Function at 0x18000cc64
Capabilities:
Create a process with modified i/o handles and window
Create process on windows
Delete file
Get common file path
Query environment variable
Read file via mapping
Write and execute a file
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xe0
xor esi, esi
mov rbx, rdx
test rcx, rcx
jne 0x18000cc87
xor al, al
jmp 0x18000cebf
cmp rcx, 0xffffffffffffffff
je 0x18000cc80
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapValidate]
test eax, eax
je 0x18000cc80
test rbx, rbx
je 0x18000cc80
cmp rbx, 0xffffffffffffffff
je 0x18000cc80
xor r9d, r9d
xor r8d, r8d
mov rcx, rbx
lea edx, [r9 + 4]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rbx, rax
test rax, rax
jne 0x18000cce0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x18003a7cc]
mov ecx, 0x3dc
call fcn.180030818
jmp 0x18000cc80
lea rcx, str.TEMP
call qword [sym.imp.msvcrt.dll_getenv]
mov edi, 0x1e05
xor r9d, r9d
mov rdx, rax
mov r8d, edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x18000cd29
lea rdx, str.___CANNOT_WRITE_TO__d_n
mov r8d, edi
mov ecx, 0x3e5
call fcn.180030818
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
jmp 0x18000cc80
lea rdx, [0x18003a400]
xor r8d, r8d
mov ecx, 0x3e9
call fcn.180030818
mov qword [rsp + 0x30], rsi
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
xor ecx, ecx
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x18000cd92
lea rdx, [0x18003a7cc]
mov ecx, 0x3f0
call fcn.180030818
mov ecx, 0x3f1
lea rdx, str._HeapFree__NULL_n
call fcn.180030818
jmp 0x18000cd1b
mov r8d, dword [rbx]
lea rdx, [rbx + 4]
lea r9, [rsp + 0xf0]
mov rcx, rax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x18000cdd4
lea rdx, [0x18003a7cc]
mov ecx, 0x3fb
call fcn.180030818
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x3fd
jmp 0x18000cd84
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
xor edx, edx
lea rcx, [rsp + 0x70]
lea r8d, [rdx + 0x68]
call qword [sym.imp.msvcrt.dll_memset]
xor edx, edx
lea rcx, [rsp + 0x50]
lea r8d, [rdx + 0x18]
call qword [sym.imp.msvcrt.dll_memset]
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0xac], 0x101
mov word [rsp + 0xb0], si
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x18000ce98
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [0x18003a7cc]
mov ecx, 0x41b
call fcn.180030818
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rdx, str._HeapFree__NULL_n
mov ecx, 0x41d
jmp 0x18000ccd9
lea rdx, str.Start__s_n
xor r8d, r8d
mov ecx, 0x420
call fcn.180030818
lea rdx, str._HeapFree__NULL_n
mov ecx, 0x422
call fcn.180030818
mov al, 1
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret