Function at 0x14001662c
Capabilities:
Create process on windows
Delete file
Get common file path
Write and execute a file
Write file on windows

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x880
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov rax, qword [0x140051040]
xor rax, rsp
mov qword [rsp + 0x870], rax
and dword [rsp + 0x70], 0
xor edx, edx
mov r8d, 0x7fc
lea rcx, [rsp + 0x74]
call fcn.140021ef0
lea rdx, [rsp + 0x70]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov ebx, 0x13
mov ecx, ebx
call fcn.140014d98
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.1400052d4
nop
lea rdx, [0x14003a1a0]
lea rcx, [rsp + 0x60]
call fcn.140004c38
mov rdi, rax
lea rdx, [0x14003aad8]
lea rcx, [rsp + 0x50]
call fcn.140004c38
nop
mov r8, qword [rdi]
mov rdx, qword [rax]
lea rcx, [rsp + 0x58]
call fcn.1400048a0
nop
lea rcx, [rsp + 0x50]
call fcn.140004268
nop
lea rcx, [rsp + 0x60]
call fcn.140004268
lea rdi, [rsp + 0x70]
xor eax, eax
or rbp, 0xffffffffffffffff
mov rcx, rbp
repne scasw ax, word [rdi]
mov rax, qword [str.translate_]
mov qword [rdi - 2], rax
mov rax, qword [0x14003aac8]
mov qword [rdi + 6], rax
mov eax, dword [0x14003aad0]
mov dword [rdi + 0xe], eax
movzx eax, word [0x14003aad4]
mov word [rdi + 0x12], ax
lea rdi, [rsp + 0x70]
xor eax, eax
mov rcx, rbp
repne scasw ax, word [rdi]
mov rdx, qword [rsp + 0x58]
xor ecx, ecx
movzx eax, word [rdx + rcx]
mov word [rdi + rcx - 2], ax
add rcx, 2
test ax, ax
jne 0x140016736
lea rdi, [rsp + 0x70]
xor eax, eax
mov rcx, rbp
repne scasw ax, word [rdi]
mov rax, qword [str..txt]
mov qword [rdi - 2], rax
movzx eax, word [0x14003aab8]
mov word [rdi + 6], ax
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rsp + 0x40]
call fcn.140004508
nop
lea rdx, str._r_nPlease_dont_forget__Write_in_e_mail_subject:_Strings_for:
lea rcx, [rsp + 0x40]
call fcn.140004544
mov ecx, ebx
call fcn.140014d98
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140004544
lea rdx, str._and_Language_Name_:_German___Deutsch
lea rcx, [rsp + 0x40]
call fcn.140004544
lea rdi, [0x140039ff8]
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.140004544
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.140004544
mov ecx, 0x19
call fcn.140014d98
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140004544
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.140004544
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.140004544
lea rdx, [0x14003a9d0]
lea rcx, [rsp + 0x40]
call fcn.140004544
mov rdx, qword [0x140053c48]
lea rcx, [rsp + 0x40]
call fcn.140004544
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.140004544
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.140004544
lea rdx, [0x14006db40]
lea rcx, [rsp + 0x40]
call fcn.14000451c
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.140004544
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.140004544
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 1]
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, rbp
je 0x140016914
and dword [rsp + 0x50], 0
mov eax, 0xfeff
mov word [rsp + 0x48], ax
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x50]
mov r8d, 2
lea rdx, [rsp + 0x48]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea rcx, [rsp + 0x40]
call fcn.14000424c
mov rdx, rax
and dword [rsp + 0x50], 0
xor eax, eax
mov rcx, rbp
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx + rcx - 2]
and qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x28], 5
and qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rsp + 0x70]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rcx, [rsp + 0x40]
call fcn.140004268
nop
lea rcx, [rsp + 0x58]
call fcn.140004268
mov rcx, qword [rsp + 0x870]
xor rcx, rsp
call fcn.140021e20
lea r11, [rsp + 0x880]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret