Function at 0x140002770
Capabilities:
Create process on windows
Delete file
Encode data using xor
Get common file path
Read file on windows
Write and execute a file
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x610]
sub rsp, 0x710
mov rax, qword [0x140015008]
xor rax, rsp
mov qword [rbp + 0x600], rax
lea rcx, [rsp + 0x54]
xor ebx, ebx
xor edx, edx
mov r8d, 0xfc
mov dword [rsp + 0x50], ebx
call fcn.140004c50
xor eax, eax
lea rcx, str.Input_password:__n
mov byte [rbp + 0xa0], bl
mov qword [rbp + 0xa1], rax
mov qword [rbp + 0xa9], rax
mov qword [rbp + 0xb1], rax
mov qword [rbp + 0xb9], rax
call fcn.1400033cc
lea rdx, [rbp + 0x200]
lea rcx, [0x14001356c]
mov r8d, 0x3e8
call fcn.140003520
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rbp + 0x200]
repne scasb al, byte [rdi]
not rcx
dec rcx
cmp rcx, 0x204
je 0x14000282b
lea rcx, str.Check_Failed__n
call fcn.1400033cc
jmp 0x140002d8f
mov qword [rsp + 0x720], rsi
mov rdi, rbx
lea rsi, [rsp + 0x28]
nop dword [rax + rax]
xor eax, eax
lea rdx, str._llx
lea rcx, [rbp + 0x50]
mov qword [rbp + 0x51], rax
mov qword [rbp + 0x59], rax
mov word [rbp + 0x61], ax
mov byte [rbp + 0x63], al
mov byte [rbp + 0x80], al
mov qword [rbp + 0x81], rax
mov qword [rbp + 0x89], rax
mov word [rbp + 0x91], ax
mov byte [rbp + 0x93], al
movzx eax, byte [rbp + rdi*4 + 0x200]
mov r8, rsi
mov byte [rbp + 0x54], bl
mov byte [rbp + 0x50], al
movzx eax, byte [rbp + rdi*4 + 0x201]
mov byte [rbp + 0x51], al
movzx eax, byte [rbp + rdi*4 + 0x202]
mov byte [rbp + 0x52], al
movzx eax, byte [rbp + rdi*4 + 0x203]
mov byte [rbp + 0x53], al
call fcn.1400032f4
mov r8, qword [rsi]
lea rdx, str._llx
lea rcx, [rbp + 0x80]
call fcn.14000332c
cmp qword [rsi], 0x100000
jg 0x1400030c5
inc rdi
add rsi, 8
cmp rdi, 4
jl 0x140002840
mov qword [rsp + 0x48], 5
mov r9d, ebx
lea r8, [rbp + 0x308]
lea r10, [0x140000000]
movzx ecx, byte [r8 + 1]
lea eax, [rcx - 0x30]
cmp al, 9
ja 0x140002916
movsx ecx, cl
sub ecx, 0x30
jmp 0x140002928
lea eax, [rcx - 0x41]
cmp al, 5
ja 0x140002925
movsx ecx, cl
sub ecx, 0x37
jmp 0x140002928
or ecx, 0xffffffff
movzx edx, byte [r8]
lea eax, [rdx - 0x30]
cmp al, 9
ja 0x14000293b
movsx edi, dl
sub edi, 0x30
jmp 0x14000294c
lea eax, [rdx - 0x41]
cmp al, 5
ja 0x1400030c5
movsx edi, dl
sub edi, 0x37
cmp edi, 0xffffffff
je 0x1400030c5
cmp ecx, 0xffffffff
je 0x1400030c5
mov eax, r9d
shl dil, 4
add r9d, 2
add dil, cl
cdq
sub r8, 2
sub eax, edx
sar eax, 1
movsxd rcx, eax
mov byte [rcx + r10 + 0x36520], dil
cmp r9d, 0xfa
jl 0x140002902
mov r9d, ebx
lea r8, [rbp + 0x402]
nop word [rax + rax]
movzx ecx, byte [r8 + 1]
lea eax, [rcx - 0x30]
cmp al, 9
ja 0x1400029b4
movsx ecx, cl
sub ecx, 0x30
jmp 0x1400029c6
lea eax, [rcx - 0x41]
cmp al, 5
ja 0x1400029c3
movsx ecx, cl
sub ecx, 0x37
jmp 0x1400029c6
