Function at 0x180030f14
Capabilities:
Create process on windows
Execute command

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x70
mov rcx, qword [0x1801f2490]
lea r14, [0x1801f2940]
movabs rdi, 0x6931bdb620783e86
movabs rsi, 0x5c0dbedbd4b10eb1
xor r9d, r9d
mov rdx, r14
mov rax, qword [rcx + 0x3ec8]
mov byte [rax + 0xb8], 1
mov rax, qword [rcx + 0x3ec8]
lea rcx, [rbp - 0x40]
movss xmm0, dword [rax + 0x24]
subss xmm0, dword [rax + 0x88]
mov byte [rax + 0x141], 1
addss xmm0, dword [0x18015dd64]
movss dword [rax + 0x104], xmm0
movabs rax, 0x5c0dbedbb1dc6fff
mov qword [rbp + 0x20], rax
mov rax, qword [rbp + 0x20]
mov qword [rbp - 0x40], rax
mov qword [rbp + 0x20], rdi
mov rax, qword [rbp + 0x20]
mov qword [rbp - 0x38], rax
mov qword [rbp + 0x20], rsi
mov rax, qword [rbp + 0x20]
mov qword [rbp - 0x20], rax
mov qword [rbp + 0x20], rdi
mov rax, qword [rbp + 0x20]
movdqa xmm0, xmmword [rbp - 0x40]
mov qword [rbp - 0x18], rax
xorps xmm0, xmmword [rbp - 0x20]
movdqa xmmword [rbp - 0x40], xmm0
call fcn.18005b598
and dword [rbp + 0x20], 0
lea rdx, [rbp + 0x20]
and dword [rbp + 0x24], 0
lea rcx, [rbp - 0x40]
movabs rax, 0x5c0ddbafb5d47cf2
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
mov qword [rbp - 0x40], rax
mov qword [rbp + 0x28], rdi
mov rax, qword [rbp + 0x28]
mov qword [rbp - 0x38], rax
mov qword [rbp + 0x28], rsi
mov rax, qword [rbp + 0x28]
mov qword [rbp - 0x20], rax
mov qword [rbp + 0x28], rdi
mov rax, qword [rbp + 0x28]
movdqa xmm0, xmmword [rbp - 0x40]
mov qword [rbp - 0x18], rax
xorps xmm0, xmmword [rbp - 0x20]
movdqa xmmword [rbp - 0x40], xmm0
call fcn.180057244
lea rbx, [0x18016f980]
test al, al
je 0x180031061
or r8, 0xffffffffffffffff
inc r8
cmp byte [r14 + r8], 0
jne 0x180031047
mov rdx, r14
mov rcx, rbx
call fcn.180033c0c
call fcn.180026c88
and dword [rbp + 0x20], 0
lea rdx, [rbp + 0x20]
and dword [rbp + 0x24], 0
lea rcx, [rbp - 0x40]
movabs rax, 0x5c0dbedbb0d061fd
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
mov qword [rbp - 0x40], rax
mov qword [rbp + 0x28], rdi
mov rax, qword [rbp + 0x28]
mov qword [rbp - 0x38], rax
mov qword [rbp + 0x28], rsi
mov rax, qword [rbp + 0x28]
mov qword [rbp - 0x20], rax
mov qword [rbp + 0x28], rdi
mov rax, qword [rbp + 0x28]
movdqa xmm0, xmmword [rbp - 0x40]
mov qword [rbp - 0x18], rax
xorps xmm0, xmmword [rbp - 0x20]
movdqa xmmword [rbp - 0x40], xmm0
call fcn.180057244
test al, al
je 0x1800310da
cmp qword [0x18016f998], 0xf
mov rdx, rbx
cmova rdx, qword [0x18016f980]
call fcn.180027354
and dword [rbp + 0x20], 0
lea rdx, [rbp + 0x20]
and dword [rbp + 0x24], 0
lea rcx, [rbp - 0x40]
movabs rax, 0x5c0ddbadbbdc6be3
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
mov qword [rbp - 0x40], rax
mov qword [rbp + 0x28], rdi
mov rax, qword [rbp + 0x28]
mov qword [rbp - 0x38], rax
mov qword [rbp + 0x28], rsi
mov rax, qword [rbp + 0x28]
mov qword [rbp - 0x20], rax
mov qword [rbp + 0x28], rdi
mov rax, qword [rbp + 0x28]
movdqa xmm0, xmmword [rbp - 0x40]
mov qword [rbp - 0x18], rax
xorps xmm0, xmmword [rbp - 0x20]
movdqa xmmword [rbp - 0x40], xmm0
call fcn.180057244
test al, al
je 0x180031153
cmp qword [0x18016f998], 0xf
cmova rbx, qword [0x18016f980]
mov rdx, rbx
call fcn.18002714c
and dword [rbp + 0x20], 0
lea rdx, [rbp + 0x20]
and dword [rbp + 0x24], 0
lea rcx, [rbp - 0x40]
movabs rax, 0x5c69ccb4b7c267f5
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
mov qword [rbp - 0x40], rax
mov qword [rbp + 0x28], rdi
mov rax, qword [rbp + 0x28]
mov qword [rbp - 0x38], rax
mov qword [rbp + 0x28], rsi
mov rax, qword [rbp + 0x28]
mov qword [rbp - 0x20], rax
mov qword [rbp + 0x28], rdi
mov rax, qword [rbp + 0x28]
movdqa xmm0, xmmword [rbp - 0x40]
mov qword [rbp - 0x18], rax
xorps xmm0, xmmword [rbp - 0x20]
movdqa xmmword [rbp - 0x40], xmm0
call fcn.180057244
test al, al
je 0x1800311d6
mov dword [rsp + 0x28], 5
lea r8, str.https:__discord.gg_jKBrCFBttg
and qword [rsp + 0x20], 0
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
and dword [rbp + 0x20], 0
lea rdx, [rbp + 0x20]
and dword [rbp + 0x24], 0
lea rcx, [rbp - 0x40]
movabs rax, 0x3062f8fbbad47efe
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
mov qword [rbp - 0x40], rax
movabs rax, 0x6931bdb6200a5be2
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
mov qword [rbp - 0x38], rax
mov qword [rbp + 0x28], rsi
mov rax, qword [rbp + 0x28]
mov qword [rbp - 0x20], rax
mov qword [rbp + 0x28], rdi
mov rax, qword [rbp + 0x28]
movdqa xmm0, xmmword [rbp - 0x40]
mov qword [rbp - 0x18], rax
xorps xmm0, xmmword [rbp - 0x20]
movdqa xmmword [rbp - 0x40], xmm0
call fcn.180057244
test al, al
je 0x1800312fd
movabs rcx, 0x7f187078214cf188
movabs rax, 0x664e9eafa6d07ac2
mov qword [rbp + 0x20], rax
mov rax, qword [rbp + 0x20]
mov qword [rbp - 0x20], rax
movabs rax, 0x87993c253197ada
mov qword [rbp + 0x20], rax
mov rax, qword [rbp + 0x20]
mov qword [rbp - 0x18], rax
movabs rax, 0xc1d02a8d9b68a8f0
mov qword [rbp + 0x20], rax
mov rax, qword [rbp + 0x20]
mov qword [rbp - 0x10], rax
mov qword [rbp + 0x20], rcx
mov rax, qword [rbp + 0x20]
mov qword [rbp - 8], rax
mov qword [rbp + 0x20], rsi
mov rax, qword [rbp + 0x20]
mov qword [rbp - 0x40], rax
mov qword [rbp + 0x20], rdi
mov rax, qword [rbp + 0x20]
mov qword [rbp - 0x38], rax
movabs rax, 0xc1d02a8d9b68c393
mov qword [rbp + 0x20], rax
mov rax, qword [rbp + 0x20]
mov qword [rbp - 0x30], rax
mov qword [rbp + 0x20], rcx
lea rcx, [rbp - 0x20]
mov rax, qword [rbp + 0x20]
movdqa xmm0, xmmword [rbp - 0x20]
movdqa xmm1, xmmword [rbp - 0x10]
xorps xmm0, xmmword [rbp - 0x40]
mov qword [rbp - 0x28], rax
xorps xmm1, xmmword [rbp - 0x30]
movdqa xmmword [rbp - 0x20], xmm0
movdqa xmmword [rbp - 0x10], xmm1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
and dword [rbp + 0x20], 0
lea rdx, [rbp + 0x20]
and dword [rbp + 0x24], 0
lea rcx, [rbp - 0x40]
movabs rax, 0x1f2ddababbdd60e4
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
mov qword [rbp - 0x40], rax
movabs rax, 0x6931bdb654195bee
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
mov qword [rbp - 0x38], rax
mov qword [rbp + 0x28], rsi
mov rax, qword [rbp + 0x28]
mov qword [rbp - 0x20], rax
mov qword [rbp + 0x28], rdi
mov rax, qword [rbp + 0x28]
movdqa xmm0, xmmword [rbp - 0x40]
mov qword [rbp - 0x18], rax
xorps xmm0, xmmword [rbp - 0x20]
movdqa xmmword [rbp - 0x40], xmm0
call fcn.180057244
test al, al
je 0x18003136f
mov byte [0x1801f23a5], 1
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
jmp fcn.18003d8e8