Function at 0x140399bd0
Capabilities:
Create process on windows
Delete file
Get common file path
Query environment variable
Self delete

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x210
movaps xmmword [rsp + 0x200], xmm6
mov rsi, rdx
mov rax, qword [0x14056a550]
xor rax, rsp
mov qword [rsp + 0x1f8], rax
mov byte [rsp + 0x5f], 0xa
mov rcx, qword [rcx]
test rcx, rcx
je 0x140399c89
mov edx, dword [rsi + 0x290]
mov eax, edx
and eax, 0xffc7ffff
mov dword [rsi + 0x290], eax
lea r8, [rcx - 1]
cmp r8, 5
ja case.default.0x140399c3a
lea r9, [0x14039a540]
movsxd r8, dword [r9 + r8*4]
add r8, r9
jmp r8
mov edi, 0x2e
test edx, 0x40000
jne 0x14039a365
mov edi, 0x2e
test byte [rsi + 0x297], 0x10
jne 0x14039a365
mov edx, eax
or edx, 0x80000
mov dword [rsi + 0x290], edx
cmp rcx, 6
je 0x140399cf9
cmp rcx, 5
jne 0x140399d04
or eax, 0x180000
jmp 0x140399cfe
cmp dword [0x1407108a8], 0
je 0x140399d04
test byte [rsi + 0x298], 0x80
je 0x140399d04
cmp dword [0x1406f9f24], 0
jne 0x140399d04
or byte [rsi + 0x292], 8
jmp 0x140399d04
mov edi, 0x30
jmp 0x14039a365
mov edi, 0x2e
test edx, 0x40000
je 0x140399d04
jmp 0x14039a365
mov edi, 0x2e
test edx, 0x40000
jne 0x14039a365
or eax, 0x100000
jmp 0x140399cfe
mov edi, 0x2e
test edx, 0x40000
jne 0x14039a365
or eax, 0x200000
jmp 0x140399cfe
or eax, 0x280000
mov dword [rsi + 0x290], eax
and byte [rsi + 0x296], 0xfd
xor edi, edi
test byte [rsi + 0x299], 0x10
je 0x140399d27
mov rcx, rsi
call fcn.140005731
mov edi, eax
and byte [rsi + 0x299], 0xef
cmp byte [rsi + 0x27e], 1
jne 0x140399d8b
mov rax, qword [rsi + 0x108]
test rax, rax
je 0x140399d8b
cmp byte [rax + 0x30], 0
jne 0x140399d48
cmp byte [rax + 0x31], 0
je 0x140399d8b
mov rcx, qword [rax + 0x20]
test rcx, rcx
cmove rcx, rsi
lea rdx, [rsp + 0x5f]
mov r8d, 1
call fcn.1400053c6
cmp eax, 0xffffffff
jne 0x140399d79
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi + 0x1a8], eax
mov edi, 0x1c
mov rax, qword [rsi + 0x108]
test rax, rax
je 0x140399d8b
mov word [rax + 0x30], 0
test byte [rsi + 0x292], 0x40
je 0x140399db3
mov rax, qword [rsi + 0x108]
test rax, rax
je 0x140399da6
mov word [rax + 0x32], 0
mov rcx, rsi
call fcn.140003530
test eax, eax
cmovne edi, eax
cmp dword [0x1407108a8], 0
je 0x140399dca
mov eax, dword [rsi + 0x298]
test al, al
js 0x140399e91
mov rbx, qword [rsi + 0x1a0]
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp rbx, rax
je 0x140399e36
mov rbx, qword [rsi + 0x1a0]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp rbx, rax
je 0x140399e36
mov rbx, qword [rsi + 0x1a0]
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp rbx, rax
je 0x140399e36
mov rcx, rsi
xor edx, edx
xor r8d, r8d
call fcn.1400053c6
mov rcx, qword [rsi + 0x1a0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x140399fa0
jmp 0x140399f8f
cmp qword [rsi + 0x140], 0
je 0x140399e57
mov rbx, qword [rsi + 0x1a0]
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp rbx, rax
je 0x140399ed4
mov rbx, qword [rsi + 0x1a0]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp rbx, rax
jne 0x140399fa0
test byte [rsi + 0x299], 0x40
je 0x140399fa0
mov rcx, rsi
xor edx, edx
xor r8d, r8d
call fcn.1400053c6
jmp 0x140399fa0
cmp dword [0x1406f9f24], 0
jne 0x140399fa0
cmp qword [rsi + 0x248], 2
ja 0x140399f5d
test eax, 0x200
jne 0x140399fa0
xor ebx, ebx
test dword [rsi + 0x290], 0x80000
sete bl
call fcn.140003c1a
mov ecx, eax
