Function at 0x14007bfb0
Capabilities:
Create a process with modified i/o handles and window
Create process on windows
Encode data using base64
Encrypt data using speck
Get common file path
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x6b8
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x620], xmm6
mov qword [rbp + 0x618], 0xfffffffffffffffe
mov byte [rbp + 0x4a0], r9b
mov qword [rbp + 0x5d0], r8
mov qword [rbp + 0x5a8], rcx
movzx eax, byte [rdx + 0xa0]
mov qword [rbp + 0x4b0], rdx
mov r8, qword [rdx + 0x98]
test al, al
jne 0x14007c02a
test r8, r8
jne 0x14007c02a
mov qword [rbp + 0x3e8], 0
lea rdx, [rbp + 0x3f0]
xor r12d, r12d
jmp 0x14007ca50
mov qword [rbp + 0x410], 0
mov qword [rbp + 0x420], 0
test al, al
jne 0x14007c1d9
mov qword [rbp + 0x5d8], r8
call qword [sym.imp.kernel32.dll_GetEnvironmentStringsW]
test rax, rax
je 0x14007f139
mov qword [rbp + 0x4c0], rax
lea rsi, [rbp + 0x4c8]
mov qword [rbp + 0x4c8], rax
lea r13, [rbp + 0x560]
lea rdi, [rbp - 0x30]
lea rbx, [rbp + 0x4f8]
lea r14, [rbp + 0x440]
lea r15, [rbp + 0x410]
lea r12, [rbp + 0x540]
nop word [rax + rax]
mov rcx, rdi
mov rdx, rsi
call fcn.14007ac30
mov rcx, qword [rbp - 0x30]
movabs rax, 0x8000000000000000
cmp rcx, rax
je 0x14007c1c5
mov qword [rbp + 0x5f8], rcx
mov rcx, qword [rbp - 0x28]
movups xmm6, xmmword [rbp - 0x20]
mov rax, qword [rbp - 0x10]
mov qword [rbp + 0x608], rax
mov rax, qword [rbp - 8]
mov qword [rbp + 0x5e8], rax
mov rax, qword [rbp - 0x20]
add rax, rcx
mov qword [rbp + 0x5c8], rcx
mov qword [rbp + 0x440], rcx
mov qword [rbp + 0x448], rax
mov word [rbp + 0x450], 0
mov rcx, rbx
mov rdx, r14
call fcn.14006b3f0
mov rax, qword [rbp + 0x5f8]
mov qword [rbp + 0x540], rax
mov rax, qword [rbp + 0x5c8]
mov qword [rbp + 0x548], rax
movups xmmword [rbp + 0x550], xmm6
mov rax, qword [rbp + 0x508]
mov qword [r13 + 0x10], rax
movups xmm0, xmmword [rbp + 0x4f8]
movups xmmword [r13], xmm0
mov rax, qword [rbp + 0x608]
mov qword [rbp + 0x440], rax
mov rax, qword [rbp + 0x5e8]
mov qword [rbp + 0x448], rax
lea rax, [rbp]
movups xmm0, xmmword [rax]
lea rax, [rbp + 0x450]
movups xmmword [rax], xmm0
mov byte [rbp + 0x5e7], 0
mov rcx, rbx
mov rdx, r15
mov r8, r12
mov r9, r14
call fcn.140067340
mov rdx, qword [rbp + 0x4f8]
lea rax, [rdx*2]
test rax, rax
je 0x14007c0a0
mov rcx, qword [rbp + 0x500]
mov r8d, 1
call fcn.140024320
jmp 0x14007c0a0
mov rcx, qword [rbp + 0x4c0]
call qword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
mov r8, qword [rbp + 0x5d8]
mov rcx, qword [rbp + 0x4b0]
mov rax, qword [rcx + 0x88]
mov rcx, qword [rcx + 0x90]
xor edx, edx
test rax, rax
cmove r8, rax
setne dl
mov qword [rbp + 0x4f8], rdx
mov qword [rbp + 0x500], 0
mov qword [rbp + 0x508], rax
mov qword [rbp + 0x510], rcx
mov qword [rbp + 0x518], rdx
mov qword [rbp + 0x520], 0
mov qword [rbp + 0x528], rax
mov qword [rbp + 0x530], rcx
mov qword [rbp + 0x538], r8
lea r14, [rbp + 0x4f8]
nop dword [rax + rax]
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp + 0x440], rax
lea rax, [rbp + 0x440]
mov qword [rbp + 0x540], rax
lea rax, [fcn.14006e890]
mov qword [rbp + 0x548], rax
lea rax, str.failure_getting_env_string_from_OS:
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], 1
mov qword [rbp - 0x10], 0
lea rax, [rbp + 0x540]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], 1
lea rdx, str.library_std_src_syspalwindowsos.rs
lea rcx, [rbp - 0x30]
call fcn.1400f8f70
jmp 0x14007f229