Function at 0x180005000
Capabilities:
Create thread
Inject thread
Print debug messages
Resume thread

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x578
mov r15d, ecx
mov edi, 1
test rdx, rdx
je 0x1800052b9
cmp qword [rsp + 0x5e8], 0
je 0x1800052b9
mov ebx, dword [rsp + 0x5f0]
test ebx, ebx
je 0x1800052b9
mov ebp, r9d
mov r13, rdx
xor eax, eax
cmp r9d, 0x8664
mov ecx, 0x7f0
cmovne rcx, rax
lea rdx, [0x180013080]
cmovne rdx, rax
cmp r9d, 0x14c
mov edi, 0x7d0
cmovne rdi, rcx
lea r12, [0x1800128b0]
cmovne r12, rdx
test r12, r12
je 0x18000528a
mov qword [rsp + 0x60], r8
mov r14d, dword [rsp + 0x600]
lea eax, [rbx + rdi]
lea esi, [r14 + rax]
add esi, 0x28
mov dword [rsp + 0x20], 4
mov rcx, r13
xor edx, edx
mov r8, rsi
mov r9d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
test rax, rax
je 0x1800052b4
mov rdx, rax
mov qword [rsp + 0x48], rsi
mov ecx, ebx
mov byte [rsp + 0x3f], r15b
movzx eax, r15b
mov dword [rsp + 0x70], eax
lea r15, [rdx + rdi]
add r15, 0x28
mov rsi, rdx
add rsi, rdi
mov qword [rsp + 0x78], r15
mov dword [rsp + 0x80], ebx
mov qword [rsp + 0x58], rcx
lea rax, [rcx + rsi]
add rax, 0x28
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x88], rax
mov dword [rsp + 0x90], r14d
lea rbx, [rsp + 0x98]
mov qword [rbx], 0
mov qword [rsp + 0x20], rbx
mov rcx, r13
mov qword [rsp + 0x40], rdx
mov r8, r12
mov r9, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov edi, 4
test eax, eax
je 0x180005291
mov qword [rsp + 0x20], rbx
lea r8, [rsp + 0x70]
mov r9d, 0x28
mov rcx, r13
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x180005291
mov qword [rsp + 0x20], rbx
mov rcx, r13
mov rdx, r15
mov r8, qword [rsp + 0x5e8]
mov r9, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x180005291
mov r8, qword [rsp + 0x5f8]
mov eax, dword [rsp + 0x600]
mov r9d, eax
mov qword [rsp + 0x20], rbx
mov rcx, r13
mov rdx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
mov r15b, byte [rsp + 0x3f]
mov rbx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
je 0x1800052a0
lea rax, [rsp + 0x6c]
mov dword [rax], 0
mov qword [rsp + 0x20], rax
mov rcx, r13
mov r8, rbx
mov r9d, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x1800052f5
mov eax, dword [rsp + 0x5e0]
cmp eax, 2
mov rdx, qword [rsp + 0x40]
je 0x1800052fc
mov edi, 0xa
cmp eax, 1
jne 0x1800052a0
cmp ebp, 0x8664
je 0x180005230
cmp ebp, 0x14c
jne 0x18000526e
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x28], 0
mov rcx, r13
xor edx, edx
xor r8d, r8d
mov r9, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rdx, qword [rsp + 0x40]
mov rdi, rax
test rax, rax
je 0x1800053af
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1800053e2
mov edi, 2
jmp 0x1800052b9
mov r15b, byte [rsp + 0x3f]
mov rbx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rcx, r13
mov r8, rbx
mov r9d, 0x4000
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
jmp 0x1800052b9
mov edi, 3
test r15b, r15b
je 0x1800052df
lea rcx, [rsp + 0xa0]
mov word [rcx], 0x49
lea eax, [rdi + 0x30]
mov word [rcx + 2], ax
mov dword [rcx + 4], 0
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, edi
add rsp, 0x578
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov edi, 5
jmp 0x18000529b
mov r14, qword [rsp + 0x60]
test r14, r14
je 0x180005351
cmp ebp, 0x14c
jne 0x18000535b
lea rdx, [rsp + 0xa0]
mov dword [rdx], 0x10002
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_Wow64GetThreadContext]
test eax, eax
je 0x1800053b9
lea rdx, [rsp + 0xa0]
mov rax, qword [rsp + 0x40]
mov dword [rdx + 0xb0], eax
mov dword [rdx + 0xa4], esi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_Wow64SetThreadContext]
jmp 0x1800053a3
mov edi, 7
jmp 0x1800052a0
cmp ebp, 0x8664
jne 0x1800053cb
lea rdx, [rsp + 0xa0]
mov dword [rdx + 0x30], 0x100002
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x1800053b9
lea rdx, [rsp + 0xa0]
mov rax, qword [rsp + 0x40]
mov qword [rdx + 0x80], rax
mov qword [rdx + 0x88], rsi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
xor ecx, ecx
test eax, eax
sete cl
lea edi, [rcx + rcx*8]
jmp 0x1800053be
mov edi, 6
jmp 0x1800052a0
mov edi, 8
mov rdx, qword [rsp + 0x40]
test edi, edi
jne 0x1800052a0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, r14
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rdx, qword [rsp + 0x40]
xor edi, edi
jmp 0x1800052a0