Function at 0x180013840
Capabilities:
Create process on windows
Create process suspended
Create thread
Delete directory
Delete file
Inject thread
Read file via mapping
Suspend thread

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xd0]
sub rsp, 0x1d0
mov rax, qword [0x1800660c0]
xor rax, rsp
mov qword [rbp + 0xc0], rax
mov qword [rbp - 0x78], r9
mov qword [rbp - 0x80], r8
mov rsi, rdx
mov rdi, rcx
mov rax, qword [rbp + 0x130]
mov qword [rsp + 0x58], rax
xor r15d, r15d
mov dword [rbp - 0x50], 0x68
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
movups xmmword [rbp - 8], xmm0
movups xmmword [rbp + 8], xmm0
xor eax, eax
movups xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], rax
mov r14, 0xffffffffffffffff
mov r8, r14
inc r8
cmp word [rcx + r8*2], ax
jne 0x1800138c3
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], r15
mov qword [rbp + 0x38], r15
mov rdx, rdi
lea rcx, [rbp + 0x20]
call fcn.180012670
nop
lea r11, [rbp + 0x20]
cmp qword [rbp + 0x38], 7
cmova r11, qword [rbp + 0x20]
mov rax, qword [rbp + 0x30]
lea rdx, [r11 + rax*2]
mov rcx, r11
call fcn.1800127a0
mov r10, rax
cmp rax, rdx
je 0x18001394e
nop
lea r8, [rdx - 2]
movzx ecx, word [r8]
cmp cx, 0x5c
je 0x18001392e
cmp cx, 0x2f
je 0x18001392e
mov rdx, r8
cmp r10, r8
jne 0x180013910
jmp 0x18001394e
cmp r10, rdx
je 0x18001394e
lea rcx, [rdx - 2]
movzx eax, word [rcx]
cmp ax, 0x5c
je 0x180013946
cmp ax, 0x2f
jne 0x18001394e
mov rdx, rcx
cmp r10, rcx
jne 0x180013933
sub rdx, r11
sar rdx, 1
xorps xmm0, xmm0
movups xmmword [rbp + 0x80], xmm0
mov qword [rbp + 0x90], r15
mov qword [rbp + 0x98], r15
mov r8, rdx
mov rdx, r11
lea rcx, [rbp + 0x80]
call fcn.180012670
nop
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0x60]
call fcn.180012930
nop
lea rbx, [rbp + 0x60]
cmp qword [rbp + 0x78], 7
cmova rbx, qword [rbp + 0x60]
lea rax, str.0_1
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 7
mov qword [rbp + 0xb0], rdi
movabs rax, 0xb000000000000000
mov qword [rbp + 0xa0], rax
mov qword [rbp + 0xb8], rsi
movabs rax, 0xb000000000000008
mov qword [rbp + 0xa8], rax
mov qword [rsp + 0x60], 2
lea rax, [rbp + 0xa0]
mov qword [rsp + 0x68], rax
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm0
movaps xmm1, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0x70], xmm1
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x40]
call fcn.180005980
lea rdx, [rbp + 0x40]
cmp qword [rbp + 0x58], 7
cmova rdx, qword [rbp + 0x40]
lea rax, [rbp - 0x70]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ebx, eax
mov rdx, qword [rbp + 0x58]
cmp rdx, 7
jbe 0x180013aa5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180013aa0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180013e4b
call fcn.180015d88
movdqa xmm0, xmmword [0x18005e9f0]
movdqu xmmword [rbp + 0x50], xmm0
mov word [rbp + 0x40], r15w
mov rdx, qword [rbp + 0x78]
cmp rdx, 7
jbe 0x180013af7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180013af2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180013e51
call fcn.180015d88
movdqa xmm0, xmmword [0x18005e9f0]
movdqu xmmword [rbp + 0x70], xmm0
mov word [rbp + 0x60], r15w
mov rdx, qword [rbp + 0x98]
cmp rdx, 7
jbe 0x180013b50
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180013b4a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180013e57
call fcn.180015d88
nop
mov rdx, qword [rbp + 0x38]
cmp rdx, 7
jbe 0x180013b90
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180013b8b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180013e5d
call fcn.180015d88
test ebx, ebx
je 0x180013e19
mov r12, qword [rbp - 0x70]
mov r15, qword [rbp - 0x68]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_SuspendThread]
lea rdx, str.Divine.Injector.CLR.dll
mov ecx, 1
call fcn.180012b70
mov rsi, rax
test rax, rax
je 0x180013e19
lea rax, [0x18005e8c8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xa28
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 4]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov r13, rax
mov qword [rsp + 0x20], 0xa28
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf001f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rbx, rax
mov r8, qword [rbp - 0x80]
mov edx, 0x104
mov rcx, rax
call fcn.18001ec74
lea rcx, [rbx + 0x208]
mov r8, qword [rbp - 0x78]
mov edx, 0x104
call fcn.18001ec74
lea rcx, [rbx + 0x410]
mov r8, qword [rsp + 0x58]
mov edx, 0x104
call fcn.18001ec74
lea rcx, [rbx + 0x618]
lea r8, str.Divine.Zero.Service.Loader__Divine.Zero
mov edx, 0x104
call fcn.18001ec74
lea rcx, [rbx + 0x820]
lea r8, str.Initialize
mov edx, 0x104
call fcn.18001ec74
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
lea r9, [0x18005e958]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rsp + 0x58], rax
mov rbx, rsi
cmp qword [rsi + 0x18], 7
jbe 0x180013cb0
mov rbx, qword [rsi]
nop word [rax + rax]
inc r14
cmp word [rbx + r14*2], 0
jne 0x180013cb0
add r14, r14
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8, r14
xor edx, edx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rdi, rax
mov qword [rsp + 0x20], 0
mov r9, r14
mov r8, rbx
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xor eax, eax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
mov r9, qword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor r8d, r8d
xor edx, edx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rbx, rax
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov r9d, 0x8000
mov r8, r14
mov rdx, rdi
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0x3a98
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rsi
cmp qword [rsi + 0x18], 7
jbe 0x180013d9f
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rsi + 0x20]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov rdx, qword [rsi + 0x18]
cmp rdx, 7
jbe 0x180013dea
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsi]
cmp rdx, 0x1000
jb 0x180013de5
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180013e45
mov rcx, r8
call fcn.180015d88
xor eax, eax
mov qword [rsi + 0x10], rax
mov qword [rsi + 0x18], 7
mov word [rsi], ax
lea edx, [rax + 0x28]
mov rcx, rsi
call fcn.180015d88
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x50], 0
setne al
jmp 0x180013e1b
xor al, al
mov rcx, qword [rbp + 0xc0]
xor rcx, rsp
call fcn.180015d60
mov rbx, qword [rsp + 0x210]
add rsp, 0x1d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.18001df38
nop
call fcn.18001df38
nop
call fcn.18001df38
nop
call fcn.18001df38
nop
call fcn.18001df38
int3