Function at 0x1400023c0
Capabilities:
Create process on windows
Get common file path
Self delete

Disassembly:
sub rsp, 0x378
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x360], rax
mov r8d, 0x104
lea rdx, [rsp + 0x250]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rdx, [rsp + 0x140]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
lea r8, str.00.bat
mov edx, 0x104
lea rcx, [rsp + 0x140]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
xor edx, edx
mov r8d, 0x108
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
lea rdx, [rsp + 0x140]
lea rcx, [rsp + 0x30]
call fcn.1400032b0
nop
cmp qword [rsp + 0xb8], 0
je 0x140002540
lea rdx, str.:Repeat
lea rcx, [rsp + 0x30]
call fcn.140001300
mov rcx, rax
lea rdx, [0x1400014e0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.del__
lea rcx, [rsp + 0x30]
call fcn.140001300
mov rcx, rax
lea rdx, [rsp + 0x250]
call fcn.140001300
mov rcx, rax
lea rdx, [0x140006b20]
call fcn.140001300
mov rcx, rax
lea rdx, [0x1400014e0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.if_exist__
lea rcx, [rsp + 0x30]
call fcn.140001300
mov rcx, rax
lea rdx, [rsp + 0x250]
call fcn.140001300
mov rcx, rax
lea rdx, str.__goto_Repeat
call fcn.140001300
mov rcx, rax
lea rdx, [0x1400014e0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.del___f0_
lea rcx, [rsp + 0x30]
call fcn.140001300
mov rcx, rax
lea rdx, [0x1400014e0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rsp + 0x38]
call fcn.140003670
test rax, rax
jne 0x140002540
mov rax, qword [rsp + 0x30]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x30]
add rcx, rax
xor r8d, r8d
mov edx, 2
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
xor eax, eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rsp + 0x140]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
lea rcx, [rsp + 0x30]
call fcn.140002590
xor al, al
mov rcx, qword [rsp + 0x360]
xor rcx, rsp
call fcn.140003eb0
add rsp, 0x378
ret