Function at 0x18000afac
Capabilities:
Create process on windows
Get common file path
Write and execute a file
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x360]
sub rsp, 0x460
mov rax, qword [0x180013578]
mov ebx, ecx
lea r9, [rbp + 0x3a0]
mov ecx, dword [rax + 0x18]
mov r8d, 0x2328
add rcx, rax
lea rax, [rbp + 0x390]
mov qword [rsp + 0x20], rax
call fcn.180006240
lea rdx, [rbp + 0x150]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea r9, [rsp + 0x40]
lea rdx, [0x18001055c]
lea rcx, [rbp + 0x150]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
xor r15d, r15d
lea r14d, [r15 + 1]
mov ecx, r15d
cmp word [rsp + 0x40], r15w
je 0x18000b046
lea rax, [rsp + 0x40]
lea rax, [rax + 2]
add ecx, r14d
cmp word [rax], r15w
jne 0x18000b039
dec ebx
je 0x18000b207
dec ebx
je 0x18000b1da
sub ebx, 3
je 0x18000b1a7
dec ebx
je 0x18000b166
dec ebx
je 0x18000b135
dec ebx
je 0x18000b0ff
dec ebx
je 0x18000b0be
dec ebx
jne 0x18000b246
movsxd rax, ecx
lea edx, [rbx + 0x2e]
inc ecx
mov word [rsp + rax*2 + 0x40], dx
lea edx, [rbx + 0x70]
movsxd rax, ecx
mov word [rsp + rax*2 + 0x40], dx
add ecx, r14d
movsxd rax, ecx
mov word [rsp + rax*2 + 0x40], dx
lea edx, [rbx + 0x74]
add ecx, r14d
movsxd rax, ecx
mov word [rsp + rax*2 + 0x40], dx
mov edx, 0x78
jmp 0x18000b238
movsxd rax, ecx
mov edx, 0x2e
inc ecx
mov word [rsp + rax*2 + 0x40], dx
movsxd rax, ecx
mov edx, 0x78
mov word [rsp + rax*2 + 0x40], dx
add ecx, r14d
lea r8d, [rdx - 0xc]
movsxd rax, ecx
add ecx, r14d
mov word [rsp + rax*2 + 0x40], r8w
lea r8d, [rdx - 5]
movsxd rax, ecx
mov word [rsp + rax*2 + 0x40], r8w
jmp 0x18000b238
movsxd rax, ecx
mov edx, 0x2e
inc ecx
mov word [rsp + rax*2 + 0x40], dx
movsxd rax, ecx
mov edx, 0x64
mov word [rsp + rax*2 + 0x40], dx
mov edx, 0x6f
add ecx, r14d
movsxd rax, ecx
mov word [rsp + rax*2 + 0x40], dx
mov edx, 0x63
jmp 0x18000b0a9
movsxd rax, ecx
mov edx, 0x2e
inc ecx
mov word [rsp + rax*2 + 0x40], dx
movsxd rax, ecx
mov edx, 0x70
mov word [rsp + rax*2 + 0x40], dx
add ecx, r14d
movsxd rax, ecx
mov word [rsp + rax*2 + 0x40], dx
mov edx, 0x74
jmp 0x18000b238
movsxd rax, ecx
mov edx, 0x2e
inc ecx
mov word [rsp + rax*2 + 0x40], dx
movsxd rax, ecx
mov edx, 0x78
mov word [rsp + rax*2 + 0x40], dx
lea r8d, [rdx - 0xc]
add ecx, r14d
movsxd rax, ecx
mov word [rsp + rax*2 + 0x40], r8w
lea r8d, [rdx - 5]
add ecx, r14d
movsxd rax, ecx
mov word [rsp + rax*2 + 0x40], r8w
jmp 0x18000b243
movsxd rax, ecx
mov edx, 0x2e
inc ecx
mov word [rsp + rax*2 + 0x40], dx
movsxd rax, ecx
mov edx, 0x64
mov word [rsp + rax*2 + 0x40], dx
mov edx, 0x6f
add ecx, r14d
movsxd rax, ecx
mov word [rsp + rax*2 + 0x40], dx
mov edx, 0x63
jmp 0x18000b238
movsxd rax, ecx
mov edx, 0x2e
inc ecx
mov word [rsp + rax*2 + 0x40], dx
movsxd rax, ecx
lea r8d, [rdx + 0x37]
mov word [rsp + rax*2 + 0x40], r8w
add ecx, r14d
lea edx, [r8 + 0x13]
movsxd rax, ecx
mov word [rsp + rax*2 + 0x40], dx
jmp 0x18000b196
movsxd rax, ecx
mov edx, 0x2e
inc ecx
mov word [rsp + rax*2 + 0x40], dx
movsxd rax, ecx
mov edx, 0x70
mov word [rsp + rax*2 + 0x40], dx
mov edx, 0x64
add ecx, r14d
movsxd rax, ecx
mov word [rsp + rax*2 + 0x40], dx
mov edx, 0x66
add ecx, r14d
movsxd rax, ecx
mov word [rsp + rax*2 + 0x40], dx
add ecx, r14d
movsxd rax, ecx
mov qword [rsp + 0x30], r15
lea rcx, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x28], 0x80
mov word [rsp + rax*2 + 0x40], r15w
mov ebx, r15d
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x18000b2e2
mov esi, dword [rbp + 0x390]
mov rdx, qword [rbp + 0x3a0]
lea r9, [rbp + 0x398]
mov r8d, esi
mov rcx, rax
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x18000b2b9
cmp dword [rbp + 0x398], esi
cmove ebx, r14d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x18000b2e2
lea r8, [rsp + 0x40]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r15
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov r8, qword [rbp + 0x3a0]
mov rcx, qword [0x180013580]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x4a8]
add rsp, 0x460
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret