Function at 0x140001580
Capabilities:
Execute command
Read file on windows
Write and execute a file
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rdi
push r15
sub rsp, 0x50
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbp, rdx
mov ebx, ecx
mov edx, 1
mov ecx, 0x100
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
xor edi, edi
mov r15, rax
mov r8d, edi
mov r9, rax
nop dword [rax]
mov byte [r9], r8b
lea r9, [r9 + 1]
inc r8d
cmp r8d, 0x100
jl 0x1400015c0
mov qword [rsp + 0x70], rsi
lea r9, [0x140001230]
mov edx, 0x100
mov qword [rsp + 0x80], r14
mov r8d, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_qsort]
cmp ebx, 1
jle 0x14000182f
mov rbp, qword [rbp + 8]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rdi
mov rbx, 0xffffffffffffffff
mov qword [rsp + 0x38], rdi
inc rbx
cmp byte [rbx + rbp], dil
jne 0x140001621
movabs rsi, 0x7fffffffffffffff
cmp rbx, rsi
ja 0x140001869
mov qword [rsp + 0x38], 0xf
cmp rbx, 0x10
jae 0x14000166b
mov r8, rbx
mov qword [rsp + 0x30], rbx
mov rdx, rbp
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rbx + 0x20], dil
jmp 0x140001705
mov rax, rbx
or rax, 0xf
cmp rax, rsi
jbe 0x1400016a0
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140001910
test rax, rax
je 0x1400016cb
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x1400016e4
mov ecx, 0x16
mov rsi, rax
cmp rax, rcx
cmovb rsi, rcx
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x1400016d2
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000186f
jmp 0x140001685
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x1400016e1
call fcn.140001910
mov r14, rax
jmp 0x1400016e4
mov r14, rdi
mov r8, rbx
mov qword [rsp + 0x20], r14
mov rdx, rbp
mov qword [rsp + 0x30], rbx
mov rcx, r14
mov qword [rsp + 0x38], rsi
call sub.VCRUNTIME140.dll_memcpy
mov byte [r14 + rbx], dil
mov rdx, r15
lea rcx, [rsp + 0x20]
call fcn.140001260
mov edx, 1
mov ecx, 0x100
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
lea rdx, [0x1400033bc]
mov rsi, rax
lea rcx, str.data0.dat
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov edx, 4
mov dword [rsp + 0x40], edi
mov r9, rax
lea rcx, [rsp + 0x40]
mov rbx, rax
lea r8d, [rdx - 3]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
movsxd rcx, dword [rsp + 0x40]
mov edx, 1
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
movsxd r8, dword [rsp + 0x40]
mov r9, rbx
mov rcx, rax
mov edx, 1
mov rbp, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov r9, rbx
mov edx, 1
mov r8d, 0x100
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov edx, 1
mov ecx, 0x100
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov r9, rax
mov edx, edi
nop word [rax + rax]
movzx ecx, byte [rsi]
lea rsi, [rsi + 1]
mov byte [rcx + rax], dl
inc edx
cmp edx, 0x100
jl 0x1400017c0
cmp dword [rsp + 0x40], edi
jle 0x1400017f9
mov r8, rbp
nop dword [rax]
movzx eax, byte [r8]
lea r8, [r8 + 1]
inc edi
movzx ecx, byte [rax + r9]
mov byte [r8 - 1], cl
cmp edi, dword [rsp + 0x40]
jl 0x1400017e0
lea rdx, [0x1400033c0]
lea rcx, str.data1.exe
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
movsxd r8, dword [rsp + 0x40]
mov edx, 1
mov r9, rax
mov rcx, rbp
mov rbx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov r14, qword [rsp + 0x80]
xor eax, eax
mov rsi, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400018f0
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop r15
pop rdi
pop rbp
ret
call fcn.140001210
int3
call fcn.140001170
int3