b8]
movsd xmm1, qword [0x14001a4b0]
xor r8d, r8d
movups xmmword [rcx], xmm0
movsd qword [rcx + 0x10], xmm1
mov word [rcx + 0x18], ax
lea rcx, [0x140045b00]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
xor edx, edx
lea rcx, [rbp + 0xffe0]
mov r8d, 0x10000
call fcn.140007ee0
lea rcx, [rbp + 0xffe0]
sub rcx, 2
nop
cmp word [rcx + 2], bx
lea rcx, [rcx + 2]
jne 0x140005190
movups xmm0, xmmword [0x14001a308]
mov eax, dword [0x14001a318]
movups xmmword [rcx], xmm0
mov dword [rcx + 0x10], eax
lea rcx, [rbp + 0xffe0]
sub rcx, 2
nop dword [rax + rax]
cmp word [rcx + 2], bx
lea rcx, [rcx + 2]
jne 0x1400051c0
mov eax, dword [0x14001a2dc]
mov dword [rcx], eax
lea rcx, [rbp + 0xffe0]
sub rcx, 2
nop dword [rax]
cmp word [rcx + 2], bx
lea rcx, [rcx + 2]
jne 0x1400051e0
lea r8, [0x1400358e0]
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx eax, word [r8 + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x140005200
lea rcx, [0x1400358b8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor edx, edx
lea rcx, [rsp + 0x74]
lea r8d, [rdx + 0x64]
call fcn.140007ee0
xor eax, eax
mov dword [rsp + 0x70], 0x68
mov qword [rsp + 0x50], rax
lea rdx, [rbp + 0xffe0]
mov qword [rsp + 0x58], rax
lea rcx, [rbp - 0x20]
mov qword [rsp + 0x60], rax
xor r9d, r9d
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x8000040
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x60]
test edi, edi
je 0x140005302
lea rcx, [0x1400358b8]
mov dword [0x1400458ec], edi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x140005302
mov edx, 0xfa0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x1400052f9
lea rdx, [rbp + 0x1fff8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140005320
lea ecx, [rax + 0x64]
call qword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, 0x10
jl 0x140005302
mov eax, dword [0x140035884]
cmp eax, 0x3d
jge 0x140005332
add eax, 0x85
jmp 0x140005335
add eax, 0xfffffffb
lea r11, [rsp + 0x200e0]
mov dword [0x140035884], eax
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x20]
mov eax, dword [rbp + 0x1fff8]
mov rsp, r11
pop rbp
ret