Function at 0x1400026bc
Capabilities:
Create process on windows
Get common file path
Write and execute a file
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r12
sub rsp, 0x510
mov rax, qword [0x140008020]
xor rax, rsp
mov qword [rsp + 0x500], rax
lea rcx, [rsp + 0x50]
lea rdx, str.:Repeat_r_ndel___s__r_nif_exist___s__goto_Repeat_r_n:Repeat1_r_ndel___s__r_nif_exist___s__goto_Repeat1_r_ndel___s_
mov r8d, 0x67
call sub.MSVCR90.dll_memcpy
and dword [rsp + 0x40], 0
mov edi, 0x104
lea rdx, [rsp + 0x1d0]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
lea r8, str._uninsep.bat
lea rcx, [rsp + 0x1d0]
mov rdx, rdi
call qword [sym.imp.MSVCR90.dll_strcat_s]
lea rdx, [rsp + 0xc0]
mov r8d, edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea r8, [rsp + 0xc0]
lea rcx, [rsp + 0x3f0]
mov rdx, rdi
call qword [sym.imp.MSVCR90.dll_strcpy_s]
xor edx, edx
mov al, byte [rsp + rdx + 0xc0]
inc rdx
mov byte [rsp + rdx + 0x2df], al
test al, al
jne 0x14000275d
mov ebx, 0x5c
lea rcx, [rsp + 0x2e0]
mov edx, ebx
call qword [sym.imp.MSVCR90.dll_strrchr]
test rax, rax
je 0x14000278f
mov byte [rax], 0
xor eax, eax
or r12, 0xffffffffffffffff
lea rdi, [rsp + 0x2e0]
mov rcx, r12
mov edx, ebx
repne scasb al, byte [rdi]
mov rax, qword [str._sc.exe]
lea rcx, [rsp + 0x3f0]
mov qword [rdi - 1], rax
call qword [sym.imp.MSVCR90.dll_strrchr]
test rax, rax
je 0x1400027c5
mov byte [rax], 0
and qword [rsp + 0x30], 0
lea rcx, [rsp + 0x1d0]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, r12
je 0x140002906
xor eax, eax
lea rdi, [rsp + 0xc0]
mov rcx, r12
repne scasb al, byte [rdi]
lea rdi, [rsp + 0x1d0]
not rcx
lea edx, [rcx + rcx*2 - 3]
mov rcx, r12
repne scasb al, byte [rdi]
lea rdi, [rsp + 0x50]
not rcx
dec rcx
add edx, ecx
mov rcx, r12
repne scasb al, byte [rdi]
not rcx
lea eax, [rdx + rcx + 0x31]
movsxd rdi, eax
mov rcx, rdi
call sub.MSVCR90.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__
mov r8, rdi
xor edx, edx
mov rcx, rax
mov rsi, rax
call sub.MSVCR90.dll_memset
lea r11, [rsp + 0x1d0]
lea rax, [rsp + 0x2e0]
mov qword [rsp + 0x38], r11
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x2e0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xc0]
lea r9, [rsp + 0xc0]
lea r8, [rsp + 0x50]
mov rdx, rdi
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCR90.dll_sprintf_s]
xor eax, eax
and qword [rsp + 0x20], rax
mov rcx, r12
mov rdi, rsi
repne scasb al, byte [rdi]
lea r9, [rsp + 0x40]
mov rdx, rsi
not rcx
lea r8, [rcx - 1]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
lea r8, [rsp + 0x1d0]
lea rdx, [0x140005814]
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
test rsi, rsi
je 0x140002906
mov rcx, rsi
call sub.MSVCR90.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x500]
xor rcx, rsp
call fcn.140003e30
lea r11, [rsp + 0x510]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop r12
ret