or ecx, 0xffffffff
movzx edx, byte [r8]
lea eax, [rdx - 0x30]
cmp al, 9
ja 0x1400029d9
movsx edi, dl
sub edi, 0x30
jmp 0x1400029ea
lea eax, [rdx - 0x41]
cmp al, 5
ja 0x1400030c5
movsx edi, dl
sub edi, 0x37
cmp edi, 0xffffffff
je 0x1400030c5
cmp ecx, 0xffffffff
je 0x1400030c5
mov eax, r9d
shl dil, 4
add r9d, 2
add dil, cl
cdq
sub r8, 2
sub eax, edx
sar eax, 1
movsxd rcx, eax
mov byte [rcx + r10 + 0x365a0], dil
cmp r9d, 0xfa
jl 0x1400029a0
mov eax, dword [rsp + 0x28]
lea rdx, [rbp + 0xf0]
mov ecx, 0x104
mov dword [0x14002a3c8], eax
mov eax, dword [rsp + 0x30]
mov qword [rsp + 0x728], r12
mov dword [0x14002a3cc], eax
mov eax, dword [rsp + 0x38]
mov dword [0x14002a3d8], 5
mov dword [0x14002a3d0], eax
mov eax, dword [rsp + 0x40]
mov dword [0x14002a3d4], eax
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
lea r8, [0x140013580]
lea rcx, [rbp + 0xf0]
mov edx, 0x104
call fcn.140003d88
lea rcx, [rbp + 0xf0]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea r8, [rbp + 0x80]
movsxd rsi, dword [rax + 0x3c]
movaps xmm0, xmmword [0x140036520]
movaps xmm1, xmmword [0x140036530]
mov rcx, rax
mov rdi, rax
movups xmmword [0x140023dc8], xmm0
movaps xmm0, xmmword [0x140036540]
movups xmmword [0x140023dd8], xmm1
movaps xmm1, xmmword [0x140036550]
movups xmmword [0x140023de8], xmm0
movaps xmm0, xmmword [0x140036560]
movups xmmword [0x140023df8], xmm1
movaps xmm1, xmmword [0x140036570]
movups xmmword [0x140023e08], xmm0
movaps xmm0, xmmword [0x140036580]
movups xmmword [0x140023e18], xmm1
movaps xmm1, xmmword [0x140036590]
movups xmmword [0x140023e28], xmm0
movaps xmm0, xmmword [0x1400365a0]
movups xmmword [0x140023e38], xmm1
movaps xmm1, xmmword [0x1400365b0]
movups xmmword [0x140023ec8], xmm0
movaps xmm0, xmmword [0x1400365c0]
movups xmmword [0x140023ed8], xmm1
movaps xmm1, xmmword [0x1400365d0]
movups xmmword [0x140023ee8], xmm0
movaps xmm0, xmmword [0x1400365e0]
movups xmmword [0x140023ef8], xmm1
movaps xmm1, xmmword [0x1400365f0]
movups xmmword [0x140023f08], xmm0
movaps xmm0, xmmword [0x140036600]
movups xmmword [0x140023f18], xmm1
movaps xmm1, xmmword [0x140036610]
movups xmmword [0x140023f28], xmm0
movups xmmword [0x140023f38], xmm1
mov edx, dword [rsi + rax + 0x118]
add rcx, 0x1000
call fcn.1400025d0
mov rdx, rbx
lea r12, [0x1400163d0]
movzx eax, byte [rbp + rdx + 0x80]
add rdx, 4
xor byte [rdx + r12 + 0xddf4], al
xor byte [rdx + r12 + 0xde14], al
movzx eax, byte [rbp + rdx + 0x7d]
xor byte [rdx + r12 + 0xddf5], al
xor byte [rdx + r12 + 0xde15], al
movzx eax, byte [rbp + rdx + 0x7e]
xor byte [rdx + r12 + 0xddf6], al
xor byte [rdx + r12 + 0xde16], al
movzx eax, byte [rbp + rdx + 0x7f]
xor byte [rdx + r12 + 0xddf7], al
xor byte [rdx + r12 + 0xde17], al
cmp rdx, 0x20
jl 0x140002bb2
mov ecx, 0x11278
nop
