Function at 0x14001103c
Capabilities:
Create directory
Create thread
Write file on windows

Disassembly:
jmp 0x140015be0
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rdi
mov eax, 0x1df8
call fcn.1400110f5
sub rsp, rax
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x5ee
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x1e18]
mov rax, qword [0x140023050]
xor rax, rbp
mov qword [rbp + 0x1da0], rax
lea rcx, [0x14002a1f2]
call fcn.14001158c
call fcn.1400112bc
lea rcx, str.C:Config.msi
call fcn.140011028
mov r9d, 3
mov r8d, 3
mov edx, 0x80010000
mov rcx, rax
call fcn.140011249
mov qword [0x1400234a8], rax
cmp qword [0x1400234a8], 0
jne 0x140015cda
lea rcx, str.____Failed_to_create_C:Config.msi_directory._Trying_to_delete_it._n
call fcn.140011271
xor ecx, ecx
call fcn.140011505
lea rcx, str.C:Config.msi
call fcn.140011028
mov r9d, 3
mov r8d, 3
mov edx, 0x80010000
mov rcx, rax
call fcn.140011249
mov qword [0x1400234a8], rax
cmp qword [0x1400234a8], 0
je 0x140015cc4
lea rcx, str.___Successfully_removed_and_recreated_C:Config.Msi._n
call fcn.140011271
jmp 0x140015cda
lea rcx, str.____Failed._Cannot_remove_c:Config.msi
call fcn.140011271
mov eax, 1
jmp 0x140016194
lea rcx, str.C:Config.Msi
call qword [sym.imp.SHLWAPI.dll_PathIsDirectoryEmptyW]
test eax, eax
jne 0x140015d01
lea rcx, str.____Failed.__C:Config.Msi_already_exists_and_is_not_empty._n
call fcn.140011271
mov eax, 1
jmp 0x140016194
lea rcx, str.___Config.msi_directory_created__n
call fcn.140011271
mov ecx, 0x104
call qword [sym.imp.ucrtbased.dll_malloc]
mov qword [0x1400234b8], rax
mov r8d, 0x104
xor edx, edx
mov rcx, qword [0x1400234b8]
call fcn.140011447
mov rcx, qword [0x1400234b8]
call fcn.140011230
mov rdx, qword [0x1400234b8]
lea rcx, str.___Directory:__ls_n
call fcn.140011271
xor edx, edx
mov rcx, qword [0x1400234b8]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140015d82
mov rdx, qword [0x1400234b8]
lea rcx, str.____Cannot_create__ls_directory__n
call fcn.140011271
mov eax, 1
jmp 0x140016194
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x6200000
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 7
mov edx, 0xc0010000
mov rcx, qword [0x1400234b8]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x1400234a0], rax
cmp qword [0x1400234a0], 0xffffffffffffffff
jne 0x140015dd1
mov eax, 1
jmp 0x140016194
lea rax, [rbp + 0x10]
mov rdi, rax
xor eax, eax
mov ecx, 0x410
rep stosb byte [rdi], al
mov r9d, 4
mov r8d, 0x208
lea rdx, [rbp + 0x10]
mov rcx, qword [0x1400234a0]
call qword [sym.imp.KERNEL32.dll_GetFinalPathNameByHandleW]
lea r8, [rbp + 0x10]
lea rdx, str.127.0.0.1c__ls
lea rcx, [0x1400234c0]
call fcn.14001116d
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, qword [0x1400234a0]
lea r8, [0x14001115e]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x1400114f1]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0x80
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edx, 1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetThreadPriorityBoost]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edx, 0xf
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
lea rdx, [0x1400113de]
mov rcx, qword [0x1400234a8]
call fcn.14001151e
mov qword [rbp + 0x438], rax
cmp qword [rbp + 0x438], 0
je 0x140015f36
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x1400110aa]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x438]
call fcn.1400111c2
mov rax, qword [rbp + 0x438]
mov qword [rbp + 0x1d88], rax
cmp qword [rbp + 0x1d88], 0
je 0x140015f2b
mov edx, 1
mov rcx, qword [rbp + 0x1d88]
call fcn.1400113d4
mov qword [rbp + 0x1d98], rax
jmp 0x140015f36
mov qword [rbp + 0x1d98], 0
lea rcx, str.C:Config.msi
call fcn.140011028
mov r9d, 3
mov r8d, 7
mov edx, 0x80070000
mov rcx, rax
call fcn.140011249
mov qword [0x1400234a8], rax
cmp qword [0x1400234a8], 0
je 0x140015f36
mov dword [rbp + 0x1474], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
lea rax, [rbp + 0x1474]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
mov r9d, 1
mov r8d, 0xffe
lea rdx, [rbp + 0x460]
mov rcx, qword [0x1400234a8]
call qword [sym.imp.KERNEL32.dll_ReadDirectoryChangesW]
lea rax, [rbp + 0x460]
mov qword [rbp + 0x1498], rax
mov rax, qword [rbp + 0x1498]
mov eax, dword [rax + 8]
xor edx, edx
mov ecx, 2
div rcx
mov qword [rbp + 0x14f8], rax
xor eax, eax
mov rcx, qword [rbp + 0x1498]
mov rdx, qword [rbp + 0x14f8]
mov word [rcx + rdx*2 + 0xc], ax
mov rax, qword [rbp + 0x1498]
add rax, 0xc
mov qword [rbp + 0x14b8], rax
lea r8, [rbp + 0x14d8]
mov edx, 0x104
mov rcx, qword [rbp + 0x14b8]
call fcn.1400111bd
lea rdx, str..rbs
mov rcx, qword [rbp + 0x14d8]
call qword [sym.imp.ucrtbased.dll_wcscmp]
test eax, eax
jne 0x140015f76
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x20000004
mov edx, 1
mov rcx, qword [0x1400234a8]
call qword [sym.imp.ADVAPI32.dll_SetSecurityInfo]
mov rcx, qword [0x1400234a8]
call fcn.1400111b8
test eax, eax
jne 0x140016088
jmp 0x140016076
lea rcx, str.C:Config.msi
call fcn.140011028
mov r9d, 2
mov r8d, 7
mov edx, 1
mov rcx, rax
call fcn.140011249
mov qword [rbp + 0x1518], rax
mov rax, qword [rbp + 0x1498]
add rax, 0xc
mov r8, rax
lea rdx, str.C:Config.msi_s
lea rcx, [rbp + 0x1540]
call fcn.140011348
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 7
mov edx, 0x40000000
lea rcx, [rbp + 0x1540]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbp + 0x1768], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, dword [0x140023b00]
mov rdx, qword [0x140023af8]
mov rcx, qword [rbp + 0x1768]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140016149
lea rcx, str.___Rollback_file_overwritten__n
call fcn.140011271
jmp 0x140016155
lea rcx, str.____Failed_to_overwrite_rbs_file__n
call fcn.140011271
mov rcx, qword [rbp + 0x1768]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x1518]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x1400234a0]
call fcn.140011519
lea rdx, str.__C:Config.msi::_INDEX_ALLOCATION
lea rcx, [0x1400238d0]
call fcn.140011555
jmp 0x140016192
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, [0x14001fa60]
call fcn.1400114ba
mov rax, rdi
mov rcx, qword [rbp + 0x1da0]
xor rcx, rbp
call fcn.14001128f
lea rsp, [rbp + 0x1db8]
pop rdi
pop rbp
ret