Function at 0x140007668
Capabilities:
Create process on windows
Create process suspended
Write and execute a file
Write file on windows

Disassembly:
jmp 0x140007668
push rbp
sub rsp, 0x5b0
lea rbp, [rsp + 0x50]
mov qword [rsp], rax
mov rax, 0x5ac
mov dword [rsp + rax], 0xcccccccc
sub rax, 4
cmp rax, 4
jg 0x140007680
mov rax, qword [rsp]
mov dword [rsp], 0xcccccccc
mov dword [rsp + 4], 0xcccccccc
mov qword [rbp + 0x128], rdi
mov qword [rbp + 0x120], rsi
mov qword [rbp + 0x118], rbx
mov qword [rbp + 0x570], rcx
mov dword [rbp + 0x578], edx
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x558], rax
mov byte [rbp + 0x99], 0
mov byte [rbp + 0x9a], 0
mov byte [rbp + 0x98], 0
lea rax, section..data1
mov edx, 0x40000000
mov ecx, 1
mov ebx, 0
mov dword [rsp + 0x20], 4
mov dword [rsp + 0x28], 2
mov qword [rsp + 0x30], 0
mov rsi, qword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [rbp + 0xf0], ecx
mov rcx, rax
mov eax, dword [rbp + 0xf0]
mov r8d, eax
mov r9, rbx
call rsi
mov qword [rbp + 0xc8], rax
mov byte [rbp + 0x98], 1
mov rax, qword [rbp + 0xc8]
mov qword [rbp + 0xd0], rax
mov rax, qword [rbp + 0xd0]
cmp rax, 0xffffffffffffffff
jne 0x1400077e6
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov dword [rbp + 0x9c], eax
mov byte [rbp + 0x99], 1
mov eax, dword [rbp + 0x9c]
mov dword [rbp + 0xa4], eax
mov eax, 0
mov dword [rbp + 0xbc], eax
lea rax, [0x1400eb040]
mov rdx, rax
mov rcx, rbp
call fcn.140003657
mov rax, qword [rbp + 0x558]
mov qword [rbp + 0x558], 0
xor rax, rbp
mov rcx, rax
call fcn.140002694
mov eax, dword [rbp + 0xbc]
mov rbx, qword [rbp + 0x118]
mov rsi, qword [rbp + 0x120]
mov rdi, qword [rbp + 0x128]
lea rsp, [rbp + 0x560]
pop rbp
ret
mov rax, qword [rbp + 0xd0]
mov rdx, qword [rbp + 0x570]
mov ecx, dword [rbp + 0x578]
mov ebx, 0
mov qword [rsp + 0x20], 0
mov rsi, qword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [rbp + 0xf8], ecx
mov rcx, rax
mov eax, dword [rbp + 0xf8]
mov r8d, eax
mov r9, rbx
call rsi
mov dword [rbp + 0xa0], eax
mov byte [rbp + 0x9a], 1
mov eax, dword [rbp + 0xa0]
mov dword [rbp + 0xa8], eax
mov rax, qword [rbp + 0xd0]
mov rdx, qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rcx, rax
call rdx
mov dword [rbp + 0xac], eax
lea rax, [rbp + 8]
mov edx, 0
mov ecx, 0x68
mov qword [rbp + 0x100], rcx
mov rcx, rax
mov rax, qword [rbp + 0x100]
mov r8, rax
call fcn.1400032a1
mov qword [rbp + 0xd8], rax
mov dword [rbp + 8], 0x68
mov dword [rbp + 0x44], 1
mov word [rbp + 0x48], 0
lea rax, [rbp + 0x138]
lea rdx, str.cmd__c
mov ecx, 0x208
mov rdi, rax
mov rsi, rdx
mov eax, ecx
shr rcx, 2
rep movsd dword [rdi], dword [rsi]
mov ecx, eax
and ecx, 3
rep movsb byte [rdi], byte [rsi]
mov eax, 0x64
lea rdx, [rbp + 0x348]
mov rcx, qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov qword [rbp + 0x108], rcx
mov ecx, eax
mov rax, qword [rbp + 0x108]
call rax
mov dword [rbp + 0xb0], eax
lea rax, [rbp + 0x138]
lea rdx, [rbp + 0x348]
mov rcx, rax
call fcn.1400020ea
mov qword [rbp + 0xe0], rax
lea rax, [rbp + 0x138]
lea rdx, [0x140130018]
mov rcx, rax
call fcn.1400020ea
mov qword [rbp + 0xe8], rax
mov eax, 0
lea rdx, [rbp + 0x138]
mov ecx, 0
mov ebx, 0
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
lea rsi, [rbp + 8]
mov qword [rsp + 0x40], rsi
lea rsi, [rbp + 0x78]
mov qword [rsp + 0x48], rsi
mov rsi, qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov qword [rbp + 0x110], rcx
mov rcx, rax
mov rax, qword [rbp + 0x110]
mov r8, rax
mov r9, rbx
call rsi
mov dword [rbp + 0xb4], eax
mov rax, qword [rbp + 0xd0]
mov rdx, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rax
call rdx
mov dword [rbp + 0xb8], eax
mov eax, 1
mov dword [rbp + 0xc0], eax
lea rax, [0x1400eb040]
mov rdx, rax
mov rcx, rbp
call fcn.140003657
mov rax, qword [rbp + 0x558]
mov qword [rbp + 0x558], 0
xor rax, rbp
mov rcx, rax
call fcn.140002694
mov eax, dword [rbp + 0xc0]
mov rbx, qword [rbp + 0x118]
mov rsi, qword [rbp + 0x120]
mov rdi, qword [rbp + 0x128]
lea rsp, [rbp + 0x560]
pop rbp
ret