Function at 0x1400713f0
Capabilities:
Create process on windows
Print debug messages
Write and execute a file
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x260]
sub rsp, 0x360
mov eax, dword [0x1401b88f8]
mov rdi, rcx
cmp dword [rcx], eax
jl 0x140071744
mov rax, qword [rcx + 8]
movsxd rdx, dword [rax + 4]
mov rax, qword [rdx + rcx + 0x48]
mov rbx, qword [rax + 8]
mov rcx, rbx
mov qword [rbp - 0x68], rbx
mov rax, qword [rbx]
call qword [rax + 8]
lea rcx, [rbp - 0x70]
call fcn.140005b60
mov dl, 0xa
mov rcx, rax
mov r8, qword [rax]
call qword [r8 + 0x40]
movzx r14d, al
test rbx, rbx
je 0x14007147c
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + 0x10]
test rax, rax
je 0x14007147c
mov r8, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r8]
movzx edx, r14b
lea rcx, [rdi + 8]
call fcn.140072860
lea rcx, [rdi + 8]
call fcn.140072770
mov ecx, dword [rdi + 0x80]
xor eax, eax
xor r15d, r15d
mov qword [rbp - 0x60], rax
xorps xmm0, xmm0
mov qword [rsp + 0x60], r15
mov eax, ecx
mov r9d, 0xf
and al, 0x22
mov qword [rsp + 0x68], r9
movups xmmword [rsp + 0x50], xmm0
mov byte [rsp + 0x50], r15b
movups xmmword [rbp - 0x70], xmm0
cmp al, 2
je 0x1400714eb
mov rax, qword [rdi + 0x50]
mov r8, qword [rax]
test r8, r8
je 0x1400714eb
cmp r8, qword [rdi + 0x78]
mov rax, qword [rdi + 0x30]
cmovb r8, qword [rdi + 0x78]
mov rdx, qword [rax]
sub r8, rdx
jmp 0x14007151a
test cl, 4
jne 0x140071512
mov rax, qword [rdi + 0x48]
mov rcx, qword [rax]
test rcx, rcx
je 0x140071512
mov rax, qword [rdi + 0x28]
mov rdx, qword [rax]
mov rax, qword [rdi + 0x60]
movsxd r8, dword [rax]
sub r8, rdx
add r8, rcx
jmp 0x14007151a
mov r8, qword [rbp - 0x68]
mov rdx, qword [rbp - 0x70]
test rdx, rdx
je 0x14007152e
lea rcx, [rsp + 0x50]
call fcn.14000ab80
mov r9, qword [rsp + 0x68]
mov rax, qword [0x1401b8920]
test rax, rax
je 0x140071550
mov ecx, dword [rdi]
lea rdx, [rsp + 0x50]
call rax
test al, al
jne 0x140071707
mov r9, qword [rsp + 0x68]
mov eax, dword [0x1401b70b4]
add eax, 0xfffffffe
cmp eax, 1
jbe 0x140071585
cmp dword [rdi], 2
jl 0x1400715d9
cmp r9, 0x10
lea rbx, [rsp + 0x50]
mov ecx, 2
cmovae rbx, qword [rsp + 0x50]
call fcn.1401081cc
lea rdx, [0x140146f34]
jmp 0x1400715bc
cmp r9, 0x10
lea rcx, [rsp + 0x50]
cmovae rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp qword [rsp + 0x68], 0x10
lea rbx, [rsp + 0x50]
mov ecx, 2
cmovae rbx, qword [rsp + 0x50]
call fcn.1401081cc
lea rdx, [0x140146f30]
mov r8, rbx
mov rcx, rax
call fcn.140072a70
mov ecx, 2
call fcn.1401081cc
mov rcx, rax
call fcn.140108624
xor edx, edx
xor ecx, ecx
call fcn.140072310
test dword [0x1401b70b4], 0xfffffffd
je 0x14007168f
cmp dword [0x1401b893c], r15d
jne 0x14007160f
mov rcx, qword [0x1401b8930]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x14007161b
mov rcx, qword [0x1401b8928]
call sub.KERNEL32.dll_EnterCriticalSection
call fcn.140072650
test al, al
je 0x14007166b
mov rcx, qword [0x1401b8908]
mov r9d, 2
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp qword [rsp + 0x68], 0x10
lea rdx, [rsp + 0x50]
mov r8d, dword [rsp + 0x60]
lea r9, [rbp + 0x280]
cmovae rdx, qword [rsp + 0x50]
mov rcx, qword [0x1401b8908]
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [0x1401b893c], r15d
jne 0x140071683
mov rcx, qword [0x1401b8930]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x14007168f
mov rcx, qword [0x1401b8928]
call sub.KERNEL32.dll_LeaveCriticalSection
mov eax, dword [rdi]
cmp eax, 4
jne 0x14007177c
call fcn.1400751f0
test al, al
jne 0x140071775
cmp qword [0x1401b8910], r15
je 0x140071775
