Function at 0x140007030
Capabilities:
Create process on windows
Delete file
Get common file path
Write and execute a file
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x938
mov ebx, ecx
lea rcx, [0x14001b990]
mov esi, r8d
mov rbp, r9
mov r13, rdx
call fcn.140006e10
mov r12, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, r12
mov r14, rax
call fcn.140006ea0
lea rcx, [0x14001b9af]
call fcn.140006d90
mov rcx, r14
mov r12, rax
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, r12
lea r12, [rsp + 0xf0]
mov r15, rax
call fcn.140006ea0
mov rdx, r12
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
xor r8d, r8d
mov rcx, r12
mov r9, r12
mov rdi, qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea rdx, [0x14001b9ca]
call rdi
mov r14, qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, r12
call r14
test eax, eax
je 0x1400070ea
xor ecx, ecx
mov rdx, r12
call r15
test eax, eax
je 0x140007108
cmp eax, 0xb7
je 0x140007108
xor r13d, r13d
mov eax, r13d
add rsp, 0x938
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea r15, [rsp + 0x300]
xor r8d, r8d
xor edx, edx
mov rcx, r12
mov r9, r15
call rdi
mov rcx, r15
call r14
test eax, eax
je 0x1400070ea
cmp ebx, 2
je 0x1400072d8
cmp ebx, 3
je 0x1400071a8
lea rcx, [0x14001b9d2]
cmp ebx, 1
je 0x1400071af
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, r15
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400070ea
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x1400071e0
mov rcx, rdi
xor r13d, r13d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400070ed
lea rcx, [0x14001b9f4]
call fcn.140006e10
mov rcx, r15
mov r12, rax
call sub.msvcrt.dll_wcslen
mov rdx, r12
lea rcx, [r15 + rax*2 - 8]
call sub.msvcrt.dll_wcscpy
mov rcx, r12
call fcn.140006ea0
jmp 0x140007141
lea r12, [rsp + 0x720]
mov rdx, r13
mov rcx, rdi
mov qword [rsp + 0x20], 0
mov r9, r12
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
mov r13d, eax
test eax, eax
jne 0x140007220
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400070ed
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rsi
cmp ebx, 2
je 0x1400073c0
cmp ebx, 3
je 0x1400072e8
cmp ebx, 1
jne 0x1400070ea
lea rdx, [rsp + 0x80]
xor eax, eax
xor r9d, r9d
xor r8d, r8d
mov rdi, rdx
mov ecx, 0xd
mov qword [rsp + 0x60], 0
rep stosq qword [rdi], rax
lea rax, [rsp + 0x60]
mov rcx, r15
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x68], 0
xor edx, edx
mov qword [rsp + 0x70], 0
mov dword [rsp + 0x80], 0x68
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x1400073a0
mov rcx, r15
call r14
jmp 0x1400070ea
lea rcx, [0x14001b9e3]
jmp 0x1400071af
lea rbx, [rsp + 0x80]
xor eax, eax
mov ecx, 0xd
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov rdi, rbx
rep stosq qword [rdi], rax
lea rcx, [0x14001ba68]
mov qword [rsp + 0x70], 0
lea rdi, [rsp + 0x60]
mov dword [rsp + 0x80], 0x68
call fcn.140006e10
mov qword [rsp + 0x20], r15
mov edx, 0x104
mov rcx, r12
mov r13, rax
mov r9, rax
lea r8, str._ls___ls_
call fcn.140006ee0
mov rcx, r13
call fcn.140006ea0
mov qword [rsp + 0x48], rdi
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], 0
mov rdx, r12
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1400072c9
mov rcx, qword [rsp + 0x60]
mov r13d, 1
call rsi
mov rcx, qword [rsp + 0x68]
call rsi
jmp 0x1400070ed
lea rbx, [rsp + 0x80]
xor eax, eax
mov ecx, 0xd
mov edx, 0x104
mov qword [rsp + 0x60], 0
mov rdi, rbx
rep stosq qword [rdi], rax
lea rdi, [rsp + 0x510]
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 0
mov rcx, rdi
mov dword [rsp + 0x80], 0x68
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea rcx, [0x14001ba08]
call fcn.140006e10
mov qword [rsp + 0x28], r15
mov r9, rdi
mov rcx, r12
mov qword [rsp + 0x20], rax
lea r8, str._ls_ls___ls__
mov edx, 0x104
mov r13, rax
call fcn.140006ee0
xor edx, edx
mov r9d, 0xffffffff
mov r8, rbp
mov dword [rsp + 0x28], 0
mov rdi, qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, 0xfde9
mov qword [rsp + 0x20], 0
call rdi
xor r10d, r10d
mov edx, eax
test eax, eax
je 0x1400074b5
cdqe
mov dword [rsp + 0x58], edx
lea rcx, [rax + rax + 2]
call fcn.140005de0
mov r10, rax
test rax, rax
je 0x1400074b5
mov edx, dword [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r8, rbp
mov ecx, 0xfde9
mov qword [rsp + 0x58], rax
mov r9d, 0xffffffff
mov dword [rsp + 0x28], edx
xor edx, edx
call rdi
mov r10, qword [rsp + 0x58]
mov rdx, r10
mov rcx, r12
mov qword [rsp + 0x58], r10
call sub.msvcrt.dll_wcscat
mov r10, qword [rsp + 0x58]
mov rcx, r10
call fcn.140005e40
mov rcx, r13
call fcn.140006ea0
cmp qword [rsp + 0x9a0], 0
je 0x140007507
lea rcx, [0x14001ba48]
call fcn.140006e10
mov rcx, r12
mov r13, rax
mov rdx, rax
call sub.msvcrt.dll_wcscat
mov rcx, r13
call fcn.140006ea0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rax
jmp 0x140007360