nop
mov edx, 0x3988
nop
nop
lea r8, [rbp + 0x80]
add rcx, rdi
call fcn.1400025d0
mov rdx, rbx
movzx eax, byte [rbp + rdx + 0x80]
add rdx, 4
xor byte [rdx + r12 + 0xdef4], al
xor byte [rdx + r12 + 0xdf14], al
movzx eax, byte [rbp + rdx + 0x7d]
xor byte [rdx + r12 + 0xdef5], al
xor byte [rdx + r12 + 0xdf15], al
movzx eax, byte [rbp + rdx + 0x7e]
xor byte [rdx + r12 + 0xdef6], al
xor byte [rdx + r12 + 0xdf16], al
movzx eax, byte [rbp + rdx + 0x7f]
xor byte [rdx + r12 + 0xdef7], al
xor byte [rdx + r12 + 0xdf17], al
cmp rdx, 0x20
jl 0x140002c33
mov ecx, dword [rsi + rdi + 0x164]
mov edx, dword [rsi + rdi + 0x168]
lea r8, [rbp + 0x80]
add rcx, rdi
call fcn.1400025d0
mov rdx, rbx
movzx eax, byte [rbp + rdx + 0x80]
add rdx, 4
xor byte [rdx + r12 + 0xdff4], al
xor byte [rdx + r12 + 0xe014], al
movzx eax, byte [rbp + rdx + 0x7d]
xor byte [rdx + r12 + 0xdff5], al
xor byte [rdx + r12 + 0xe015], al
movzx eax, byte [rbp + rdx + 0x7e]
xor byte [rdx + r12 + 0xdff6], al
xor byte [rdx + r12 + 0xe016], al
movzx eax, byte [rbp + rdx + 0x7f]
xor byte [rdx + r12 + 0xdff7], al
xor byte [rdx + r12 + 0xe017], al
cmp rdx, 0x20
jl 0x140002cb4
lea rdx, [rbp + 0xf0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
lea r8, str.n1ctf.exe
lea rcx, [rbp + 0xf0]
mov edx, 0x104
call fcn.140003d88
lea rcx, [rbp + 0xf0]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea r8, [0x14001359c]
lea rdx, [rbp + 0xf0]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rbx
call fcn.14000362c
mov r9, qword [rsp + 0x20]
test r9, r9
jne 0x140002db5
lea rcx, [0x1400135a0]
call fcn.1400033cc
mov r12, qword [rsp + 0x728]
mov rsi, qword [rsp + 0x720]
xor eax, eax
mov rcx, qword [rbp + 0x600]
xor rcx, rsp
call fcn.1400030f0
lea r11, [rsp + 0x710]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
mov edx, 1
mov r8d, 0x1f000
mov rcx, r12
call fcn.14000380c
mov rcx, qword [rsp + 0x20]
call fcn.140003918
lea rcx, [rbp + 0xf0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rdx, [rbp + 0xf0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
lea r8, [0x140013580]
lea rcx, [rbp + 0xf0]
mov edx, 0x104
call fcn.140003d88
mov qword [rsp + 0x20], rbx
mov edi, ebx
lea r8, [0x1400135b4]
lea rdx, [rbp + 0xf0]
lea rcx, [rsp + 0x20]
call fcn.14000362c
mov r9, qword [rsp + 0x20]
test r9, r9
jne 0x140002e4f
lea ecx, [r9 + 0x32]
call qword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 0x3c
jl 0x140002e12
mov r9, qword [rsp + 0x20]
test r9, r9
je 0x140002e6e
mov edx, 1
lea rcx, [rbp + 0xa0]
lea r8d, [rdx + 0x1f]
call fcn.140003c60
mov rcx, qword [rsp + 0x20]
call fcn.140003918
lea r8, [rbp + 0x80]
lea rcx, [rbp + 0xa0]
mov edx, 0x20
mov dword [rbp + 0x50], 0x80d1c8d7
mov dword [rbp + 0x54], 0xa02457c
mov dword [rbp + 0x58], 0x71d07ac4
mov dword [rbp + 0x5c], 0x47ea32fd
