Function at 0x14001147e
Capabilities:
Delete file
Query environment variable
Read file on windows
Write file on windows

Disassembly:
jmp 0x140017fd0
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x2d8
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x76
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x2f8]
mov rax, qword [0x140027018]
xor rax, rbp
mov qword [rbp + 0x288], rax
lea rcx, [0x14002d0d6]
call fcn.14001169f
mov qword [rbp + 8], 0
mov ecx, 0x5f5e100
call qword [sym.imp.ucrtbased.dll_malloc]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
je 0x140018296
mov r8d, 0x5f5e100
xor edx, edx
mov rcx, qword [rbp + 8]
call fcn.140011505
mov rcx, qword [rbp + 8]
call qword [sym.imp.ucrtbased.dll_free]
mov dword [rbp + 0x24], 0
mov dword [rbp + 0x44], 0
mov dword [rbp + 0x44], 0
jmp 0x140018078
mov eax, dword [rbp + 0x44]
inc eax
mov dword [rbp + 0x44], eax
cmp dword [rbp + 0x44], 0x5f5e100
jge 0x14001808b
mov eax, dword [rbp + 0x24]
inc eax
mov dword [rbp + 0x24], eax
jmp 0x140018070
cmp dword [rbp + 0x24], 0x5f5e100
jne 0x140018296
mov r8d, 4
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jne 0x140018296
lea rax, str.1234
mov qword [rbp + 0xe8], rax
lea rax, [rbp + 0x104]
mov rdi, rax
xor eax, eax
mov ecx, 5
rep stosb byte [rdi], al
lea rcx, str.APPDATA
call qword [sym.imp.ucrtbased.dll_getenv]
mov qword [rbp + 0x128], rax
lea rdx, str._tmp.file
lea rcx, [rbp + 0x248]
call fcn.1400112df
mov qword [rbp + 0x278], rax
mov rax, qword [rbp + 0x278]
mov qword [rbp + 0x280], rax
mov r8, qword [rbp + 0x280]
mov rdx, qword [rbp + 0x128]
lea rcx, [rbp + 0x148]
call fcn.1400116cc
nop
lea rcx, [rbp + 0x248]
call fcn.14001113b
lea rcx, [rbp + 0x148]
call fcn.140011217
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbp + 0xa8], rax
mov rcx, qword [rbp + 0xe8]
call fcn.1400112d5
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0xc4]
mov r8d, eax
mov rdx, qword [rbp + 0xe8]
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140018274
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x148]
call fcn.140011217
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbp + 0xa8], rax
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0xc4]
mov r8d, 4
lea rdx, [rbp + 0x104]
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140018267
mov r8d, 4
lea rdx, [rbp + 0x104]
mov rcx, qword [rbp + 0xe8]
call qword [sym.imp.ucrtbased.dll_strncmp]
test eax, eax
jne 0x140018267
lea rcx, str.hello
call fcn.140011311
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x148]
call fcn.140011217
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
lea rcx, [rbp + 0x148]
call fcn.14001113b
xor eax, eax
mov edi, eax
lea rcx, [rbp - 0x40]
lea rdx, [0x140022900]
call fcn.14001158c
mov eax, edi
mov rcx, qword [rbp + 0x288]
xor rcx, rbp
call fcn.14001132f
lea rsp, [rbp + 0x298]
pop rdi
pop rbp
ret