mov edx, ebx
jmp 0x140399f72
mov rdx, qword [rsi + 0x140]
movzx eax, byte [rsi + 0x27c]
cmp eax, 5
je 0x140399f0a
mov rcx, qword [rsi + 0xa8]
test rcx, rcx
je 0x14039a3e7
mov rdx, qword [rsi + 0xb0]
sub rdx, rcx
xor eax, eax
test rdx, rdx
cmovle rdx, rax
test rdx, rdx
je 0x140399fa0
neg rdx
mov rcx, qword [rsi + 0x1a0]
mov qword [rsp + 0xf0], rdx
lea r8, [rsp + 0xf4]
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0xf0], eax
cmp eax, 0xffffffff
je 0x140399f85
cmp qword [rsp + 0xf0], 0xffffffffffffffff
je 0x140399f8f
mov qword [rsi + 0x140], 0
jmp 0x140399fa0
xor edx, edx
test dword [rsi + 0x290], 0x80000
sete dl
mov ecx, dword [rsi + 0x1a0]
call fcn.1400054a7
cmp eax, 0xffffffff
jne 0x140399fa0
and byte [rsi + 0x292], 0xf7
jmp 0x140399fa0
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x140399f45
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi + 0x1a8], eax
mov edi, 0x1c
cmp dword [0x1407108a8], 0
je 0x140399fb6
test byte [rsi + 0x298], 0x80
jne 0x14039a20a
movsx r14, word [rsi + 0x278]
lea rbx, [r14 + r14*2]
add rbx, 0x28
xor r15d, r15d
lea r8, [rsp + 0xe8]
mov rcx, rbx
xor edx, edx
call fcn.140003765
test eax, eax
jne 0x14039a205
mov rcx, qword [rsp + 0xe8]
xor edx, edx
mov r8, rbx
call fcn.1400020b8
xorps xmm0, xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0xb0], xmm0
movaps xmmword [rsp + 0xc0], xmm0
movaps xmmword [rsp + 0xd0], xmm0
mov qword [rsp + 0xe0], 0
mov dword [rsp + 0x80], 0x68
mov eax, dword [rsi + 0x290]
test eax, 0x200000
je 0x14039a123
mov r9, qword [rsi + 0xd0]
mov rcx, qword [rsp + 0xe8]
test eax, 0x80000
jne 0x14039a073
mov rdx, rbx
mov r8, r9
call fcn.140003f71
jmp 0x14039a08e
mov qword [rsp + 0x20], r9
lea r8, str._s__DEL__s
mov rdx, rbx
call fcn.140003f71
and byte [rsi + 0x292], 0xf7
mov rdx, qword [rsp + 0xe8]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 0x4000000
mov dword [rsp + 0x20], 1
xor r15d, r15d
xor ecx, ecx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x14039a0ec
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi + 0x1a8], eax
mov r15d, 0x1c
mov rcx, qword [rsp + 0x70]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
jne 0x14039a112
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi + 0x1a8], eax
mov r15d, 0x1c
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsi + 0x290]
test eax, 0x100000
jne 0x14039a174
and eax, 0xc0000
cmp eax, 0x80000
jne 0x14039a159
mov rcx, qword [rsi + 0xd0]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x14039a159
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi + 0x1a8], eax
mov r15d, 0x1c
mov rcx, qword [rsp + 0xe8]
call fcn.140001b0e
test eax, eax
cmovne r15d, eax
mov eax, r15d
jmp 0x14039a205
lea r12, [r14 + r14*2]
lea rcx, str.FOR_DEFAULT_PRINT_DEVICE
lea r14, [rsp + 0xf0]
mov rdx, r14
mov r8d, 0x105
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
dec eax
cmp eax, 0x104
jae 0x14039a1b4
cmp byte [rsp + 0xf0], 0
lea rax, str.PRN_FILE
cmove r14, rax
jmp 0x14039a1c3
mov byte [rsp + 0xf0], 0
lea r14, str.PRN_FILE
mov r9, qword [rsi + 0xd0]
mov rcx, qword [rsp + 0xe8]
mov qword [rsp + 0x20], r14
lea r8, str.Cmd.exe__C_COPY___s___s
mov rdx, rbx
call fcn.140003f71
lea ebx, [r12 + 0x12e]
movsxd rcx, ebx
lea r8, [rsp + 0x60]
xor edx, edx
call fcn.140003765
test eax, eax
je 0x14039a391
test eax, eax
cmovne edi, eax
cmp word [rsi + 0x278], 0
jle 0x14039a23d
