Function at 0x14001b2c0
Capabilities:
Create process on windows
Write and execute a file
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
lea rbp, [rax - 0x138]
sub rsp, 0x210
mov qword [rbp + 0x90], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
lea rcx, [rbp + 0x68]
call fcn.14001b260
nop
xor esi, esi
cmp qword [rbp + 0x78], rsi
je 0x14001b60b
call fcn.14001b1b0
mov rdx, rax
lea r12d, [rsi + 0xf]
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x60], rsi
mov byte [rsp + 0x50], sil
xor eax, eax
or r13, 0xffffffffffffffff
mov rcx, r13
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x50]
call fcn.1400015dc
nop
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0x10
cmovae rcx, qword [rsp + 0x50]
lea ebx, [rsi + 4]
mov r8d, ebx
mov rdi, qword [rsp + 0x60]
cmp rdi, rbx
cmovb r8, rdi
lea rdx, str.NULL
call fcn.14000d880
movsxd rcx, eax
mov eax, esi
cmp rdi, rbx
setne al
cmp rdi, rbx
cmovb eax, r13d
test rcx, rcx
cmovne eax, ecx
test eax, eax
sete al
test al, al
sete al
test al, al
je 0x14001b5f8
test rdi, rdi
je 0x14001b5f8
cmp rdi, 0xa
jbe 0x14001b5f8
mov qword [rbp - 0x20], r12
mov qword [rbp - 0x28], rsi
mov byte [rbp - 0x38], sil
lea r8d, [rsi + 9]
lea rdx, [0x140029f88]
lea rcx, [rbp - 0x38]
call fcn.1400015dc
nop
mov qword [rbp - 0x48], r12
mov qword [rbp - 0x50], rsi
mov byte [rbp - 0x60], sil
lea r8d, [rsi + 0x14]
lea rdx, str.GDUSGwwcHRoMagwZCA
lea rcx, [rbp - 0x60]
call fcn.1400015dc
nop
lea r8, [rbp - 0x38]
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x10]
call fcn.14001d160
nop
cmp qword [rbp - 0x48], 0x10
jb 0x14001b408
mov rcx, qword [rbp - 0x60]
call fcn.14000b430
mov qword [rbp - 0x48], r12
mov qword [rbp - 0x50], rsi
mov byte [rbp - 0x60], sil
cmp qword [rbp - 0x20], 0x10
jb 0x14001b424
mov rcx, qword [rbp - 0x38]
call fcn.14000b430
mov qword [rbp - 0x20], r12
mov qword [rbp - 0x28], rsi
mov byte [rbp - 0x38], sil
lea r8, [rbp - 0x10]
cmp qword [rbp + 8], 0x10
cmovae r8, qword [rbp - 0x10]
add r8, qword [rbp]
lea rdx, [rbp - 0x10]
cmp qword [rbp + 8], 0x10
cmovae rdx, qword [rbp - 0x10]
mov r12d, 7
mov qword [rbp + 0x58], r12
mov qword [rbp + 0x50], rsi
mov word [rbp + 0x40], si
lea rcx, [rbp + 0x40]
call fcn.140009ee8
nop
lea r8, [rsp + 0x50]
cmp qword [rsp + 0x68], 0x10
cmovae r8, qword [rsp + 0x50]
add r8, qword [rsp + 0x60]
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0x10
cmovae rdx, qword [rsp + 0x50]
mov qword [rbp + 0x30], r12
mov qword [rbp + 0x28], rsi
mov word [rbp + 0x18], si
lea rcx, [rbp + 0x18]
call fcn.140009ee8
nop
lea r8, [rbp + 0x40]
lea rdx, [rbp + 0x68]
lea rcx, [rsp + 0x78]
call fcn.140009e28
nop
lea rdx, [rbp + 0x140]
lea rcx, [rbp + 0x18]
call fcn.14001ae20
mov rbx, rax
lea rcx, [rsp + 0x78]
cmp qword [rbp - 0x70], 8
cmovae rcx, qword [rsp + 0x78]
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, r13
je 0x14001b59c
mov qword [rsp + 0x20], rsi
lea r9, [rbp + 0x148]
mov r8d, dword [rbp + 0x140]
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp + 0xa0], 0x68
xor edx, edx
lea r8d, [r12 + 0x59]
lea rcx, [rbp + 0xa8]
call fcn.140013ff0
lea rdx, [rsp + 0x78]
cmp qword [rbp - 0x70], 8
cmovae rdx, qword [rsp + 0x78]
lea rax, [rbp - 0x60]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0xa0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
nop
cmp qword [rbp - 0x70], 8
jb 0x14001b5ad
mov rcx, qword [rsp + 0x78]
call fcn.14000b430
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x78], rsi
mov word [rsp + 0x78], si
cmp qword [rbp + 0x30], 8
jb 0x14001b5ca
mov rcx, qword [rbp + 0x18]
call fcn.14000b430
mov qword [rbp + 0x30], r12
mov qword [rbp + 0x28], rsi
mov word [rbp + 0x18], si
cmp qword [rbp + 0x58], 8
jb 0x14001b5e7
mov rcx, qword [rbp + 0x40]
call fcn.14000b430
nop
cmp qword [rbp + 8], 0x10
jb 0x14001b5f8
mov rcx, qword [rbp - 0x10]
call fcn.14000b430
nop
cmp qword [rsp + 0x68], 0x10
jb 0x14001b60b
mov rcx, qword [rsp + 0x50]
call fcn.14000b430
nop
cmp qword [rbp + 0x80], 8
jb 0x14001b61e
mov rcx, qword [rbp + 0x68]
call fcn.14000b430
xor eax, eax
mov rbx, qword [rsp + 0x250]
add rsp, 0x210
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret