Function at 0x1800019d0
Capabilities:
Create process on windows
Terminate process
Write and execute a file
Write file on windows

Disassembly:
test rcx, rcx
je 0x180001cae
mov rax, rsp
push rbx
sub rsp, 0xf0
mov rbx, rdx
test rdx, rdx
je 0x180001ca6
mov qword [rax + 0x20], rdi
mov edi, dword [rcx + 8]
cmp edi, 1
jb 0x180001c9e
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax - 0x10], r14
mov r14, qword [rcx]
mov qword [rax - 0x18], r15
movzx edx, byte [r14]
test edx, edx
je 0x180001c38
sub edx, 1
je 0x180001b3a
sub edx, 1
je 0x180001b2d
sub edx, 1
je 0x180001a47
cmp edx, 0xfc
je 0x180001c7e
jmp 0x180001c49
xor esi, esi
mov ecx, esi
cmp word [r14 + 1], cx
je 0x180001a5c
inc ecx
cmp word [r14 + rcx*2 + 1], si
jne 0x180001a52
lea ecx, [rcx*2 + 2]
mov r8, rdi
mov r15d, ecx
lea rax, [rdi - 1]
cmp r15, rax
ja 0x180001c34
sub edi, ecx
lea rdx, [rcx + 1]
dec edi
mov eax, edi
add rdx, rax
cmp rdx, r8
jne 0x180001c34
mov qword [rsp + 0x30], rsi
lea rcx, [r14 + 1]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 2
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x180001c34
lea rdx, [r14 + 1]
mov qword [rsp + 0x20], rsi
add rdx, r15
lea r9, [rsp + 0x100]
mov r8d, edi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbp
test eax, eax
jne 0x180001af7
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x180001c45
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 1
lea ecx, [rdx + 0x3f]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
test rax, rax
jne 0x180001b19
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov qword [rbx], rax
mov dword [rbx + 8], 1
mov byte [rax], 3
mov al, 1
jmp 0x180001c45
mov rdx, rbx
call fcn.180001880
jmp 0x180001c40
xor esi, esi
lea rdx, [r14 + 1]
mov ecx, esi
cmp word [rdx], cx
je 0x180001b4f
inc ecx
cmp word [rdx + rcx*2], si
jne 0x180001b47
lea ecx, [rcx*2 + 2]
lea rax, [rdi - 1]
cmp rcx, rax
jne 0x180001c08
xor eax, eax
mov qword [rsp + 0x50], rsi
lea rdi, [rsp + 0x70]
mov qword [rsp + 0x58], rsi
mov ecx, 0x68
mov qword [rsp + 0x60], rsi
rep stosb byte [rdi], al
lea rax, [rsp + 0x50]
mov dword [rsp + 0x70], 0x68
mov qword [rsp + 0x48], rax
xor r9d, r9d
lea rax, [rsp + 0x70]
mov dword [rsp + 0xac], 1
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov qword [rsp + 0x38], rsi
xor ecx, ecx
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 1
mov word [rsp + 0xb0], si
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x180001c08
mov edx, 1
lea ecx, [rdx + 0x3f]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
test rax, rax
jne 0x180001bf7
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov qword [rbx], rax
mov dword [rbx + 8], 1
mov byte [rax], 1
mov al, 1
jmp 0x180001c45
mov rdi, qword [rbx]
mov eax, dword [rbx + 8]
mov rcx, rdi
test rdi, rdi
je 0x180001c23
test eax, eax
je 0x180001c23
mov ecx, eax
xor eax, eax
rep stosb byte [rdi], al
mov rcx, qword [rbx]
test rcx, rcx
je 0x180001c31
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rbx], rsi
mov dword [rbx + 8], esi
xor al, al
jmp 0x180001c45
mov rdx, rbx
call fcn.1800015b0
test eax, eax
setne al
test al, al
jne 0x180001c7e
mov edx, 5
lea ecx, [rdx + 0x3b]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
test rax, rax
jne 0x180001c65
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov qword [rbx], rax
mov dword [rbx + 8], 5
mov byte [rax], 0xff
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rbx]
mov dword [rcx + 1], eax
mov r14, qword [rsp + 0xe8]
mov rbp, qword [rsp + 0x108]
mov rsi, qword [rsp + 0x110]
mov r15, qword [rsp + 0xe0]
mov rdi, qword [rsp + 0x118]
add rsp, 0xf0
pop rbx
ret