lea rdx, [rsp + 0x70]
lea rcx, [rdi + 8]
call fcn.1400729d0
mov rcx, rax
call qword [0x1401b8910]
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x140071707
mov rcx, qword [rsp + 0x70]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140071702
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140071a14
call fcn.1400eef0c
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x140071744
mov rcx, qword [rsp + 0x50]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007173f
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400719fc
call fcn.1400eef0c
mov ecx, dword [rdi + 0xf8]
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, [rdi + 8]
lea r11, [rsp + 0x360]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
jmp fcn.140006ca0
call fcn.1400024f0
jmp 0x140071707
cmp eax, 3
jne 0x140071707
cmp qword [0x1401b8918], r15
lea rcx, [rdi + 8]
je 0x1400717e5
lea rdx, [rsp + 0x70]
call fcn.1400729d0
mov rcx, rax
call qword [0x1401b8918]
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x140071707
mov rcx, qword [rsp + 0x70]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140071702
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140071a02
jmp 0x140071702
lea rdx, [rbp - 0x40]
call fcn.1400729d0
mov rbx, rax
cmp qword [rax + 0x10], r15
lea r14, [rax + 0x10]
je 0x1400718b9
cmp byte [0x1401b88ff], r15b
je 0x1400718b9
mov r8d, 0x104
lea rdx, [rbp + 0x50]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edx, 0x5c
lea rcx, [rbp + 0x50]
call fcn.1400f0fd4
test rax, rax
je 0x140071836
mov word [rax + 2], r15w
lea r8, [0x140146ed0]
mov edx, 0x104
lea rcx, [rbp + 0x50]
call fcn.14010868c
cmp qword [rbx + 0x18], 0x10
jb 0x140071855
mov rbx, qword [rbx]
mov rax, qword [r14]
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x70]
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x70], rbx
call fcn.140075470
cmp qword [rbp - 0x80], r15
jne 0x1400718fc
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x1400718b9
mov rcx, qword [rsp + 0x70]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400718b4
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140071a0e
call fcn.1400eef0c
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x140071707
mov rcx, qword [rbp - 0x40]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140071702
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140071a08
jmp 0x140071702
xorps xmm0, xmm0
mov dword [rbp - 0x20], 0x68
xor eax, eax
lea rdx, [rsp + 0x70]
cmp qword [rbp - 0x78], 8
lea rcx, [rbp + 0x50]
mov dword [rbp + 0x44], eax
lea rax, [rbp - 0x58]
cmovae rdx, qword [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x48], rax
xor r8d, r8d
lea rax, [rbp - 0x20]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
movups xmmword [rbp - 0x1c], xmm0
movups xmmword [rbp - 0xc], xmm0
movups xmmword [rbp + 4], xmm0
movups xmmword [rbp + 0x14], xmm0
movups xmmword [rbp + 0x24], xmm0
movups xmmword [rbp + 0x34], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140071992
mov rcx, qword [rbp - 0x58]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400719b7
cmp qword [rbp - 0x78], 8
lea rdx, [rsp + 0x70]
mov r9d, 0x40010
lea r8, [0x140146ef8]
cmovae rdx, qword [rsp + 0x70]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x1400718b9
mov rcx, qword [rsp + 0x70]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400718b4
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140071a0e
jmp 0x1400718b4
call fcn.1400f5e30
int3
call fcn.1400f5e30
int3
call fcn.1400f5e30
int3
call fcn.1400f5e30
int3
call fcn.1400f5e30
int3