mov rcx, qword [rsi + 0xd0]
call fcn.140001b0e
mov ebx, eax
test eax, eax
jne 0x14039a23f
lea rax, str._Unknown_
mov qword [rsi + 0xd0], rax
mov word [rsi + 0x278], 0
mov ebx, edi
mov rcx, qword [rsi + 0x78]
call fcn.140001b0e
mov edi, eax
test eax, eax
je 0x14039a25c
test byte [rsi + 0x292], 0x40
jne 0x14039a26f
jmp 0x14039a2e5
mov qword [rsi + 0x78], 0
mov edi, ebx
test byte [rsi + 0x292], 0x40
je 0x14039a2e5
mov rbx, qword [rsi + 0xc0]
test rbx, rbx
je 0x14039a2e5
mov eax, dword [rbx + 0xb4]
test eax, 0x2000000
je 0x14039a2a4
and eax, 0xfdffffff
mov dword [rbx + 0xb4], eax
mov rcx, qword [rbx + 8]
call fcn.140001b0e
mov qword [rbx + 8], 0
cmp word [rsi + 0x27a], 0
jne 0x14039a2bf
mov rcx, qword [rsi + 0xc0]
call fcn.140001b0e
test eax, eax
cmovne edi, eax
mov rax, qword [rsi + 0xc8]
cmp rax, qword [rsi + 0xc0]
jne 0x14039a2da
mov qword [rsi + 0xc8], 0
mov qword [rsi + 0xc0], 0
test byte [rsi + 0x295], 0x80
jne 0x14039a33b
lea rcx, [rsi + 0x30]
movups xmm6, xmmword [rsi + 0x58]
mov ebx, 0x200
mov ebp, dword [rsi + 0x48]
mov r14, qword [rsi + 0x130]
and ebx, dword [rsi + 0x29c]
test byte [rsi + 0x291], 0x18
je 0x14039a344
mov r15d, dword [rsi + 0x1e0]
mov r8d, 0x278
xor edx, edx
call fcn.1400020b8
mov dword [rsi + 0x290], 0x800
mov dword [rsi + 0x1e0], r15d
jmp 0x14039a351
and byte [rsi + 0x291], 0xdf
jmp 0x14039a365
mov r8d, 0x278
xor edx, edx
call fcn.1400020b8
movups xmmword [rsi + 0x58], xmm6
mov dword [rsi + 0x29c], ebx
mov dword [rsi + 0x48], ebp
mov qword [rsi + 0x130], r14
mov rcx, qword [rsp + 0x1f8]
xor rcx, rsp
call fcn.140003706
mov eax, edi
movaps xmm6, xmmword [rsp + 0x200]
add rsp, 0x210
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rcx, qword [rsp + 0x60]
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x14039a415
lea eax, [r12 + 0x12d]
movsxd rdx, eax
mov rcx, qword [rsp + 0x60]
lea r8, [0x14052d7a6]
mov r9, rdx
call fcn.140004da9
lea eax, [r12 + 0x29]
movsxd r9, eax
mov r8, qword [rsp + 0xe8]
add r12d, 0x12a
movsxd rdx, r12d
mov rcx, qword [rsp + 0x60]
call fcn.140004da9
jmp 0x14039a429
mov rcx, qword [rsi + 0x90]
test rcx, rcx
je 0x140399f01
mov rdx, qword [rsi + 0xb0]
sub rdx, rcx
lea ecx, [rax - 6]
cmp ecx, 2
jae 0x14039a52d
dec rdx
jmp 0x140399f01
mov ecx, 0x313
xor edx, edx
call fcn.140004539
mov rax, qword [rsp + 0x60]
mov byte [rax], 0
mov rdx, qword [rsp + 0x60]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 0x4000000
mov dword [rsp + 0x20], 1
xor ecx, ecx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x14039a510
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x14039a494
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi + 0x1a8], eax
mov r15d, 0x1c
mov rcx, qword [rsp + 0x68]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
jne 0x14039a4bb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi + 0x1a8], eax
mov r15d, 0x1c
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x14039a4dc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi + 0x1a8], eax
mov r15d, 0x1c
mov eax, dword [rsi + 0x290]
test eax, 0x80000
je 0x14039a12a
cmp dword [rsi + 0x1a8], 0
je 0x14039a12a
and eax, 0xfff7ffff
mov dword [rsi + 0x290], eax
mov r15d, 5
jmp 0x14039a12a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi + 0x1a8], eax
mov eax, dword [rsi + 0x290]
mov r15d, 0x1c
jmp 0x14039a12a
cmp eax, 8
jne 0x140399f01
add rdx, 0xfffffffffffffffe
jmp 0x140399f01