mov dword [rbp + 0x60], 0xb15c899
mov dword [rbp + 0x64], 0xeabe61f2
mov dword [rbp + 0x68], 0x619da991
mov dword [rbp + 0x6c], 0xe869b7b7
call fcn.1400025d0
lea rdx, [rbp + 0x50]
lea rcx, [rbp + 0x80]
mov r8d, 0x20
call fcn.1400107f0
test eax, eax
jne 0x1400030b9
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rbp + 0x200]
repne scasb al, byte [rdi]
lea r8, [rbp + 0xc8]
not rcx
lea rdx, [rcx - 1]
lea rcx, [rbp + 0x200]
call fcn.1400025d0
xor eax, eax
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0xc8]
mov byte [rbp + 0x50], bl
mov qword [rbp + 0x51], rax
mov qword [rbp + 0x59], rax
mov qword [rbp + 0x61], rax
mov dword [rbp + 0x69], eax
mov word [rbp + 0x6d], ax
mov byte [rbp + 0x6f], al
call section..text
mov rax, qword [rbp + 0xa0]
mov rdi, qword [rbp + 0x50]
mov rsi, qword [rbp + 0x58]
mov qword [rbp + 0x50], rax
mov rax, qword [rbp + 0xa8]
lea r8, [rsp + 0x50]
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 0x50]
mov qword [rbp + 0x80], rdi
mov qword [rbp + 0x58], rax
mov qword [rbp + 0x88], rsi
call fcn.1400015a0
mov rdx, rbx
nop word [rax + rax]
movzx eax, byte [rbp + rdx + 0x80]
add rdx, 4
xor byte [rbp + rdx + 0x6c], al
movzx eax, byte [rbp + rdx + 0x7d]
xor byte [rbp + rdx + 0x6d], al
movzx eax, byte [rbp + rdx + 0x7e]
xor byte [rbp + rdx + 0x6e], al
movzx eax, byte [rbp + rdx + 0x7f]
xor byte [rbp + rdx + 0x6f], al
cmp rdx, 0x10
jb 0x140002f80
mov rax, qword [rbp + 0x70]
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0xd8]
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0x78]
mov qword [rbp + 0xa8], rax
call section..text
mov rax, qword [rbp + 0xb0]
mov qword [rbp + 0x50], rax
mov rax, qword [rbp + 0xb8]
lea r8, [rsp + 0x50]
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 0x50]
mov qword [rbp + 0x80], rdi
mov qword [rbp + 0x58], rax
mov qword [rbp + 0x88], rsi
call fcn.1400015a0
mov rdx, rbx
nop word [rax + rax]
movzx eax, byte [rbp + rdx + 0x80]
add rdx, 4
xor byte [rbp + rdx + 0x6c], al
movzx eax, byte [rbp + rdx + 0x7d]
xor byte [rbp + rdx + 0x6d], al
movzx eax, byte [rbp + rdx + 0x7e]
xor byte [rbp + rdx + 0x6e], al
movzx eax, byte [rbp + rdx + 0x7f]
xor byte [rbp + rdx + 0x6f], al
cmp rdx, 0x10
jb 0x140003020
mov rax, qword [rbp + 0x70]
mov qword [rbp + 0xb0], rax
mov rax, qword [rbp + 0x78]
mov qword [rbp + 0xb8], rax
movzx eax, word [rbp + 0xbe]
nop
sub ax, word [rbp + rbx + 0xa0]
add rbx, 2
mov word [rbp + 0xbe], ax
cmp rbx, 0x1e
jl 0x140003070
test al, al
jne 0x1400030b9
shr ax, 8
test al, al
jne 0x1400030b9
lea rdx, [rbp + 0xa0]
lea rcx, str.Flag_is:__s_n
call fcn.1400033cc
lea rcx, str.pause
call fcn.140003c80
jmp 0x140002d7f
lea rcx, str.Check_Failed__n
jmp 0x140002d7a
lea rcx, str.Check_Failed__n
call fcn.1400033cc
jmp 0x140002d87