Function at 0x140038a08
Capabilities:
Create process on windows
Write and execute a file
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rax - 0xf8]
sub rsp, 0x1d0
mov qword [rbp + 0x50], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
lea rcx, [rbp + 0x30]
call fcn.140040e88
nop
xor esi, esi
cmp qword [rbp + 0x40], rsi
je 0x140038d4a
call fcn.140038d7c
lea edi, [rsi + 0xf]
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x60], rsi
mov byte [rsp + 0x50], sil
or r15, 0xffffffffffffffff
cmp byte [rax], sil
jne 0x140038a67
mov r8d, esi
jmp 0x140038a73
mov r8, r15
inc r8
cmp byte [rax + r8], sil
jne 0x140038a6a
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.14000157c
nop
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0x10
cmovae rcx, qword [rsp + 0x50]
mov r14d, 4
mov r8d, r14d
mov rbx, qword [rsp + 0x60]
cmp rbx, r14
cmovb r8, rbx
test r8, r8
jne 0x140038ab0
mov eax, esi
jmp 0x140038abc
lea rdx, str.NULL
call fcn.140024280
movsxd rcx, eax
mov eax, esi
cmp rbx, r14
setne al
cmp rbx, r14
cmovb eax, r15d
test rcx, rcx
cmovne eax, ecx
test eax, eax
je 0x140038d37
cmp rbx, 0xb
jb 0x140038d37
mov qword [rbp - 0x38], rdi
mov qword [rbp - 0x40], rsi
mov byte [rbp - 0x50], sil
mov r8d, 9
lea rdx, [0x140054660]
lea rcx, [rbp - 0x50]
call fcn.14000157c
nop
mov qword [rbp - 0x58], rdi
mov qword [rbp - 0x60], rsi
mov byte [rbp - 0x70], sil
mov r8d, 0x14
lea rdx, str.GDUSGwwcHRoMagwZCA
lea rcx, [rbp - 0x70]
call fcn.14000157c
nop
lea r8, [rbp - 0x50]
lea rdx, [rbp - 0x70]
lea rcx, [rbp - 0x30]
call fcn.140037a60
nop
cmp qword [rbp - 0x58], 0x10
jb 0x140038b4e
mov rcx, qword [rbp - 0x70]
call fcn.14001ddec
mov qword [rbp - 0x58], rdi
mov qword [rbp - 0x60], rsi
mov byte [rbp - 0x70], sil
cmp qword [rbp - 0x38], 0x10
jb 0x140038b6a
mov rcx, qword [rbp - 0x50]
call fcn.14001ddec
mov qword [rbp - 0x38], rdi
mov qword [rbp - 0x40], rsi
mov byte [rbp - 0x50], sil
lea r8, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae r8, qword [rbp - 0x30]
add r8, qword [rbp - 0x20]
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rdx, qword [rbp - 0x30]
mov r14d, 7
mov qword [rbp + 0x28], r14
mov qword [rbp + 0x20], rsi
mov word [rbp + 0x10], si
lea rcx, [rbp + 0x10]
call fcn.14000fc74
nop
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0x10
cmovae rcx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
add r8, rcx
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0x10
cmovae rdx, qword [rsp + 0x50]
mov qword [rbp + 8], r14
mov qword [rbp], rsi
mov word [rbp - 0x10], si
lea rcx, [rbp - 0x10]
call fcn.14000fc74
nop
lea r8, [rbp + 0x10]
lea rdx, [rbp + 0x30]
lea rcx, [rsp + 0x70]
call fcn.14000fe24
nop
lea rdx, [rbp + 0x100]
lea rcx, [rbp - 0x10]
call fcn.140038684
mov rdi, rax
lea rcx, [rsp + 0x70]
cmp qword [rbp - 0x78], 8
cmovae rcx, qword [rsp + 0x70]
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, r15
je 0x140038cdb
mov qword [rsp + 0x20], rsi
lea r9, [rbp + 0x108]
mov r8d, dword [rbp + 0x100]
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp + 0x60], 0x68
xor edx, edx
lea r8d, [r14 + 0x59]
lea rcx, [rbp + 0x68]
call fcn.140020ea0
lea rdx, [rsp + 0x70]
cmp qword [rbp - 0x78], 8
cmovae rdx, qword [rsp + 0x70]
lea rax, [rbp - 0x70]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x60]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
nop
cmp qword [rbp - 0x78], 8
jb 0x140038cec
mov rcx, qword [rsp + 0x70]
call fcn.14001ddec
mov qword [rbp - 0x78], r14
mov qword [rbp - 0x80], rsi
mov word [rsp + 0x70], si
cmp qword [rbp + 8], 8
jb 0x140038d09
mov rcx, qword [rbp - 0x10]
call fcn.14001ddec
mov qword [rbp + 8], r14
mov qword [rbp], rsi
mov word [rbp - 0x10], si
cmp qword [rbp + 0x28], 8
jb 0x140038d26
mov rcx, qword [rbp + 0x10]
call fcn.14001ddec
nop
cmp qword [rbp - 0x18], 0x10
jb 0x140038d37
mov rcx, qword [rbp - 0x30]
call fcn.14001ddec
nop
cmp qword [rsp + 0x68], 0x10
jb 0x140038d4a
mov rcx, qword [rsp + 0x50]
call fcn.14001ddec
nop
cmp qword [rbp + 0x48], 8
jb 0x140038d5a
mov rcx, qword [rbp + 0x30]
call fcn.14001ddec
xor eax, eax
mov rbx, qword [rsp + 0x210]
add rsp, 0x1d0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret